diff --git a/Makefile b/Makefile
index 34ff7bae..4d8b86c7 100644
--- a/Makefile
+++ b/Makefile
@@ -28,6 +28,7 @@ cuelint: cuefmt
 .PHONY: shellcheck
 shellcheck:
 	shellcheck ./tests/*.bats ./tests/*.bash
+	shellcheck ./universe/*.bats ./universe/*.bash
 
 .PHONY: lint
 lint: shellcheck cuelint golint check-buildkit-version docslint
diff --git a/stdlib/helpers.bash b/stdlib/helpers.bash
new file mode 100644
index 00000000..584e88ec
--- /dev/null
+++ b/stdlib/helpers.bash
@@ -0,0 +1,47 @@
+common_setup() {
+    load 'node_modules/bats-support/load'
+    load 'node_modules/bats-assert/load'
+
+    # Dagger Binary
+    DAGGER="${DAGGER_BINARY:-$(command -v dagger)}"
+    export DAGGER
+
+    # Set the workspace to the universe directory (so tests can run from anywhere)
+    UNIVERSE="$( cd "$( dirname "$BATS_TEST_FILENAME" )" >/dev/null 2>&1 && pwd )"
+    DAGGER_WORKSPACE="$UNIVERSE"
+    export DAGGER_WORKSPACE
+
+    # Force pretty printing for error reporting
+    DAGGER_LOG_FORMAT="pretty"
+    export DAGGER_LOG_FORMAT
+
+    # Sandbox workspace.
+    DAGGER_SANDBOX="$(mktemp -d -t dagger-workspace-XXXXXX)"
+    export DAGGER_SANDBOX
+    dagger init -w "$DAGGER_SANDBOX"
+
+    # allows the use of `sops`
+    SOPS_AGE_KEY_FILE=~/.config/dagger/keys.txt
+    export SOPS_AGE_KEY_FILE
+}
+
+# dagger helper to execute the right binary
+dagger() {
+    "${DAGGER}" "$@"
+}
+
+# copy an environment from the current workspace to the sandbox.
+#
+# this is needed if the test requires altering inputs without dirtying the
+# current environment.
+# Usage:
+# copy_to_sandbox myenv
+# dagger input secret -w "$DAGGER_SANDBOX" -e myenv "temporary change"
+# dagger up -w "$DAGGER_SANDBOX" -e myenv
+copy_to_sandbox() {
+    local name="$1"
+    local source="$DAGGER_WORKSPACE"/.dagger/env/"$name"
+    local target="$DAGGER_SANDBOX"/.dagger/env/"$name"
+
+    cp -a "$source" "$target"
+}
\ No newline at end of file
diff --git a/stdlib/universe.bats b/stdlib/universe.bats
index 2d0bf9d2..8070271b 100644
--- a/stdlib/universe.bats
+++ b/stdlib/universe.bats
@@ -1,10 +1,7 @@
-
 setup() {
-    load 'node_modules/bats-assert/load'
-}
+    load 'helpers'
 
-function dagger() {
-	"${DAGGER_BINARY:-$(which dagger)}" "$@"
+    common_setup
 }
 
 @test "netlify" {
@@ -12,34 +9,34 @@ function dagger() {
 }
 
 @test "aws: ecr" {
-	dagger -e aws-ecr up
+    dagger -e aws-ecr up
 }
 
 @test "aws: s3" {
-	dagger -e aws-s3 up
+    dagger -e aws-s3 up
 }
 
 @test "docker run: local" {
-	dagger -e docker-run-local up
+    dagger -e docker-run-local up
 }
 
 @test "docker run: ssh" {
-	dagger -e docker-run-ssh up
+    dagger -e docker-run-ssh up
 }
 
 @test "docker run: ssh with passphrase" {
-	dagger -e docker-run-ssh-passphrase up
+    dagger -e docker-run-ssh-passphrase up
 }
 
 @test "docker run: ssh with wrong passphrase" {
-	run dagger -e docker-run-ssh-wrong-passphrase up
-	assert_failure
+    run dagger -e docker-run-ssh-wrong-passphrase up
+    assert_failure
 }
 
 @test "google cloud: gcr" {
-	dagger -e google-gcr up
+    dagger -e google-gcr up
 }
 
 @test "google cloud: gke" {
-	dagger -e google-gke up
+    dagger -e google-gke up
 }