diff --git a/go.mod b/go.mod
index 49f11668d..748d554b6 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,6 @@ require (
 	github.com/Masterminds/semver/v3 v3.3.1 // MIT
 	github.com/briandowns/spinner v1.23.1 // Apache 2.0
 	github.com/databricks/databricks-sdk-go v0.54.0 // Apache 2.0
-	github.com/elliotchance/orderedmap/v3 v3.0.0 // MIT
 	github.com/fatih/color v1.18.0 // MIT
 	github.com/google/uuid v1.6.0 // BSD-3-Clause
 	github.com/hashicorp/go-version v1.7.0 // MPL 2.0
diff --git a/go.sum b/go.sum
index 3959a1c1e..1e806ea03 100644
--- a/go.sum
+++ b/go.sum
@@ -37,8 +37,6 @@ github.com/databricks/databricks-sdk-go v0.54.0/go.mod h1:ds+zbv5mlQG7nFEU5ojLtg
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/elliotchance/orderedmap/v3 v3.0.0 h1:Yay/tDjX+vzza+Drcoo8VEbuBnOYGpgenCXWcpQSFDg=
-github.com/elliotchance/orderedmap/v3 v3.0.0/go.mod h1:G+Hc2RwaZvJMcS4JpGCOyViCnGeKf0bTYCGTO4uhjSo=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
diff --git a/internal/testcli/golden.go b/internal/testcli/golden.go
index 5299ec5b3..cb24c4568 100644
--- a/internal/testcli/golden.go
+++ b/internal/testcli/golden.go
@@ -16,7 +16,6 @@ import (
 	"github.com/databricks/cli/libs/testdiff"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/iam"
-	"github.com/elliotchance/orderedmap/v3"
 	"github.com/stretchr/testify/require"
 )
 
@@ -95,10 +94,7 @@ func ReplaceOutput(t testutil.TestingT, ctx context.Context, out string) string
 	if replacements == nil {
 		t.Fatal("WithReplacementsMap was not called")
 	}
-	for key, value := range replacements.AllFromFront() {
-		out = strings.ReplaceAll(out, key, value)
-	}
-
+	out = replacements.Replace(out)
 	out = uuidRegex.ReplaceAllString(out, "<UUID>")
 	out = numIdRegex.ReplaceAllString(out, "<NUMID>")
 	out = privatePathRegex.ReplaceAllString(out, "/tmp/.../$3")
@@ -112,67 +108,83 @@ const (
 	replacementsMapKey = key(1)
 )
 
-func WithReplacementsMap(ctx context.Context) (context.Context, *orderedmap.OrderedMap[string, string]) {
+type Replacement struct {
+	Old string
+	New string
+}
+
+type ReplacementsContext struct {
+	Repls []Replacement
+}
+
+func (r *ReplacementsContext) Replace(s string) string {
+	for _, repl := range r.Repls {
+		s = strings.ReplaceAll(s, repl.Old, repl.New)
+	}
+	return s
+}
+
+func (r *ReplacementsContext) Set(old, new string) {
+	if old == "" || new == "" {
+		return
+	}
+	r.Repls = append(r.Repls, Replacement{Old: old, New: new})
+}
+
+func WithReplacementsMap(ctx context.Context) (context.Context, *ReplacementsContext) {
 	value := ctx.Value(replacementsMapKey)
 	if value != nil {
-		if existingMap, ok := value.(*orderedmap.OrderedMap[string, string]); ok {
+		if existingMap, ok := value.(*ReplacementsContext); ok {
 			return ctx, existingMap
 		}
 	}
 
-	newMap := orderedmap.NewOrderedMap[string, string]()
+	newMap := &ReplacementsContext{}
 	ctx = context.WithValue(ctx, replacementsMapKey, newMap)
 	return ctx, newMap
 }
 
-func GetReplacementsMap(ctx context.Context) *orderedmap.OrderedMap[string, string] {
+func GetReplacementsMap(ctx context.Context) *ReplacementsContext {
 	value := ctx.Value(replacementsMapKey)
 	if value != nil {
-		if existingMap, ok := value.(*orderedmap.OrderedMap[string, string]); ok {
+		if existingMap, ok := value.(*ReplacementsContext); ok {
 			return existingMap
 		}
 	}
 	return nil
 }
 
