diff --git a/flake.nix b/flake.nix
index 3e0b568..98e0ec9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -63,6 +63,7 @@
             src = ./.;
             hooks = {
               nixpkgs-fmt.enable = true;
+              shellcheck.enable = true;
             };
           };
         };
@@ -138,6 +139,7 @@
         devShell = pkgs.mkShell {
           buildInputs = (with pkgs; [
             nixpkgs-fmt
+            shellcheck
             sops
             ssh-to-pgp
           ]);
diff --git a/users/simon/files/scripts/btsync b/users/simon/files/scripts/btsync
index 7f5a734..c0f4ae9 100755
--- a/users/simon/files/scripts/btsync
+++ b/users/simon/files/scripts/btsync
@@ -2,6 +2,6 @@
 set -eo pipefail
 card=$(pactl list cards short | grep -E -o "bluez_card.*" | cut -f1)
 # pactl does not support any easily parsable output format
-profile=$(pactl list cards | rg -oU "Name: ${card}.*(\\n.*?)*.*Active Profile: (.*)" -r '$2')
-pacmd set-card-profile $card off
-pacmd set-card-profile $card "$profile"
+profile=$(pactl list cards | rg -oU "Name: ${card}.*(\\n.*?)*.*Active Profile: (.*)" -r "\$2")
+pacmd set-card-profile "$card" off
+pacmd set-card-profile "$card" "$profile"
diff --git a/users/simon/files/scripts/mkvextract-all-attachments b/users/simon/files/scripts/mkvextract-all-attachments
index 8000884..04305e1 100755
--- a/users/simon/files/scripts/mkvextract-all-attachments
+++ b/users/simon/files/scripts/mkvextract-all-attachments
@@ -1,2 +1,3 @@
 #!/usr/bin/env bash
-mkvextract "$1" attachments $(mkvmerge --identify "$1" | grep "Attachment ID" | sed "s/Attachment ID \([0-9]*\): .*/\1/")
+set -eo pipefail
+mkvextract "$1" attachments "$(mkvmerge --identify "$1" | grep "Attachment ID" | sed "s/Attachment ID \([0-9]*\): .*/\1/")"
diff --git a/users/simon/files/scripts/mkvpropedit-add-fonts b/users/simon/files/scripts/mkvpropedit-add-fonts
index 21cc1b3..fabecbe 100755
--- a/users/simon/files/scripts/mkvpropedit-add-fonts
+++ b/users/simon/files/scripts/mkvpropedit-add-fonts
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+set -e
 file="$1"
 shift
 for attachment in "$@"; do
diff --git a/users/simon/files/scripts/renumber b/users/simon/files/scripts/renumber
index 96d12d1..51d8667 100755
--- a/users/simon/files/scripts/renumber
+++ b/users/simon/files/scripts/renumber
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+set -euo pipefail
 if (( $# < 2 )); then
 	echo "USAGE: $0 DIGITS FILES"
 	return 1
@@ -6,7 +7,8 @@ fi
 digits="$1"
 shift 1
 i=1
-for file in $@; do
-	mv -n "$file" "$(dirname $file)/$(printf %0${digits}d $i).${file##*.}"
+for file in "$@"; do
+	file="$(readlink -f "$file")"
+	mv -n "$file" "${file%/*}/$(printf "%0${digits}d" "$i").${file##*.}"
 	i="$((i+1))"
 done