diff --git a/examples/config/config.variant b/examples/config/config.variant
index 9b2b347..36e6ee4 100644
--- a/examples/config/config.variant
+++ b/examples/config/config.variant
@@ -72,10 +72,18 @@ job "config view" {
     }
   }
 
+  variable "var1" {
+    value = conf.foo
+  }
+
   exec {
     command = "echo"
     args = [
-      jsonencode(conf.foo)
+      <<EOS
+${jsonencode(conf.foo)}
+${jsonencode(var.var1)}
+      EOS
+      ,
     ]
   }
 }
diff --git a/examples/config/config_test.variant b/examples/config/config_test.variant
index d08e470..f312796 100644
--- a/examples/config/config_test.variant
+++ b/examples/config/config_test.variant
@@ -5,10 +5,10 @@ test "app deploy" {
     env = "prod"
     exitstatus = 0
     err = ""
-    out = trimspace(<<EOS
+    out = <<EOS
+{"app":"app1","bar":"OPT1","env":"prod","getfoo":"app_override,prod,PARAM1","v":"app1prod"}
 {"app":"app1","bar":"OPT1","env":"prod","getfoo":"app_override,prod,PARAM1","v":"app1prod"}
 EOS
-    )
   }
 
   case "app2prod" {
@@ -16,10 +16,10 @@ EOS
     env = "prod"
     exitstatus = 0
     err = ""
-    out = trimspace(<<EOS
+    out = <<EOS
+{"app":"app2","bar":"OPT1","env":"prod","getfoo":"app_override,prod,PARAM1","v":"app2"}
 {"app":"app2","bar":"OPT1","env":"prod","getfoo":"app_override,prod,PARAM1","v":"app2"}
 EOS
-    )
   }
 
   // missing env "test"
diff --git a/pkg/app/app.go b/pkg/app/app.go
index 8b9d28c..ac655b2 100644
--- a/pkg/app/app.go
+++ b/pkg/app/app.go
@@ -3,6 +3,7 @@ package app
 import (
 	"flag"
 	"fmt"
+	"github.com/variantdev/vals"
 	"io/ioutil"
 	"os"
 	"os/exec"
@@ -31,7 +32,6 @@ import (
 	"github.com/pkg/errors"
 	"github.com/variantdev/dag/pkg/dag"
 	"github.com/variantdev/mod/pkg/shell"
-	"github.com/variantdev/vals"
 	"github.com/zclconf/go-cty/cty"
 	"github.com/zclconf/go-cty/cty/gocty"
 )
@@ -144,28 +144,6 @@ func (app *App) Job(l *EventLogger, cmd string, args map[string]interface{}, opt
 			}
 		}
 
-		conf, err := app.getConfigs(jobCtx, cc, j, "config", func(j JobSpec) []Config { return j.Configs }, nil)
-		if err != nil {
-			return nil, err
-		}
-
-		jobEvalCtx.Variables["conf"] = conf
-
-		secretRefsEvaluator, err := vals.New(vals.Options{CacheSize: 100})
-		if err != nil {
-			return nil, fmt.Errorf("failed to initialize vals: %v", err)
-		}
-
-		sec, err := app.getConfigs(jobCtx, cc, j, "secret", func(j JobSpec) []Config { return j.Secrets }, func(m map[string]interface{}) (map[string]interface{}, error) {
-			return secretRefsEvaluator.Eval(m)
-		})
-
-		if err != nil {
-			return nil, err
-		}
-
-		jobEvalCtx.Variables["sec"] = sec
-
 		needs := map[string]cty.Value{}
 
 		var concurrency int
@@ -1213,7 +1191,7 @@ func (app *App) createJobContext(cc *HCL2Config, j JobSpec, givenParams map[stri
 	}
 
 	varSpecs := append(append([]Variable{}, cc.Variables...), j.Variables...)
-	varCtx := &hcl2.EvalContext{
+	modCtx := &hcl2.EvalContext{
 		Functions: conf.Functions("."),
 		Variables: map[string]cty.Value{
 			"param":   cty.ObjectVal(params),
@@ -1222,17 +1200,13 @@ func (app *App) createJobContext(cc *HCL2Config, j JobSpec, givenParams map[stri
 		},
 	}
 
-	jobCtx, err := addVariables(varCtx, varSpecs)
+	mod, err := getModule(modCtx, cc.Module, j.Module)
 	if err != nil {
 		return nil, err
 	}
 
-	mod, err := getModule(jobCtx, cc.Module, j.Module)
-	if err != nil {
-		return nil, err
-	}
-
-	jobCtx.Variables["mod"] = mod
+	confEvalCtx := cloneEvalContext(modCtx)
+	confEvalCtx.Variables["mod"] = mod
 
 	globalArgs := map[string]interface{}{}
 
@@ -1258,10 +1232,41 @@ func (app *App) createJobContext(cc *HCL2Config, j JobSpec, givenParams map[stri
 		globalArgs[k] = v
 	}
 
-	return &JobContext{
-		evalContext: jobCtx,
+	confJobCtx := &JobContext{
+		evalContext: confEvalCtx,
 		globalArgs:  globalArgs,
-	}, nil
+	}
+
+	conf, err := app.getConfigs(confJobCtx, cc, j, "config", func(j JobSpec) []Config { return j.Configs }, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	secJobCtx := confJobCtx.WithVariable("conf", conf).Ptr()
+
+	secretRefsEvaluator, err := vals.New(vals.Options{CacheSize: 100})
+	if err != nil {
+		return nil, fmt.Errorf("failed to initialize vals: %v", err)
+	}
+
+	sec, err := app.getConfigs(secJobCtx, cc, j, "secret", func(j JobSpec) []Config { return j.Secrets }, func(m map[string]interface{}) (map[string]interface{}, error) {
+		return secretRefsEvaluator.Eval(m)
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	varJobCtx := secJobCtx.WithVariable("sec", sec)
+
+	varCtx, err := addVariables(varJobCtx.evalContext, varSpecs)
+	if err != nil {
+		return nil, err
+	}
+
+	jobCtx := varJobCtx.WithEvalContext(varCtx).Ptr()
+
+	return jobCtx, nil
 }
 
 func (app *App) getConfigs(jobCtx *JobContext, cc *HCL2Config, j JobSpec, confType string, f func(JobSpec) []Config, g func(map[string]interface{}) (map[string]interface{}, error)) (cty.Value, error) {