-func setKV(replacements *orderedmap.OrderedMap[string, string], key, value string) {
-	if key == "" || value == "" {
-		return
-	}
-	replacements.Set(key, value)
-}
-
-func PrepareReplacements(t testutil.TestingT, replacements *orderedmap.OrderedMap[string, string], w *databricks.WorkspaceClient) {
+func PrepareReplacements(t testutil.TestingT, r *ReplacementsContext, w *databricks.WorkspaceClient) {
 	// in some clouds (gcp) w.Config.Host includes "https://" prefix in others it's really just a host (azure)
 	host := strings.TrimPrefix(strings.TrimPrefix(w.Config.Host, "http://"), "https://")
-	setKV(replacements, host, "$DATABRICKS_HOST")
-	setKV(replacements, w.Config.ClusterID, "$DATABRICKS_CLUSTER_ID")
-	setKV(replacements, w.Config.WarehouseID, "$DATABRICKS_WAREHOUSE_ID")
-	setKV(replacements, w.Config.ServerlessComputeID, "$DATABRICKS_SERVERLESS_COMPUTE_ID")
-	setKV(replacements, w.Config.MetadataServiceURL, "$DATABRICKS_METADATA_SERVICE_URL")
-	setKV(replacements, w.Config.AccountID, "$DATABRICKS_ACCOUNT_ID")
-	setKV(replacements, w.Config.Token, "$DATABRICKS_TOKEN")
-	setKV(replacements, w.Config.Username, "$DATABRICKS_USERNAME")
-	setKV(replacements, w.Config.Password, "$DATABRICKS_PASSWORD")
-	setKV(replacements, w.Config.Profile, "$DATABRICKS_CONFIG_PROFILE")
-	setKV(replacements, w.Config.ConfigFile, "$DATABRICKS_CONFIG_FILE")
-	setKV(replacements, w.Config.GoogleServiceAccount, "$DATABRICKS_GOOGLE_SERVICE_ACCOUNT")
-	setKV(replacements, w.Config.GoogleCredentials, "$GOOGLE_CREDENTIALS")
-	setKV(replacements, w.Config.AzureResourceID, "$DATABRICKS_AZURE_RESOURCE_ID")
-	setKV(replacements, w.Config.AzureClientSecret, "$ARM_CLIENT_SECRET")
-	// setKV(replacements, w.Config.AzureClientID, "$ARM_CLIENT_ID")
-	setKV(replacements, w.Config.AzureClientID, "$USERNAME")
-	setKV(replacements, w.Config.AzureTenantID, "$ARM_TENANT_ID")
-	setKV(replacements, w.Config.ActionsIDTokenRequestURL, "$ACTIONS_ID_TOKEN_REQUEST_URL")
-	setKV(replacements, w.Config.ActionsIDTokenRequestToken, "$ACTIONS_ID_TOKEN_REQUEST_TOKEN")
-	setKV(replacements, w.Config.AzureEnvironment, "$ARM_ENVIRONMENT")
-	setKV(replacements, w.Config.ClientID, "$DATABRICKS_CLIENT_ID")
-	setKV(replacements, w.Config.ClientSecret, "$DATABRICKS_CLIENT_SECRET")
-	setKV(replacements, w.Config.DatabricksCliPath, "$DATABRICKS_CLI_PATH")
-	setKV(replacements, w.Config.AuthType, "$DATABRICKS_AUTH_TYPE")
+	r.Set(host, "$DATABRICKS_HOST")
+	r.Set(w.Config.ClusterID, "$DATABRICKS_CLUSTER_ID")
+	r.Set(w.Config.WarehouseID, "$DATABRICKS_WAREHOUSE_ID")
+	r.Set(w.Config.ServerlessComputeID, "$DATABRICKS_SERVERLESS_COMPUTE_ID")
+	r.Set(w.Config.MetadataServiceURL, "$DATABRICKS_METADATA_SERVICE_URL")
+	r.Set(w.Config.AccountID, "$DATABRICKS_ACCOUNT_ID")
+	r.Set(w.Config.Token, "$DATABRICKS_TOKEN")
+	r.Set(w.Config.Username, "$DATABRICKS_USERNAME")
+	r.Set(w.Config.Password, "$DATABRICKS_PASSWORD")
+	r.Set(w.Config.Profile, "$DATABRICKS_CONFIG_PROFILE")
+	r.Set(w.Config.ConfigFile, "$DATABRICKS_CONFIG_FILE")
+	r.Set(w.Config.GoogleServiceAccount, "$DATABRICKS_GOOGLE_SERVICE_ACCOUNT")
+	r.Set(w.Config.GoogleCredentials, "$GOOGLE_CREDENTIALS")
+	r.Set(w.Config.AzureResourceID, "$DATABRICKS_AZURE_RESOURCE_ID")
+	r.Set(w.Config.AzureClientSecret, "$ARM_CLIENT_SECRET")
+	// r.Set(w.Config.AzureClientID, "$ARM_CLIENT_ID")
+	r.Set(w.Config.AzureClientID, "$USERNAME")
+	r.Set(w.Config.AzureTenantID, "$ARM_TENANT_ID")
+	r.Set(w.Config.ActionsIDTokenRequestURL, "$ACTIONS_ID_TOKEN_REQUEST_URL")
+	r.Set(w.Config.ActionsIDTokenRequestToken, "$ACTIONS_ID_TOKEN_REQUEST_TOKEN")
+	r.Set(w.Config.AzureEnvironment, "$ARM_ENVIRONMENT")
+	r.Set(w.Config.ClientID, "$DATABRICKS_CLIENT_ID")
+	r.Set(w.Config.ClientSecret, "$DATABRICKS_CLIENT_SECRET")
+	r.Set(w.Config.DatabricksCliPath, "$DATABRICKS_CLI_PATH")
+	r.Set(w.Config.AuthType, "$DATABRICKS_AUTH_TYPE")
 }
 
-func PrepareReplacementsUser(t testutil.TestingT, replacements *orderedmap.OrderedMap[string, string], u iam.User) {
+func PrepareReplacementsUser(t testutil.TestingT, r *ReplacementsContext, u iam.User) {
 	// There could be exact matches or overlap between different name fields, so sort them by length
 	// to ensure we match the largest one first and map them all to the same token
 	names := []string{
@@ -192,17 +204,17 @@ func PrepareReplacementsUser(t testutil.TestingT, replacements *orderedmap.Order
 	stableSortReverseLength(names)
 
 	for _, name := range names {
-		setKV(replacements, name, "$USERNAME")
+		r.Set(name, "$USERNAME")
 	}
 
 	for ind, val := range u.Groups {
-		setKV(replacements, val.Value, fmt.Sprintf("$USER.Groups[%d]", ind))
+		r.Set(val.Value, fmt.Sprintf("$USER.Groups[%d]", ind))
 	}
 
-	setKV(replacements, u.Id, "$USER.Id")
+	r.Set(u.Id, "$USER.Id")
 
 	for ind, val := range u.Roles {
-		setKV(replacements, val.Value, fmt.Sprintf("$USER.Roles[%d]", ind))
+		r.Set(val.Value, fmt.Sprintf("$USER.Roles[%d]", ind))
 	}
 }