diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index e2d06d1..c5cc25e 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -23,12 +23,16 @@ jobs:
       - name: Run ShellCheck
         run: |
           git diff --name-only -z `git merge-base origin/master HEAD` -- \
-            'install/_lib.sh' \
+            install/_lib.sh \
+            'optional-modifications/**.sh' \
+            'scripts/**.sh' \
+            unit-test.sh \
+            'workstation/**.sh' \
           | xargs -0 -r -- \
             shellcheck \
               --shell=bash \
-              --exclude=SC1090,SC1091 \
               --format=json1 \
+              --external-sources \
           | jq -r '
             .comments
             | map(.level |= if ([.] | inside(["info", "style"])) then "notice" else . end)
diff --git a/scripts/_lib.sh b/scripts/_lib.sh
index a742f8a..ba57fc4 100755
--- a/scripts/_lib.sh
+++ b/scripts/_lib.sh
@@ -7,7 +7,7 @@ if [ -n "${DEBUG:-}" ]; then
 fi
 
 function confirm() {
-  read -p "$1 [y/n] " confirmation
+  read -r -p "$1 [y/n] " confirmation
   if [ "$confirmation" != "y" ]; then
     echo "Canceled. 😅"
     exit
@@ -26,8 +26,7 @@ function reset() {
   # we're targeting a valid tag here. Do this early in order to fail fast.
   if [ -n "$version" ]; then
     set +e
-    git rev-parse --verify --quiet "refs/tags/$version" >/dev/null
-    if [ $? -gt 0 ]; then
+    if ! git rev-parse --verify --quiet "refs/tags/$version" >/dev/null; then
       echo "Bad version: $version"
       exit
     fi
@@ -43,12 +42,15 @@ function reset() {
     echo "Okay ... good luck! 😰"
   fi
 
+  # assert that commands are defined
+  : "${dc:?}" "${cmd:?}"
+
   # Hit the reset button.
   $dc down --volumes --remove-orphans --rmi local
 
   # Remove any remaining (likely external) volumes with name matching 'sentry-.*'.
   for volume in $(docker volume list --format '{{ .Name }}' | grep '^sentry-'); do
-    docker volume remove $volume >/dev/null &&
+    docker volume remove "$volume" >/dev/null &&
       echo "Removed volume: $volume" ||
       echo "Skipped volume: $volume"
   done
@@ -60,30 +62,34 @@ function reset() {
 }
 
 function backup() {
+  local type
+
   type=${1:-"global"}
-  touch $(pwd)/sentry/backup.json
-  chmod 666 $(pwd)/sentry/backup.json
-  $dc run -v $(pwd)/sentry:/sentry-data/backup --rm -T -e SENTRY_LOG_LEVEL=CRITICAL web export $type /sentry-data/backup/backup.json
+  touch "${PWD}/sentry/backup.json"
+  chmod 666 "${PWD}/sentry/backup.json"
+  $dc run -v "${PWD}/sentry:/sentry-data/backup" --rm -T -e SENTRY_LOG_LEVEL=CRITICAL web export "$type" /sentry-data/backup/backup.json
 }
 
 function restore() {
-  type=${1:-"global"}
-  $dc run --rm -T web import $type /etc/sentry/backup.json
+  local type
+
+  type="${1:-global}"
+  $dc run --rm -T web import "$type" /etc/sentry/backup.json
 }
 
 # Needed variables to source error-handling script
 MINIMIZE_DOWNTIME="${MINIMIZE_DOWNTIME:-}"
-STOP_TIMEOUT=60
+export STOP_TIMEOUT=60
 
 # Save logs in order to send envelope to Sentry
-log_file=sentry_"${cmd%% *}"_log-$(date +'%Y-%m-%d_%H-%M-%S').txt
+log_file="sentry_${cmd%% *}_log-$(date +%Y-%m-%d_%H-%M-%S).txt"
 exec &> >(tee -a "$log_file")
 version=""
 
 while (($#)); do
   case "$1" in
-  --report-self-hosted-issues) REPORT_SELF_HOSTED_ISSUES=1 ;;
-  --no-report-self-hosted-issues) REPORT_SELF_HOSTED_ISSUES=0 ;;
+  --report-self-hosted-issues) export REPORT_SELF_HOSTED_ISSUES=1 ;;
+  --no-report-self-hosted-issues) export REPORT_SELF_HOSTED_ISSUES=0 ;;
   *) version=$1 ;;
   esac
   shift
diff --git a/scripts/bump-version.sh b/scripts/bump-version.sh
index 5e53ec8..f5853a3 100755
--- a/scripts/bump-version.sh
+++ b/scripts/bump-version.sh
@@ -7,4 +7,5 @@ NEW_VERSION="$2"
 sed -i -e "s/^\(SENTRY\|SNUBA\|RELAY\|SYMBOLICATOR\|TASKBROKER\|VROOM\)_IMAGE=\([^:]\+\):.\+\$/\1_IMAGE=\2:$NEW_VERSION/" .env
 sed -i -e "s/^\# Self-Hosted Sentry .*/# Self-Hosted Sentry $NEW_VERSION/" README.md
 
+[ -z "$OLD_VERSION" ] || echo "Previous version: $OLD_VERSION"
 echo "New version: $NEW_VERSION"
diff --git a/scripts/restore.sh b/scripts/restore.sh
index ededd31..ae3666b 100755
--- a/scripts/restore.sh
+++ b/scripts/restore.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 cmd="restore $1"
 source scripts/_lib.sh
+
 $cmd
diff --git a/unit-test.sh b/unit-test.sh
index 01a945e..8dbc0d7 100755
--- a/unit-test.sh
+++ b/unit-test.sh
@@ -5,7 +5,7 @@ export REPORT_SELF_HOSTED_ISSUES=0 # will be over-ridden in the relevant test
 FORCE_CLEAN=1 "./scripts/reset.sh"
 fail=0
 for test_file in _unit-test/*-test.sh; do
-  if [ "$1" -a "$1" != "$test_file" ]; then
+  if [ -n "$1" ] && [ "$1" != "$test_file" ]; then
     echo "🙊 Skipping $test_file ..."
     continue
   fi
diff --git a/workstation/200_download-self-hosted.sh b/workstation/200_download-self-hosted.sh
index a07735d..406a52c 100644
--- a/workstation/200_download-self-hosted.sh
+++ b/workstation/200_download-self-hosted.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-#
+set -eo pipefail
 
 # Create getsentry folder and enter.
 mkdir /home/user/getsentry