diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9abfdaac..9a4a1636 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,8 +11,13 @@
   - `EOS_INTERVAL` (`--eos-interval`) to set the interval in which the operator checks if it is EoS.
   - `EOS_DISABLED` (`--eos-disabled`) to disable the EoS checker completely.
 
+### Changed
+
+- Changed env-vars to be consistent with config-utils in the entrypoint script ([#700]).
+
 [#691]: https://github.com/stackabletech/hbase-operator/pull/691
 [#697]: https://github.com/stackabletech/hbase-operator/pull/697
+[#700]: https://github.com/stackabletech/hbase-operator/pull/700
 
 ## [25.7.0] - 2025-07-23
 
diff --git a/docs/modules/hbase/pages/reference/discovery.adoc b/docs/modules/hbase/pages/reference/discovery.adoc
index a2268903..dc912fff 100644
--- a/docs/modules/hbase/pages/reference/discovery.adoc
+++ b/docs/modules/hbase/pages/reference/discovery.adoc
@@ -41,6 +41,6 @@ Contains the needed information to connect to Zookeeper and use that to establis
 === Kerberos
 In case Kerberos is enabled according to the xref:usage-guide/security.adoc[security documentation], the discovery ConfigMap also includes the information that clients must authenticate themselves using Kerberos.
 
-If you want to use the discovery ConfigMap outside Stackable services, you need to substitute `${env.KERBEROS_REALM}` with your actual realm (e.g. by using `sed -i -e 's/${{env.KERBEROS_REALM}}/'"$KERBEROS_REALM/g" hbase-site.xml`).
+If you want to use the discovery ConfigMap outside Stackable services, you need to substitute `${env:KERBEROS_REALM}` with your actual realm (e.g. by using `sed -i -e 's/${{env:KERBEROS_REALM}}/'"$KERBEROS_REALM/g" hbase-site.xml`).
 
-One example would be the property `hbase.master.kerberos.principal` being set to `hbase/hbase.default.svc.cluster.local@${env.KERBEROS_REALM}`.
+One example would be the property `hbase.master.kerberos.principal` being set to `hbase/hbase.default.svc.cluster.local@${env:KERBEROS_REALM}`.
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index 8054c6ff..ea19a09a 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -567,15 +567,15 @@ fn build_rolegroup_config_map(
                         );
                         hbase_site_config.insert(
                             "hbase.master.hostname".to_string(),
-                            "${HBASE_SERVICE_HOST}".to_string(),
+                            "${env:HBASE_SERVICE_HOST}".to_string(),
                         );
                         hbase_site_config.insert(
                             "hbase.master.port".to_string(),
-                            "${HBASE_SERVICE_PORT}".to_string(),
+                            "${env:HBASE_SERVICE_PORT}".to_string(),
                         );
                         hbase_site_config.insert(
                             "hbase.master.info.port".to_string(),
-                            "${HBASE_INFO_PORT}".to_string(),
+                            "${env:HBASE_INFO_PORT}".to_string(),
                         );
                         hbase_site_config.insert(
                             "hbase.master.bound.info.port".to_string(),
@@ -593,15 +593,15 @@ fn build_rolegroup_config_map(
                         );
                         hbase_site_config.insert(
                             "hbase.unsafe.regionserver.hostname".to_string(),
-                            "${HBASE_SERVICE_HOST}".to_string(),
+                            "${env:HBASE_SERVICE_HOST}".to_string(),
                         );
                         hbase_site_config.insert(
                             "hbase.regionserver.port".to_string(),
-                            "${HBASE_SERVICE_PORT}".to_string(),
+                            "${env:HBASE_SERVICE_PORT}".to_string(),
                         );
                         hbase_site_config.insert(
                             "hbase.regionserver.info.port".to_string(),
-                            "${HBASE_INFO_PORT}".to_string(),
+                            "${env:HBASE_INFO_PORT}".to_string(),
                         );
                         hbase_site_config.insert(
                             "hbase.regionserver.bound.info.port".to_string(),
diff --git a/rust/operator-binary/src/kerberos.rs b/rust/operator-binary/src/kerberos.rs
index c46f91d0..e3ae1781 100644
--- a/rust/operator-binary/src/kerberos.rs
+++ b/rust/operator-binary/src/kerberos.rs
@@ -289,7 +289,7 @@ fn principal_host_part(
     })?;
     let cluster_domain = &cluster_info.cluster_domain;
     Ok(format!(
-        "{hbase_name}.{hbase_namespace}.svc.{cluster_domain}@${{env.KERBEROS_REALM}}"
+        "{hbase_name}.{hbase_namespace}.svc.{cluster_domain}@${{env:KERBEROS_REALM}}"
     ))
 }
 
