diff --git a/.config/setup/12-setup-packages.sh b/.config/setup/12-setup-packages.sh
index 267e217..48c0136 100755
--- a/.config/setup/12-setup-packages.sh
+++ b/.config/setup/12-setup-packages.sh
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 systemctl --user enable --now syncthing.service
 
diff --git a/.config/setup/14-install-cron-jobs.sh b/.config/setup/14-install-cron-jobs.sh
index 829ad9b..22851b8 100755
--- a/.config/setup/14-install-cron-jobs.sh
+++ b/.config/setup/14-install-cron-jobs.sh
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 # keep-sorted start
 systemctl --user enable --now backup.timer
diff --git a/.config/setup/16-install-tor.sh b/.config/setup/16-install-tor.sh
index 4c1e33b..5688ea2 100755
--- a/.config/setup/16-install-tor.sh
+++ b/.config/setup/16-install-tor.sh
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 sudo cp "$(systemd-path user-configuration)"/setup/sources.list.d/tor.sources /etc/apt/sources.list.d/
 sudo chmod 644 /etc/apt/sources.list.d/tor.sources
diff --git a/.config/setup/18-install-git-sync.sh b/.config/setup/18-install-git-sync.sh
index ac57a8f..c5824c1 100755
--- a/.config/setup/18-install-git-sync.sh
+++ b/.config/setup/18-install-git-sync.sh
@@ -1,3 +1,6 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 resync-git-sync
diff --git a/.config/setup/20-install-zoom.sh b/.config/setup/20-install-zoom.sh
index 72dd1f9..d1260cc 100755
--- a/.config/setup/20-install-zoom.sh
+++ b/.config/setup/20-install-zoom.sh
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 curl --location --output-dir /tmp --remote-name https://zoom.us/client/latest/zoom_amd64.deb
 sudo apt-get install --no-install-recommends --yes /tmp/zoom_amd64.deb
diff --git a/.config/setup/31-initialize-backup-repository.sh b/.config/setup/31-initialize-backup-repository.sh
index d384732..fe2c0cf 100755
--- a/.config/setup/31-initialize-backup-repository.sh
+++ b/.config/setup/31-initialize-backup-repository.sh
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 sudo mkdir --parents "${BORG_REPO}"
 sudo chown "${USER}":"${USER}" "${BORG_REPO}"
diff --git a/.config/setup/42-install-github-packages.sh b/.config/setup/42-install-github-packages.sh
index 13d5478..1ebd793 100755
--- a/.config/setup/42-install-github-packages.sh
+++ b/.config/setup/42-install-github-packages.sh
@@ -1,3 +1,6 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 ghup
diff --git a/.config/setup/43-install-emacs-lilypond-mode.sh b/.config/setup/43-install-emacs-lilypond-mode.sh
index a3fce38..cf53bf2 100755
--- a/.config/setup/43-install-emacs-lilypond-mode.sh
+++ b/.config/setup/43-install-emacs-lilypond-mode.sh
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 projdir="$(systemd-path user)"/Projects
 mkdir --parents "${projdir}"
diff --git a/.config/setup/50-install-cargo-packages.sh b/.config/setup/50-install-cargo-packages.sh
index e46a08d..b8856e7 100755
--- a/.config/setup/50-install-cargo-packages.sh
+++ b/.config/setup/50-install-cargo-packages.sh
@@ -1,3 +1,6 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 cargo install zellij
diff --git a/.local/bin/ghup b/.local/bin/ghup
index 1941987..d198be9 100755
--- a/.local/bin/ghup
+++ b/.local/bin/ghup
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 STATE_DIR="$(systemd-path user-state-private)"/github-versions
 mkdir --parents "${STATE_DIR}"
diff --git a/.local/bin/git-resign b/.local/bin/git-resign
index 90a7a05..6d45d8e 100755
--- a/.local/bin/git-resign
+++ b/.local/bin/git-resign
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 rebase_marker="$(git rev-parse --show-toplevel)/.git/rebase-merge/done"
 while [ -f "${rebase_marker}" ]
diff --git a/.local/bin/kill-current-zellij-session b/.local/bin/kill-current-zellij-session
index ac22ec5..378e1bf 100755
--- a/.local/bin/kill-current-zellij-session
+++ b/.local/bin/kill-current-zellij-session
@@ -1,3 +1,6 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 zellij delete-session --force "${ZELLIJ_SESSION_NAME}"
diff --git a/.local/bin/leave b/.local/bin/leave
index 7d51b3f..438c45e 100755
--- a/.local/bin/leave
+++ b/.local/bin/leave
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 listopts() {
     echo "⏼ Shut down"
diff --git a/.local/bin/make-backup b/.local/bin/make-backup
index eb6bbe1..251a77c 100755
--- a/.local/bin/make-backup
+++ b/.local/bin/make-backup
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 TS_DIR="$(systemd-path user-state-private)"/backup
 
