diff --git a/envvar/envvar.go b/envvar/envvar.go
index e53c3ba..f4e461d 100644
--- a/envvar/envvar.go
+++ b/envvar/envvar.go
@@ -62,10 +62,7 @@
 func ClearCredentials() error {
 	for _, v := range []string{
 		Credentials,
-		// Old environment variables, remove when
-		// https://github.com/veyron/release-issues/issues/1367
-		// is closed.
-		"VEYRON_CREDENTIALS",
+		// Remove when https://github.com/veyron/release-issues/issues/1597 is closed.
 		"VEYRON_AGENT_FD",
 	} {
 		if err := os.Unsetenv(v); err != nil {
@@ -74,33 +71,3 @@
 	}
 	return nil
 }
-
-// Helper function to ease the transition from VEYRON_CREDENTIALS to
-// V23_CREDENTIALS.  Remove before release (and after updating all binaries so
-// that they respect V23_CREDENTIALS).
-func DoNotUse_GetCredentials() string {
-	if dir := os.Getenv(Credentials); len(dir) > 0 {
-		return dir
-	}
-	return os.Getenv("VEYRON_CREDENTIALS")
-}
-
-// Helper function to ease the transition from NAMESPACE_ROOT to V23_NAMESPACE.
-// Once all binaries have been updated to respect V23_NAMESPACE, this function
-// can be removed and calls replaced with:
-// othervars = append(othervars, NamespacePrefix+"="+root)
-func DoNotUse_AppendNamespaceRoot(root string, othervars []string) []string {
-	return append(othervars,
-		NamespacePrefix+"="+root,
-		"NAMESPACE_ROOT="+root)
-}
-
-// Helper function to ease the transition from VEYRON_CREDENTIALS to
-// V23_CREDENTIALS.  Once all binaries have been updated to respect
-// V23_CREDENTIALS, this function can be removed and calls replaced with:
-// othervars = append(othervars, Credentials + "="+value
-func DoNotUse_AppendCredentials(value string, othervars []string) []string {
-	return append(othervars,
-		Credentials+"="+value,
-		"VEYRON_CREDENTIALS="+value)
-}
diff --git a/lib/flags/flags.go b/lib/flags/flags.go
index f28d1dd..aac40ad 100644
--- a/lib/flags/flags.go
+++ b/lib/flags/flags.go
@@ -264,7 +264,7 @@
 	var (
 		f             = &RuntimeFlags{}
 		_, roots      = envvar.NamespaceRoots()
-		creds         = envvar.DoNotUse_GetCredentials()
+		creds         = os.Getenv(envvar.Credentials)
 		i18nCatalogue = os.Getenv(envvar.I18nCatalogueFiles)
 	)
 	if len(roots) == 0 {
diff --git a/services/mgmt/device/impl/app_service.go b/services/mgmt/device/impl/app_service.go
index 2aa4f87..e0c4cff 100644
--- a/services/mgmt/device/impl/app_service.go
+++ b/services/mgmt/device/impl/app_service.go
@@ -778,7 +778,7 @@
 	cmd.Args = append(cmd.Args, "--progname", appName)
 
 	// Set the app's default namespace root to the local namespace.
-	cmd.Env = envvar.DoNotUse_AppendNamespaceRoot(nsRoot, cmd.Env)
+	cmd.Env = []string{envvar.NamespacePrefix + "=" + nsRoot}
 	cmd.Env = append(cmd.Env, envelope.Env...)
 	rootDir := filepath.Join(instanceDir, "root")
 	cmd.Dir = rootDir
@@ -868,7 +868,7 @@
 		cmd.ExtraFiles = append(cmd.ExtraFiles, file)
 		cfg.Set(mgmt.SecurityAgentFDConfigKey, strconv.Itoa(fd))
 	} else {
-		cmd.Env = envvar.DoNotUse_AppendCredentials(filepath.Join(instanceDir, "credentials"), cmd.Env)
+		cmd.Env = append(cmd.Env, envvar.Credentials+"="+filepath.Join(instanceDir, "credentials"))
 	}
 	handle := vexec.NewParentHandle(cmd, vexec.ConfigOpt{cfg})
 	defer func() {
diff --git a/services/mgmt/device/impl/device_installer.go b/services/mgmt/device/impl/device_installer.go
index a50daa5..c631db8 100644
--- a/services/mgmt/device/impl/device_installer.go
+++ b/services/mgmt/device/impl/device_installer.go
@@ -251,9 +251,7 @@
 	output += fmt.Sprintf("  TIMESTAMP=$(%s)\n", dateCommand)
 	output += fmt.Sprintf("  exec > %s-$TIMESTAMP 2> %s-$TIMESTAMP\n", stdoutLog, stderrLog)
 	output += "fi\n"
-	for _, v := range envvar.DoNotUse_AppendCredentials(principalDir, nil) {
-		output += fmt.Sprintf("%v ", v)
-	}
+	output += fmt.Sprintf("%s=%q ", envvar.Credentials, principalDir)
 	// Escape the path to the binary; %q uses Go-syntax escaping, but it's
 	// close enough to Bash that we're using it as an approximation.
 	//
diff --git a/services/mgmt/device/impl/device_service.go b/services/mgmt/device/impl/device_service.go
index 54f18ad..142fe63 100644
--- a/services/mgmt/device/impl/device_service.go
+++ b/services/mgmt/device/impl/device_service.go
@@ -363,7 +363,7 @@
 		if p, err = vsecurity.CreatePersistentPrincipal(credentialsDir, nil); err != nil {
 			return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("CreatePersistentPrincipal(%v, nil) failed: %v", credentialsDir, err))
 		}
-		cmd.Env = envvar.DoNotUse_AppendCredentials(credentialsDir, cmd.Env)
+		cmd.Env = append(cmd.Env, envvar.Credentials+"="+credentialsDir)
 	}
 	dmPrincipal := v23.GetPrincipal(ctx)
 	dmBlessings, err := dmPrincipal.Bless(p.PublicKey(), dmPrincipal.BlessingStore().Default(), "testdm", security.UnconstrainedUse())