diff --git a/Jenkinsfile b/Jenkinsfile
index ff0a5f309a85..fca3886b9e34 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -50,23 +50,21 @@ node('ubuntu') {
         """.trim()
         def FULL_COMMAND
 
-        withCredentials([string(credentialsId: 'SONARCLOUD_TOKEN', variable: 'SONAR_TOKEN')]) {
-          if (env.BRANCH_NAME.startsWith("PR-")) {
-            def PR_ARGS = """
-               -Dsonar.pullrequest.branch=${CHANGE_BRANCH} \
-               -Dsonar.pullrequest.base=${CHANGE_TARGET} \
-               -Dsonar.pullrequest.key=${CHANGE_ID} \
-            """.trim()
-            FULL_COMMAND = "./gradlew ${COMMON_ARGS} ${PR_ARGS}"
-          } else {
-            FULL_COMMAND = "./gradlew ${COMMON_ARGS} -Dsonar.branch.name=${BRANCH_NAME}"
-          }
+        if (env.BRANCH_NAME.startsWith("PR-")) {
+          def PR_ARGS = """
+             -Dsonar.pullrequest.branch=${CHANGE_BRANCH} \
+             -Dsonar.pullrequest.base=${CHANGE_TARGET} \
+             -Dsonar.pullrequest.key=${CHANGE_ID} \
+          """.trim()
+          FULL_COMMAND = "./gradlew ${COMMON_ARGS} ${PR_ARGS}"
+        } else {
+          FULL_COMMAND = "./gradlew ${COMMON_ARGS} -Dsonar.branch.name=${BRANCH_NAME}"
         }
 
         // to avoid problems with Groovy's interpolation for secrets
-        withEnv(["SONAR_TOKEN=${SONAR_TOKEN}"]) {
+        withCredentials([string(credentialsId: 'SONARCLOUD_TOKEN', variable: 'SONAR_TOKEN')]) {
             sh """
-                ./gradlew ${FULL_COMMAND} -Dsonar.token=\$SONAR_TOKEN
+                ./gradlew ${FULL_COMMAND} -Dsonar.token=${SONAR_TOKEN}
             """
         }
       }