diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 636d631e65..4477b27ed7 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-29e2930269c744fe6136334f8b159afc9dd26bab
\ No newline at end of file
+8f539adc1b5331de3c2cd539712526d653bfbabf
\ No newline at end of file
diff --git a/backend/windmill-api/src/resources.rs b/backend/windmill-api/src/resources.rs
index ca9d9f2d87..087d31cdcf 100644
--- a/backend/windmill-api/src/resources.rs
+++ b/backend/windmill-api/src/resources.rs
@@ -32,7 +32,7 @@ use uuid::Uuid;
 use windmill_audit::audit_oss::{audit_log, AuditAuthor};
 use windmill_audit::ActionKind;
 use windmill_common::{
-    db::UserDB,
+    db::{UserDB, UserDbWithOptAuthed},
     error::{Error, JsonResult, Result},
     utils::{not_found_if_none, paginate, require_admin, Pagination, StripPath},
     variables,
@@ -515,11 +515,10 @@ pub async fn transform_json_value<'c>(
     match v {
         Value::String(y) if y.starts_with("$var:") => {
             let path = y.strip_prefix("$var:").unwrap();
-            let tx: Transaction<'_, Postgres> =
-                authed_transaction_or_default(authed, user_db.clone(), db).await?;
+            let userdb_authed = UserDbWithOptAuthed { authed: authed, user_db: user_db.clone(), db: db.clone() };
 
             let v = crate::variables::get_value_internal(
-                tx,
+                &userdb_authed,
                 db,
                 workspace,
                 path,
diff --git a/backend/windmill-api/src/variables.rs b/backend/windmill-api/src/variables.rs
index 0b1ce0fc5e..1b4b5e9c01 100644
--- a/backend/windmill-api/src/variables.rs
+++ b/backend/windmill-api/src/variables.rs
@@ -25,7 +25,7 @@ use serde_json::Value;
 use windmill_audit::audit_oss::{audit_log, AuditAuthorable};
 use windmill_audit::ActionKind;
 use windmill_common::{
-    db::UserDB,
+    db::{UserDB, UserDbWithAuthed},
     error::{Error, JsonResult, Result},
     scripts::ScriptHash,
     utils::{not_found_if_none, paginate, Pagination, StripPath, WarnAfterExt},
@@ -238,9 +238,10 @@ async fn get_value(
 ) -> JsonResult<String> {
     let path = path.to_path();
     check_scopes(&authed, || format!("variables:read:{}", path))?;
-    let tx = user_db.begin(&authed).await?;
+    let userdb_authed = UserDbWithAuthed { db: user_db.clone(), authed: &authed.to_authed_ref() };
+
     return get_value_internal(
-        tx,
+        &userdb_authed,
         &db,
         &w_id,
         &path,
@@ -772,8 +773,8 @@ fn replace_path(v: serde_json::Value, path: &str, npath: &str) -> Value {
     }
 }
 
-pub async fn get_value_internal<'c>(
-    mut tx: Transaction<'c, Postgres>,
+pub async fn get_value_internal<'a, 'e, A: sqlx::Acquire<'e, Database = Postgres> + Send + 'a>(
+    acquire_db: A,
     db: &DB,
     w_id: &str,
     path: &str,
@@ -786,6 +787,7 @@ pub async fn get_value_internal<'c>(
         }
     }
 
+    let mut tx = acquire_db.begin().await?;
     let variable_o = sqlx::query!(
         "SELECT value, account, (now() > account.expires_at) as is_expired, is_secret, path from variable
         LEFT JOIN account ON variable.account = account.id WHERE variable.path = $1 AND variable.workspace_id = $2", path, w_id
@@ -793,6 +795,7 @@ pub async fn get_value_internal<'c>(
     .fetch_optional(&mut *tx)
     .warn_after_seconds(5)
     .await?;
+    drop(tx);
 
     let variable = if let Some(variable) = variable_o {
         variable
@@ -802,6 +805,7 @@ pub async fn get_value_internal<'c>(
     };
 
     let r = if variable.is_secret {
+        let mut tx = db.begin().await?;
         audit_log(
             &mut *tx,
             audit_author,
@@ -812,6 +816,8 @@ pub async fn get_value_internal<'c>(
             None,
         )
         .await?;
+        tx.commit().await?;
+
         let value = variable.value;
         if variable.is_expired.unwrap_or(false) && variable.account.is_some() {
             #[cfg(feature = "oauth2")]
@@ -828,7 +834,6 @@ pub async fn get_value_internal<'c>(
             #[cfg(not(feature = "oauth2"))]
             return Err(Error::internal_err("Require oauth2 feature".to_string()));
         } else if !value.is_empty() {
-            tx.commit().await?;
             let mc = build_crypt(&db, &w_id).await?;
             decrypt(&mc, value)?
         } else {
diff --git a/backend/windmill-common/src/db.rs b/backend/windmill-common/src/db.rs
index 46fde40380..61366c5ad2 100644
--- a/backend/windmill-common/src/db.rs
+++ b/backend/windmill-common/src/db.rs
@@ -1,5 +1,7 @@
 use sqlx::{Acquire, Pool, Postgres, Transaction};
 
+use crate::db;
+
 pub type DB = Pool<Postgres>;
 
 #[derive(Clone, Debug, Hash)]
@@ -121,6 +123,43 @@ impl<'c, 'd, T: Authable + Sync> Acquire<'c> for &'c UserDbWithAuthed<'d, T> {
     }
 }
 
+
+
+pub struct UserDbWithOptAuthed<'c, T: Authable + Sync> {
+    pub authed: &'c T,
+    pub user_db: Option<UserDB>,
+    pub db: DB,
+}
+
+impl<'c, 'd, T: Authable + Sync> Acquire<'c> for &'c UserDbWithOptAuthed<'d, T> {
+    type Database = Postgres;
+    type Connection = Transaction<'c, Postgres>;
+
+    fn acquire(self) -> futures_core::future::BoxFuture<'c, Result<Self::Connection, sqlx::Error>> {
+        Box::pin(async move { 
+            if let Some(db) = &self.user_db {
+                db.clone().begin(self.authed).await
+            } else {
+                self.db.clone().begin().await
+            }
+        })
+    }
+
+
+    fn begin(
+        self,
+    ) -> futures_core::future::BoxFuture<'c, Result<Transaction<'c, Postgres>, sqlx::Error>> {
+        Box::pin(async move { 
+            if let Some(db) = &self.user_db {
+                db.clone().begin(self.authed).await
+            } else {
+                self.db.clone().begin().await
+            }
+        })
+    }
+}
+
+
 impl UserDB {
     pub fn new(db: DB) -> Self {
         Self { db }
diff --git a/frontend/src/lib/components/common/drawer/Drawer.svelte b/frontend/src/lib/components/common/drawer/Drawer.svelte
index 24668fdd3f..91c09743bd 100644
--- a/frontend/src/lib/components/common/drawer/Drawer.svelte
+++ b/frontend/src/lib/components/common/drawer/Drawer.svelte
@@ -87,7 +87,6 @@
 
 	$effect(() => {
 		open
-		console.log('open', open)
 		untrack(() => {
 			open ? openDrawer() : closeDrawer()
 		})