diff --git a/lib/puppet/functions/docker/env.rb b/lib/puppet/functions/docker/env.rb
new file mode 100644
index 00000000..62eeacf8
--- /dev/null
+++ b/lib/puppet/functions/docker/env.rb
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+Puppet::Functions.create_function(:'docker::env') do
+  dispatch :env do
+    param 'Array', :args
+    return_type 'Array'
+  end
+
+  def env(args)
+    args
+  end
+end
diff --git a/manifests/registry.pp b/manifests/registry.pp
index b5abe5c9..a40cc8eb 100644
--- a/manifests/registry.pp
+++ b/manifests/registry.pp
@@ -134,11 +134,11 @@
         }
       } elsif $ensure == 'present' {
         exec { 'compute-hash':
-          command     => template('docker/windows/compute_hash.ps1.erb'),
-          environment => $exec_env,
+          command     => stdlib::deferrable_epp('docker/windows/compute_hash.ps1.epp', { 'passfile' => $passfile }),
+          environment => Deferred('docker::env', [$exec_env]),
           provider    => $exec_provider,
           logoutput   => true,
-          unless      => template('docker/windows/check_hash.ps1.erb'),
+          unless      => stdlib::deferrable_epp('docker/windows/check_hash.ps1.epp', { 'passfile' => $passfile }),
           notify      => Exec["${title} auth"],
         }
       }
@@ -148,8 +148,8 @@
   }
 
   exec { "${title} auth":
-    environment => $exec_env,
-    command     => $_auth_command,
+    environment => Deferred('docker::env', [$exec_env]),
+    command     => Deferred('sprintf', [$_auth_command]),
     user        => $exec_user,
     path        => $exec_path,
     timeout     => $exec_timeout,
diff --git a/spec/functions/env_spec.rb b/spec/functions/env_spec.rb
new file mode 100644
index 00000000..76265fd8
--- /dev/null
+++ b/spec/functions/env_spec.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'docker::env' do
+  it { is_expected.to run.with_params([4]).and_return([4]) }
+  it { is_expected.to run.with_params([4, 5, '3']).and_return([4, 5, '3']) }
+  it { is_expected.to run.with_params(2).and_raise_error(StandardError) }
+  it { is_expected.to run.with_params('string').and_raise_error(StandardError) }
+  it { is_expected.to run.with_params(nil).and_raise_error(StandardError) }
+end
diff --git a/templates/windows/check_hash.ps1.erb b/templates/windows/check_hash.ps1.epp
similarity index 78%
rename from templates/windows/check_hash.ps1.erb
rename to templates/windows/check_hash.ps1.epp
index ca9b6414..14666a94 100644
--- a/templates/windows/check_hash.ps1.erb
+++ b/templates/windows/check_hash.ps1.epp
@@ -7,11 +7,11 @@ $StringBuilder = New-Object System.Text.StringBuilder
 [Void]$StringBuilder.Append($_.ToString("x2")) 
 } 
 
-if([System.IO.File]::Exists("<%= @passfile %>")){
-    $CurrentContent = Get-Content -Path "<%= @passfile %>"
+if([System.IO.File]::Exists("<%= $passfile %>")){
+    $CurrentContent = Get-Content -Path "<%= $passfile %>"
     if($CurrentContent -eq $StringBuilder.ToString()){
         exit 0
     }
 }
 
-exit 1
\ No newline at end of file
+exit 1
diff --git a/templates/windows/compute_hash.ps1.erb b/templates/windows/compute_hash.ps1.epp
similarity index 86%
rename from templates/windows/compute_hash.ps1.erb
rename to templates/windows/compute_hash.ps1.epp
index 088b77db..9c1e5854 100644
--- a/templates/windows/compute_hash.ps1.erb
+++ b/templates/windows/compute_hash.ps1.epp
@@ -7,4 +7,4 @@ $StringBuilder = New-Object System.Text.StringBuilder
 [Void]$StringBuilder.Append($_.ToString("x2")) 
 } 
 
-$StringBuilder.ToString() | Out-File <%= @passfile %>
\ No newline at end of file
+$StringBuilder.ToString() | Out-File <%= $passfile %>