diff --git a/run_once_before_decrypt-private-key.sh b/run_once_before_decrypt-private-key.sh
index 8a401e5..6b7e688 100644
--- a/run_once_before_decrypt-private-key.sh
+++ b/run_once_before_decrypt-private-key.sh
@@ -3,6 +3,10 @@
 # Any copyright is dedicated to the Public Domain.
 # https://creativecommons.org/publicdomain/zero/1.0/
 
+set -o nounset
+set -o errexit
+set -o pipefail
+
 if [ ! -f "/home/steveno/.config/chezmoi/key.txt" ]; then
     mkdir -p "/home/steveno/.config/chezmoi"
     chezmoi age decrypt --output "/home/steveno/.config/chezmoi/key.txt" --passphrase "{{ .chezmoi.sourceDir }}/key.txt.age"