diff --git a/images/tidb-backup-manager/e2e-entrypoint.sh b/images/tidb-backup-manager/e2e-entrypoint.sh
index b25427c6bc5..db7f6152557 100755
--- a/images/tidb-backup-manager/e2e-entrypoint.sh
+++ b/images/tidb-backup-manager/e2e-entrypoint.sh
@@ -25,7 +25,23 @@ cleanup() {
 
 trap cleanup EXIT
 
-export GOOGLE_APPLICATION_CREDENTIALS=/tmp/google-credentials.json
+GCS_SERVICE_ACCOUNT_FILE=/tmp/google-credentials.json
+GCS_SERVICE_ACCOUNT_FILE_CONFIG=
+if [ -n "${GCS_SERVICE_ACCOUNT_JSON_KEY:-}" ]; then
+    export GOOGLE_APPLICATION_CREDENTIALS=${GCS_SERVICE_ACCOUNT_FILE}
+    GCS_SERVICE_ACCOUNT_FILE_CONFIG="service_account_file = ${GOOGLE_APPLICATION_CREDENTIALS}"
+    echo "Create google-credentials.json file."
+    cat <<EOF > "${GOOGLE_APPLICATION_CREDENTIALS}"
+    ${GCS_SERVICE_ACCOUNT_JSON_KEY}
+EOF
+elif [ -s "${GCS_SERVICE_ACCOUNT_FILE}" ]; then
+    echo "Use mounted google-credentials.json file."
+    export GOOGLE_APPLICATION_CREDENTIALS=${GCS_SERVICE_ACCOUNT_FILE}
+    GCS_SERVICE_ACCOUNT_FILE_CONFIG="service_account_file = ${GOOGLE_APPLICATION_CREDENTIALS}"
+else
+    unset GOOGLE_APPLICATION_CREDENTIALS
+fi
+
 echo "Create rclone.conf file."
 cat <<EOF > /tmp/rclone.conf
 [s3]
@@ -41,26 +57,17 @@ storage_class = ${AWS_STORAGE_CLASS}
 [gcs]
 type = google cloud storage
 project_number = ${GCS_PROJECT_ID}
-service_account_file = ${GOOGLE_APPLICATION_CREDENTIALS}
 object_acl = ${GCS_OBJECT_ACL}
 bucket_acl = ${GCS_BUCKET_ACL}
 location =  ${GCS_LOCATION}
 storage_class = ${GCS_STORAGE_CLASS:-"COLDLINE"}
+${GCS_SERVICE_ACCOUNT_FILE_CONFIG}
 [azure]
 type = azureblob
 account = ${AZUREBLOB_ACCOUNT}
 key = ${AZUREBLOB_KEY}
 EOF
 
-if [[ -n "${GCS_SERVICE_ACCOUNT_JSON_KEY:-}" ]]; then
-    echo "Create google-credentials.json file."
-    cat <<EOF > ${GOOGLE_APPLICATION_CREDENTIALS}
-    ${GCS_SERVICE_ACCOUNT_JSON_KEY}
-EOF
-else
-    touch ${GOOGLE_APPLICATION_CREDENTIALS}
-fi
-
 BACKUP_BIN=/tidb-backup-manager
 
 COV_NAME="backup-manager.$(( ( RANDOM % 100000 ) + 1 ))"
diff --git a/images/tidb-backup-manager/entrypoint.sh b/images/tidb-backup-manager/entrypoint.sh
index 710a76c507e..f3e4ffe3e6a 100755
--- a/images/tidb-backup-manager/entrypoint.sh
+++ b/images/tidb-backup-manager/entrypoint.sh
@@ -27,7 +27,23 @@ cleanup() {
 
 trap cleanup EXIT
 
-export GOOGLE_APPLICATION_CREDENTIALS=/tmp/google-credentials.json
+GCS_SERVICE_ACCOUNT_FILE=/tmp/google-credentials.json
+GCS_SERVICE_ACCOUNT_FILE_CONFIG=
+if [ -n "${GCS_SERVICE_ACCOUNT_JSON_KEY:-}" ]; then
+    export GOOGLE_APPLICATION_CREDENTIALS=${GCS_SERVICE_ACCOUNT_FILE}
+    GCS_SERVICE_ACCOUNT_FILE_CONFIG="service_account_file = ${GOOGLE_APPLICATION_CREDENTIALS}"
+    echo "Create google-credentials.json file."
+    cat <<EOF > "${GOOGLE_APPLICATION_CREDENTIALS}"
+    ${GCS_SERVICE_ACCOUNT_JSON_KEY}
+EOF
+elif [ -s "${GCS_SERVICE_ACCOUNT_FILE}" ]; then
+    echo "Use mounted google-credentials.json file."
+    export GOOGLE_APPLICATION_CREDENTIALS=${GCS_SERVICE_ACCOUNT_FILE}
+    GCS_SERVICE_ACCOUNT_FILE_CONFIG="service_account_file = ${GOOGLE_APPLICATION_CREDENTIALS}"
+else
+    unset GOOGLE_APPLICATION_CREDENTIALS
+fi
+
 echo "Create rclone.conf file."
 cat <<EOF > /tmp/rclone.conf
 [s3]
@@ -43,26 +59,17 @@ storage_class = ${AWS_STORAGE_CLASS}
 [gcs]
 type = google cloud storage
 project_number = ${GCS_PROJECT_ID}
-service_account_file = ${GOOGLE_APPLICATION_CREDENTIALS}
 object_acl = ${GCS_OBJECT_ACL}
 bucket_acl = ${GCS_BUCKET_ACL}
 location =  ${GCS_LOCATION}
 storage_class = ${GCS_STORAGE_CLASS:-"COLDLINE"}
+${GCS_SERVICE_ACCOUNT_FILE_CONFIG}
 [azure]
 type = azureblob
 account = ${AZUREBLOB_ACCOUNT}
 key = ${AZUREBLOB_KEY}
 EOF
 
-if [[ -n "${GCS_SERVICE_ACCOUNT_JSON_KEY:-}" ]]; then
-    echo "Create google-credentials.json file."
-    cat <<EOF > ${GOOGLE_APPLICATION_CREDENTIALS}
-    ${GCS_SERVICE_ACCOUNT_JSON_KEY}
-EOF
-else
-    touch ${GOOGLE_APPLICATION_CREDENTIALS}
-fi
-
 BACKUP_BIN=/tidb-backup-manager
 if [[ -n "${AWS_DEFAULT_REGION}" ]]; then
 	EXEC_COMMAND="exec"