diff --git a/.config/emacs/init.el b/.config/emacs/init.el
index 94dbd23..de9791c 100644
--- a/.config/emacs/init.el
+++ b/.config/emacs/init.el
@@ -8,6 +8,11 @@
     (zerop (call-process "git" nil nil nil
                          "-C" dirname "ls-files" "--error-unmatch" filename))))
 
+(defun should-auto-save-current-buffer-p ()
+  "Check whether the current buffer should be autosaved."
+  (when buffer-file-name
+    (git-tracked-file-p buffer-file-name)))
+
 (defun find-init-file ()
   "Find the user's init file"
   (interactive)
@@ -42,7 +47,7 @@
   ; keep-sorted start
   (auto-save-interval 20)
   (auto-save-visited-mode t)
-  (auto-save-visited-predicate (lambda () (git-tracked-file-p buffer-file-name)))
+  (auto-save-visited-predicate #'should-auto-save-current-buffer)
   (column-number-mode t)
   (dired-dwim-target 'dired-dwim-target-next)
   (display-time-24hr-format t)
diff --git a/.config/setup/02-install-debian-testing.sh b/.config/setup/02-install-debian-testing.sh
new file mode 100755
index 0000000..7cf2c21
--- /dev/null
+++ b/.config/setup/02-install-debian-testing.sh
@@ -0,0 +1,10 @@
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
+
+sudo cp "$(systemd-path user-configuration)"/setup/sources.list.d/debian.sources /etc/apt/sources.list.d/
+sudo rm /etc/apt/sources.list
+
+sudo apt update
+sudo apt --yes full-upgrade
diff --git a/.config/setup/01-install-packages.sh b/.config/setup/04-install-deb-packages.sh
similarity index 77%
rename from .config/setup/01-install-packages.sh
rename to .config/setup/04-install-deb-packages.sh
index 0b56d5b..d1e8af7 100755
--- a/.config/setup/01-install-packages.sh
+++ b/.config/setup/04-install-deb-packages.sh
@@ -10,6 +10,7 @@ DEB_PKGS=(
     audacity
     avahi-daemon
     awscli
+    blueman
     bluez
     borgbackup
     build-essential
@@ -53,6 +54,7 @@ DEB_PKGS=(
     mesa-utils
     minicom
     mpv
+    network-manager-applet
     network-manager-openvpn
     nmap
     ntfs-3g
@@ -104,33 +106,5 @@ META_PKGS=(
     # keep-sorted end
 )
 
-PIPX_PKGS=(
-    # keep-sorted start
-    python-lsp-server
-    rshell
-    ruff
-    # keep-sorted end
-)
-
 sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes "${DEB_PKGS[@]}"
 sudo DEBIAN_FRONTEND=noninteractive apt-get install --install-recommends --yes "${META_PKGS[@]}"
-
-echo 'kernel.perf_event_paranoid=1' | sudo tee '/etc/sysctl.d/51-enable-perf-events.conf'
-
-if (( "${#PIPX_PKGS[@]}" != 0 )); then
-    pipx install "${PIPX_PKGS[@]}"
-fi
-
-PYLSP_PLUGINS=(
-    # keep-sorted start
-    fs
-    podman
-    pydantic
-    pylsp-mypy
-    pylsp-rope
-    pytest
-    types-pyxdg
-    # keep-sorted end
-)
-
-pipx inject python-lsp-server "${PYLSP_PLUGINS[@]}"
diff --git a/.config/setup/06-install-git-sync.sh b/.config/setup/06-install-git-sync.sh
deleted file mode 100755
index ac57a8f..0000000
--- a/.config/setup/06-install-git-sync.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#! /usr/bin/sh
-
-resync-git-sync
diff --git a/.config/setup/06-install-pipx-packages.sh b/.config/setup/06-install-pipx-packages.sh
new file mode 100755
index 0000000..91d04f3
--- /dev/null
+++ b/.config/setup/06-install-pipx-packages.sh
@@ -0,0 +1,30 @@
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
+
+PIPX_PKGS=(
+    # keep-sorted start
+    python-lsp-server
+    rshell
+    ruff
+    # keep-sorted end
+)
+
+if (( "${#PIPX_PKGS[@]}" != 0 )); then
+    pipx install "${PIPX_PKGS[@]}"
+fi
+
+PYLSP_PLUGINS=(
+    # keep-sorted start
+    fs
+    podman
+    pydantic
+    pylsp-mypy
+    pylsp-rope
+    pytest
+    types-pyxdg
+    # keep-sorted end
+)
+
+pipx inject python-lsp-server "${PYLSP_PLUGINS[@]}"
diff --git a/.config/setup/02-setup-packages.sh b/.config/setup/12-setup-packages.sh
similarity index 53%
rename from .config/setup/02-setup-packages.sh
rename to .config/setup/12-setup-packages.sh
index 859047f..48c0136 100755
--- a/.config/setup/02-setup-packages.sh
+++ b/.config/setup/12-setup-packages.sh
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 systemctl --user enable --now syncthing.service
 