diff --git a/tests/templates/kuttl/kerberos/41-access-hbase.yaml.j2 b/tests/templates/kuttl/kerberos/41-access-hbase.yaml.j2
index 2ecb0e52..d185926e 100644
--- a/tests/templates/kuttl/kerberos/41-access-hbase.yaml.j2
+++ b/tests/templates/kuttl/kerberos/41-access-hbase.yaml.j2
@@ -90,9 +90,12 @@ data:
     klist
 
     export KERBEROS_REALM=$(grep -oP 'default_realm = \K.*' /stackable/kerberos/krb5.conf)
-    cat /stackable/conf/hbase_mount/hbase-site.xml | sed -e 's/${env.KERBEROS_REALM}/'"$KERBEROS_REALM/g" > /stackable/conf/hbase/hbase-site.xml
+    # the hdfs discovery files are not written by the hbase operator and use
+    # the dot notation, so they cannot use config-utils
     cat /stackable/conf/hdfs_mount/core-site.xml | sed -e 's/${env.KERBEROS_REALM}/'"$KERBEROS_REALM/g" > /stackable/conf/hbase/core-site.xml
     cat /stackable/conf/hdfs_mount/hdfs-site.xml | sed -e 's/${env.KERBEROS_REALM}/'"$KERBEROS_REALM/g" > /stackable/conf/hbase/hdfs-site.xml
+    cp /stackable/conf/hbase_mount/hbase-site.xml /stackable/conf/hbase/hbase-site.xml
+    config-utils template /stackable/conf/hbase/hbase-site.xml
 
     cat > /tmp/hbase-script << 'EOF'
     disable 'test';
diff --git a/tests/templates/kuttl/opa/41-access-hbase.yaml.j2 b/tests/templates/kuttl/opa/41-access-hbase.yaml.j2
index 8bdecb5a..2b62a79d 100644
--- a/tests/templates/kuttl/opa/41-access-hbase.yaml.j2
+++ b/tests/templates/kuttl/opa/41-access-hbase.yaml.j2
@@ -87,9 +87,12 @@ data:
     klist -k /stackable/kerberos/keytab
 
     export KERBEROS_REALM=$(grep -oP 'default_realm = \K.*' /stackable/kerberos/krb5.conf)
-    cat /stackable/conf/hbase_mount/hbase-site.xml | sed -e 's/${env.KERBEROS_REALM}/'"$KERBEROS_REALM/g" > /stackable/conf/hbase/hbase-site.xml
+    # the hdfs discovery files are not written by the hbase operator and use
+    # the dot notation, so they cannot use config-utils
     cat /stackable/conf/hdfs_mount/core-site.xml | sed -e 's/${env.KERBEROS_REALM}/'"$KERBEROS_REALM/g" > /stackable/conf/hbase/core-site.xml
     cat /stackable/conf/hdfs_mount/hdfs-site.xml | sed -e 's/${env.KERBEROS_REALM}/'"$KERBEROS_REALM/g" > /stackable/conf/hbase/hdfs-site.xml
+    cp /stackable/conf/hbase_mount/hbase-site.xml /stackable/conf/hbase/hbase-site.xml
+    config-utils template /stackable/conf/hbase/hbase-site.xml
 
     kdestroy; kinit -kt /stackable/kerberos/keytab admin/access-hbase.$NAMESPACE.svc.cluster.local; klist