diff --git a/.local/bin/no-ipv6 b/.local/bin/no-ipv6
index e1192d5..3ad8edb 100755
--- a/.local/bin/no-ipv6
+++ b/.local/bin/no-ipv6
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 sudo sysctl net.ipv6.conf.all.disable_ipv6=1
 "$@"
diff --git a/.local/bin/package-alert b/.local/bin/package-alert
index 1bce7c2..2d11eb9 100755
--- a/.local/bin/package-alert
+++ b/.local/bin/package-alert
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 WATCHLIST="$(systemd-path user-shared)"/package-alert/watchlist
 
diff --git a/.local/bin/pull-emacs-tide b/.local/bin/pull-emacs-tide
index 2ceaac9..f41212c 100755
--- a/.local/bin/pull-emacs-tide
+++ b/.local/bin/pull-emacs-tide
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 podman run \
        --rm \
diff --git a/.local/bin/resync-git-sync b/.local/bin/resync-git-sync
index 5486d52..f167ca8 100755
--- a/.local/bin/resync-git-sync
+++ b/.local/bin/resync-git-sync
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 REPO_DIR="$(systemd-path user-state-private)"/git-sync
 if [ -d "${REPO_DIR}" ]
diff --git a/.local/bin/sync-backup b/.local/bin/sync-backup
index 8e6574a..97edd7a 100755
--- a/.local/bin/sync-backup
+++ b/.local/bin/sync-backup
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 export BORG_REPO="/media/backup/"
 
diff --git a/.local/bin/take-screenshot b/.local/bin/take-screenshot
index a586a10..f2cf7c2 100755
--- a/.local/bin/take-screenshot
+++ b/.local/bin/take-screenshot
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 listopts() {
     echo "📷 Focused monitor"
diff --git a/.local/bin/update-weather b/.local/bin/update-weather
index 6acdf66..25d37c3 100755
--- a/.local/bin/update-weather
+++ b/.local/bin/update-weather
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 # Documentation available in https://github.com/chubin/wttr.in
 curl --http1.1 --show-error --silent 'https://wttr.in/?0&m&q&T&format=3' > /tmp/weather-report.txt
diff --git a/.local/bin/upgrade b/.local/bin/upgrade
index 6acd66c..95784aa 100755
--- a/.local/bin/upgrade
+++ b/.local/bin/upgrade
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 apt_update() {
     sudo --reset-timestamp
diff --git a/.local/bin/vaulter b/.local/bin/vaulter
index f3f17b9..f12dd73 100755
--- a/.local/bin/vaulter
+++ b/.local/bin/vaulter
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 podman --transient-store run --rm -ti \
     --env WAYLAND_DISPLAY \
diff --git a/.local/share/github-versions/dolt b/.local/share/github-versions/dolt
index 72b1559..21ac93a 100755
--- a/.local/share/github-versions/dolt
+++ b/.local/share/github-versions/dolt
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 package=dolt
 repo=dolthub/dolt
diff --git a/.local/share/github-versions/kingfisher b/.local/share/github-versions/kingfisher
index 116183e..92eb753 100755
--- a/.local/share/github-versions/kingfisher
+++ b/.local/share/github-versions/kingfisher
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 package=kingfisher
 repo=mongodb/kingfisher
diff --git a/.local/share/github-versions/minikube b/.local/share/github-versions/minikube
index 8bbc23c..733d6f3 100755
--- a/.local/share/github-versions/minikube
+++ b/.local/share/github-versions/minikube
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 package=minikube
 repo=kubernetes/minikube
diff --git a/.local/share/github-versions/rust-analyzer b/.local/share/github-versions/rust-analyzer
index 9452be9..69196c7 100755
--- a/.local/share/github-versions/rust-analyzer
+++ b/.local/share/github-versions/rust-analyzer
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 package=rust-analyzer
 repo=rust-lang/rust-analyzer
diff --git a/.local/share/github-versions/uv b/.local/share/github-versions/uv
index 856c4c7..3a03d30 100755
--- a/.local/share/github-versions/uv
+++ b/.local/share/github-versions/uv
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 package=uv
 repo=astral-sh/uv