@@ -7,3 +10,5 @@ mkdir --parents ~/Pictures/screenshots
 pre-commit install
 
 sudo usermod --append --groups dialout "${USER}"
+
+echo 'kernel.perf_event_paranoid=1' | sudo tee '/etc/sysctl.d/51-enable-perf-events.conf'
diff --git a/.config/setup/03-install-cron-jobs.sh b/.config/setup/14-install-cron-jobs.sh
similarity index 79%
rename from .config/setup/03-install-cron-jobs.sh
rename to .config/setup/14-install-cron-jobs.sh
index 829ad9b..22851b8 100755
--- a/.config/setup/03-install-cron-jobs.sh
+++ b/.config/setup/14-install-cron-jobs.sh
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 # keep-sorted start
 systemctl --user enable --now backup.timer
diff --git a/.config/setup/05-install-tor.sh b/.config/setup/16-install-tor.sh
similarity index 90%
rename from .config/setup/05-install-tor.sh
rename to .config/setup/16-install-tor.sh
index 4c1e33b..5688ea2 100755
--- a/.config/setup/05-install-tor.sh
+++ b/.config/setup/16-install-tor.sh
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 sudo cp "$(systemd-path user-configuration)"/setup/sources.list.d/tor.sources /etc/apt/sources.list.d/
 sudo chmod 644 /etc/apt/sources.list.d/tor.sources
diff --git a/.config/setup/18-install-git-sync.sh b/.config/setup/18-install-git-sync.sh
new file mode 100755
index 0000000..c5824c1
--- /dev/null
+++ b/.config/setup/18-install-git-sync.sh
@@ -0,0 +1,6 @@
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
+
+resync-git-sync
diff --git a/.config/setup/10-install-zoom.sh b/.config/setup/20-install-zoom.sh
similarity index 77%
rename from .config/setup/10-install-zoom.sh
rename to .config/setup/20-install-zoom.sh
index 72dd1f9..d1260cc 100755
--- a/.config/setup/10-install-zoom.sh
+++ b/.config/setup/20-install-zoom.sh
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 curl --location --output-dir /tmp --remote-name https://zoom.us/client/latest/zoom_amd64.deb
 sudo apt-get install --no-install-recommends --yes /tmp/zoom_amd64.deb
diff --git a/.config/setup/22-install-github-packages.sh b/.config/setup/22-install-github-packages.sh
deleted file mode 100755
index 13d5478..0000000
--- a/.config/setup/22-install-github-packages.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#! /usr/bin/sh
-
-ghup
diff --git a/.config/setup/30-install-cargo-packages.sh b/.config/setup/30-install-cargo-packages.sh
deleted file mode 100755
index e46a08d..0000000
--- a/.config/setup/30-install-cargo-packages.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#! /usr/bin/sh
-
-cargo install zellij
diff --git a/.config/setup/11-initialize-backup-repository.sh b/.config/setup/31-initialize-backup-repository.sh
similarity index 56%
rename from .config/setup/11-initialize-backup-repository.sh
rename to .config/setup/31-initialize-backup-repository.sh
index 26c475e..fe2c0cf 100755
--- a/.config/setup/11-initialize-backup-repository.sh
+++ b/.config/setup/31-initialize-backup-repository.sh
@@ -1,6 +1,9 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
 
