diff --git a/apps/cnquery/cmd/scan.go b/apps/cnquery/cmd/scan.go
index b1a272578c..e995179b0b 100644
--- a/apps/cnquery/cmd/scan.go
+++ b/apps/cnquery/cmd/scan.go
@@ -257,6 +257,7 @@ func getCobraScanConfig(cmd *cobra.Command, runtime *providers.Runtime, cliRes *
 				Incognito:   conf.IsIncognito,
 				Creds:       serviceAccount,
 			}
+			providers.DefaultRuntime().UpstreamConfig = conf.runtime.UpstreamConfig
 		} else {
 			log.Warn().Msg("No credentials provided. Switching to --incognito mode.")
 			conf.IsIncognito = true
diff --git a/providers/coordinator.go b/providers/coordinator.go
index 63d7c31841..265c4b9885 100644
--- a/providers/coordinator.go
+++ b/providers/coordinator.go
@@ -360,6 +360,7 @@ func (c *coordinator) newRuntime() *Runtime {
 
 func (c *coordinator) NewRuntimeFrom(parent *Runtime) *Runtime {
 	res := c.NewRuntime()
+	res.UpstreamConfig = parent.UpstreamConfig
 	res.recording = parent.Recording()
 	for k, v := range parent.providers {
 		res.providers[k] = v