diff --git a/datasette/utils/__init__.py b/datasette/utils/__init__.py
index 226efe4514..490b71c8d6 100644
--- a/datasette/utils/__init__.py
+++ b/datasette/utils/__init__.py
@@ -4,6 +4,7 @@
 import click
 import hashlib
 import json
+import mergedeep
 import os
 import re
 import shlex
@@ -363,9 +364,11 @@ def temporary_docker_directory(
         metadata_content = parse_metadata(metadata.read())
     else:
         metadata_content = {}
-    for key, value in extra_metadata.items():
-        if value:
-            metadata_content[key] = value
+    # Merge in the non-null values in extra_metadata
+    mergedeep.merge(
+        metadata_content,
+        {key: value for key, value in extra_metadata.items() if value is not None},
+    )
     try:
         dockerfile = make_dockerfile(
             file_names,
diff --git a/setup.py b/setup.py
index 7b6422fe81..0de00dc508 100644
--- a/setup.py
+++ b/setup.py
@@ -46,6 +46,7 @@ def get_version():
         "aiofiles~=0.4.0",
         "janus~=0.4.0",
         "PyYAML~=5.3",
+        "mergedeep~=1.1.1",
     ],
     entry_points="""
         [console_scripts]
diff --git a/tests/test_publish_cloudrun.py b/tests/test_publish_cloudrun.py
index bb51b76b0f..55c207c77e 100644
--- a/tests/test_publish_cloudrun.py
+++ b/tests/test_publish_cloudrun.py
@@ -1,8 +1,9 @@
 from click.testing import CliRunner
 from datasette import cli
 from unittest import mock
-import pytest
 import json
+import pytest
+import textwrap
 
 
 @mock.patch("shutil.which")
@@ -146,7 +147,16 @@ def test_publish_cloudrun_plugin_secrets(mock_call, mock_output, mock_which):
     runner = CliRunner()
     with runner.isolated_filesystem():
         open("test.db", "w").write("data")
-        open("metadata.yml", "w").write("title: Hello from metadata YAML")
+        open("metadata.yml", "w").write(
+            textwrap.dedent(
+                """
+                title: Hello from metadata YAML
+                plugins:
+                  datasette-auth-github:
+                    foo: bar
+                """
+            ).strip()
+        )
         result = runner.invoke(
             cli.cli,
             [
@@ -189,7 +199,8 @@ def test_publish_cloudrun_plugin_secrets(mock_call, mock_output, mock_which):
             "title": "Hello from metadata YAML",
             "plugins": {
                 "datasette-auth-github": {
-                    "client_id": {"$env": "DATASETTE_AUTH_GITHUB_CLIENT_ID"}
+                    "foo": "bar",
+                    "client_id": {"$env": "DATASETTE_AUTH_GITHUB_CLIENT_ID"},
                 }
             },
         } == json.loads(metadata)