-sudo mkdir -p "${BORG_REPO}"
+set -euo pipefail
+IFS=$'\n\t'
+
+sudo mkdir --parents "${BORG_REPO}"
 sudo chown "${USER}":"${USER}" "${BORG_REPO}"
 sudo chmod 700 "${BORG_REPO}"
 
diff --git a/.config/setup/42-install-github-packages.sh b/.config/setup/42-install-github-packages.sh
new file mode 100755
index 0000000..1ebd793
--- /dev/null
+++ b/.config/setup/42-install-github-packages.sh
@@ -0,0 +1,6 @@
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
+
+ghup
diff --git a/.config/setup/23-install-emacs-lilypond-mode.sh b/.config/setup/43-install-emacs-lilypond-mode.sh
similarity index 62%
rename from .config/setup/23-install-emacs-lilypond-mode.sh
rename to .config/setup/43-install-emacs-lilypond-mode.sh
index 97855fd..cf53bf2 100755
--- a/.config/setup/23-install-emacs-lilypond-mode.sh
+++ b/.config/setup/43-install-emacs-lilypond-mode.sh
@@ -1,8 +1,11 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 projdir="$(systemd-path user)"/Projects
-mkdir -p "${projdir}"
-rm -rf "${projdir}/lilypond"
+mkdir --parents "${projdir}"
+rm --force --recursive "${projdir}/lilypond"
 cd "${projdir}" || exit
 git clone --depth=1 https://github.com/lilypond/lilypond
 cd lilypond || exit
diff --git a/.config/setup/50-install-cargo-packages.sh b/.config/setup/50-install-cargo-packages.sh
new file mode 100755
index 0000000..b8856e7
--- /dev/null
+++ b/.config/setup/50-install-cargo-packages.sh
@@ -0,0 +1,6 @@
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
+
+cargo install zellij
diff --git a/.config/sway/config b/.config/sway/config
index b76ca8f..43bcd99 100644
--- a/.config/sway/config
+++ b/.config/sway/config
@@ -294,6 +294,9 @@ bar {
     }
 }
 
+exec blueman-applet
+exec nm-applet
+
 workspace_layout tabbed
 for_window [class="."] inhibit_idle fullscreen
 for_window [app_id="."] inhibit_idle fullscreen
diff --git a/.local/bin/ghup b/.local/bin/ghup
index 74de4a3..d198be9 100755
--- a/.local/bin/ghup
+++ b/.local/bin/ghup
@@ -1,7 +1,10 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 STATE_DIR="$(systemd-path user-state-private)"/github-versions
-mkdir -p "${STATE_DIR}"
+mkdir --parents "${STATE_DIR}"
 
 github_update() {
     package="$1"
diff --git a/.local/bin/git-resign b/.local/bin/git-resign
index 90a7a05..6d45d8e 100755
--- a/.local/bin/git-resign
+++ b/.local/bin/git-resign
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 rebase_marker="$(git rev-parse --show-toplevel)/.git/rebase-merge/done"
 while [ -f "${rebase_marker}" ]
diff --git a/.local/bin/kill-current-zellij-session b/.local/bin/kill-current-zellij-session
index ac22ec5..378e1bf 100755
--- a/.local/bin/kill-current-zellij-session
+++ b/.local/bin/kill-current-zellij-session
@@ -1,3 +1,6 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 zellij delete-session --force "${ZELLIJ_SESSION_NAME}"
diff --git a/.local/bin/leave b/.local/bin/leave
index 7d51b3f..438c45e 100755
--- a/.local/bin/leave
+++ b/.local/bin/leave
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 listopts() {
     echo "⏼ Shut down"
diff --git a/.local/bin/make-backup b/.local/bin/make-backup
index 7d05e48..251a77c 100755
--- a/.local/bin/make-backup
+++ b/.local/bin/make-backup
@@ -1,8 +1,11 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 TS_DIR="$(systemd-path user-state-private)"/backup
 
-mkdir -p "${TS_DIR}"
+mkdir --parents "${TS_DIR}"
 
 backup () {
     target=$1
diff --git a/.local/bin/no-ipv6 b/.local/bin/no-ipv6
index e1192d5..3ad8edb 100755
--- a/.local/bin/no-ipv6
+++ b/.local/bin/no-ipv6
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 sudo sysctl net.ipv6.conf.all.disable_ipv6=1
 "$@"
diff --git a/.local/bin/package-alert b/.local/bin/package-alert
index 1bce7c2..2d11eb9 100755
--- a/.local/bin/package-alert
+++ b/.local/bin/package-alert
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 WATCHLIST="$(systemd-path user-shared)"/package-alert/watchlist
 
