diff --git a/nixosModules/clanCore/secrets/default.nix b/nixosModules/clanCore/secrets/default.nix
index e0f814f08..5f6211b28 100644
--- a/nixosModules/clanCore/secrets/default.nix
+++ b/nixosModules/clanCore/secrets/default.nix
@@ -70,6 +70,7 @@
                   internal = true;
                   default = ''
                     export PATH="${lib.makeBinPath config.path}"
+                    set -efu -o pipefail
                     ${config.script}
                   '';
                 };