diff --git a/chromeos/scripts/make_chroot b/chromeos/scripts/make_chroot
index 1d02584..1a1f2c4 100755
--- a/chromeos/scripts/make_chroot
+++ b/chromeos/scripts/make_chroot
@@ -94,7 +94,7 @@
 function bash_chroot {
   # Use $* not $@ since 'bash -c' needs a single arg
   # Use -l to force source of /etc/profile (login shell)
-  sudo chroot "$FLAGS_chroot" env ${CHROOT_PASSTHRU} bash -l -c "$*"
+  sudo "${CHROOT_PASSTHRU[@]}" chroot "$FLAGS_chroot" bash -l -c "$*"
 }
 
 function cleanup {
@@ -153,6 +153,7 @@
    # the user's already typed in one sudo password...)
    bash_chroot "echo Defaults env_keep += CROS_WORKON_SRCROOT >> /etc/sudoers"
    bash_chroot "echo Defaults env_keep += CHROMEOS_OFFICIAL >> /etc/sudoers"
+   bash_chroot "echo Defaults env_keep += PORTAGE_USERNAME >> /etc/sudoers"
    bash_chroot "echo Defaults env_keep += http_proxy >> /etc/sudoers"
    bash_chroot "echo Defaults env_keep += ftp_proxy >> /etc/sudoers"
    bash_chroot "echo Defaults env_keep += all_proxy >> /etc/sudoers"
@@ -262,13 +263,13 @@
 CHROOT_CONFIG="${CHROOT_TRUNK}/src/third_party/chromiumos-overlay/chromeos/config"
 CHROOT_OVERLAY="/usr/local/portage/chromiumos"
 CHROOT_STATE="${FLAGS_chroot}/etc/debian_chroot"
-CHROOT_PASSTHRU="CROS_WORKON_SRCROOT=\"${CHROOT_TRUNK}\" PORTAGE_USERNAME=\"$USER\""
+CHROOT_PASSTHRU=(CROS_WORKON_SRCROOT="$CHROOT_TRUNK" PORTAGE_USERNAME="$USER")
 
 # Pass proxy variables into the environment.
 for type in http ftp all; do
    value=$(env | grep ${type}_proxy || true)
    if [ -n "${value}" ]; then
-      CHROOT_PASSTHRU="${CHROOT_PASSTHRU} ${value}"
+      CHROOT_PASSTHRU=("${CHROOT_PASSTHRU[@]}" "$value")
    fi
 done