diff --git a/.local/bin/pull-emacs-tide b/.local/bin/pull-emacs-tide
index 2ceaac9..f41212c 100755
--- a/.local/bin/pull-emacs-tide
+++ b/.local/bin/pull-emacs-tide
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 podman run \
        --rm \
diff --git a/.local/bin/resync-git-sync b/.local/bin/resync-git-sync
index 5486d52..f167ca8 100755
--- a/.local/bin/resync-git-sync
+++ b/.local/bin/resync-git-sync
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 REPO_DIR="$(systemd-path user-state-private)"/git-sync
 if [ -d "${REPO_DIR}" ]
diff --git a/.local/bin/sync-backup b/.local/bin/sync-backup
index 8e6574a..97edd7a 100755
--- a/.local/bin/sync-backup
+++ b/.local/bin/sync-backup
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 export BORG_REPO="/media/backup/"
 
diff --git a/.local/bin/sync-git-repos b/.local/bin/sync-git-repos
index d1fce9e..f8ba4c4 100755
--- a/.local/bin/sync-git-repos
+++ b/.local/bin/sync-git-repos
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 REPO_ROOT_FILE="$(systemd-path user-state-private)"/repo-roots/repo-roots
 
@@ -16,14 +19,21 @@ sync_repo () {
     echo
 }
 
-if [ "list" = "$1" ]; then
-    while read -r repo_root; do
-        list_repos "${repo_root}"
-    done < "${REPO_ROOT_FILE}"
-else
-    while read -r repo_root; do
-        for repo in $(list_repos "${repo_root}"); do
-            sync_repo "${repo}"
-        done
-    done < "${REPO_ROOT_FILE}"
-fi
+case "${1:-sync}" in
+    "list")
+        while read -r repo_root; do
+            list_repos "${repo_root}"
+        done < "${REPO_ROOT_FILE}"
+        ;;
+    "sync")
+        while read -r repo_root; do
+            for repo in $(list_repos "${repo_root}"); do
+                sync_repo "${repo}"
+            done
+        done < "${REPO_ROOT_FILE}"
+        ;;
+    *)
+        echo Unknown option \""$1"\"
+        exit 1
+        ;;
+esac
diff --git a/.local/bin/take-screenshot b/.local/bin/take-screenshot
index a586a10..f2cf7c2 100755
--- a/.local/bin/take-screenshot
+++ b/.local/bin/take-screenshot
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 listopts() {
     echo "📷 Focused monitor"
diff --git a/.local/bin/update-weather b/.local/bin/update-weather
index 6acdf66..25d37c3 100755
--- a/.local/bin/update-weather
+++ b/.local/bin/update-weather
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 # Documentation available in https://github.com/chubin/wttr.in
 curl --http1.1 --show-error --silent 'https://wttr.in/?0&m&q&T&format=3' > /tmp/weather-report.txt
diff --git a/.local/bin/upgrade b/.local/bin/upgrade
index 6acd66c..95784aa 100755
--- a/.local/bin/upgrade
+++ b/.local/bin/upgrade
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 apt_update() {
     sudo --reset-timestamp
diff --git a/.local/bin/vaulter b/.local/bin/vaulter
index f3f17b9..f12dd73 100755
--- a/.local/bin/vaulter
+++ b/.local/bin/vaulter
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 podman --transient-store run --rm -ti \
     --env WAYLAND_DISPLAY \
diff --git a/.local/share/github-versions/dolt b/.local/share/github-versions/dolt
index 72b1559..21ac93a 100755
--- a/.local/share/github-versions/dolt
+++ b/.local/share/github-versions/dolt
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 package=dolt
 repo=dolthub/dolt
diff --git a/.local/share/github-versions/kingfisher b/.local/share/github-versions/kingfisher
index 116183e..92eb753 100755
--- a/.local/share/github-versions/kingfisher
+++ b/.local/share/github-versions/kingfisher
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 package=kingfisher
 repo=mongodb/kingfisher
diff --git a/.local/share/github-versions/minikube b/.local/share/github-versions/minikube
index 8bbc23c..733d6f3 100755
--- a/.local/share/github-versions/minikube
+++ b/.local/share/github-versions/minikube
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 package=minikube
 repo=kubernetes/minikube
diff --git a/.local/share/github-versions/rust-analyzer b/.local/share/github-versions/rust-analyzer
index 9452be9..69196c7 100755
--- a/.local/share/github-versions/rust-analyzer
+++ b/.local/share/github-versions/rust-analyzer
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 package=rust-analyzer
 repo=rust-lang/rust-analyzer
diff --git a/.local/share/github-versions/uv b/.local/share/github-versions/uv
index 856c4c7..3a03d30 100755
--- a/.local/share/github-versions/uv
+++ b/.local/share/github-versions/uv
@@ -1,4 +1,7 @@
-#! /usr/bin/sh
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
 
 package=uv
 repo=astral-sh/uv