diff --git a/targets/web01/decrypt.sh b/targets/web01/decrypt.sh
index d712ff2..63b9eb9 100755
--- a/targets/web01/decrypt.sh
+++ b/targets/web01/decrypt.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p coreutils sops openssh
+# shellcheck shell=bash
 
 # shellcheck disable=SC1008,SC1128
 
diff --git a/targets/web01/deploy.sh b/targets/web01/deploy.sh
index 1895473..f4626e4 100755
--- a/targets/web01/deploy.sh
+++ b/targets/web01/deploy.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p nix jq bash rsync
+# shellcheck shell=bash
 
 # shellcheck disable=SC1008,SC1128
 
diff --git a/terraform/web01/install.sh b/terraform/web01/install.sh
index 63d5cf2..0b9a6d3 100644
--- a/terraform/web01/install.sh
+++ b/terraform/web01/install.sh
@@ -1,8 +1,8 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p coreutils sops openssh nix
 
+# shellcheck shell=bash
 # shellcheck disable=SC1008,SC1128
-set -euox pipefail
 
 if [[ -z "${HOST:-}" ]]; then
   echo "HOST is not set"