diff --git a/mkosi.images/system/mkosi.clean b/mkosi.images/system/mkosi.clean
index cb716c41f71..64810b79571 100755
--- a/mkosi.images/system/mkosi.clean
+++ b/mkosi.images/system/mkosi.clean
@@ -1,4 +1,5 @@
 #!/bin/bash
 set -e
+set -o nounset
 
 rm -f "$OUTPUTDIR"/*.{rpm,deb,pkg.tar}
diff --git a/mkosi.images/system/mkosi.postinst.chroot b/mkosi.images/system/mkosi.postinst.chroot
index 397884b7202..acb4e631e9c 100755
--- a/mkosi.images/system/mkosi.postinst.chroot
+++ b/mkosi.images/system/mkosi.postinst.chroot
@@ -1,6 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
+set -o nounset
 
 if command -v authselect >/dev/null; then
     # authselect 1.5.0 renamed the minimal profile to the local profile without keeping backwards compat so
diff --git a/mkosi.images/system/mkosi.sanitizers.chroot b/mkosi.images/system/mkosi.sanitizers.chroot
index 854a419933b..524e3dadb19 100755
--- a/mkosi.images/system/mkosi.sanitizers.chroot
+++ b/mkosi.images/system/mkosi.sanitizers.chroot
@@ -1,8 +1,9 @@
 #!/bin/bash
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
+set -o nounset
 
-if [[ -z "$SANITIZERS" ]]; then
+if [[ -z "${SANITIZERS:-}" ]]; then
     exit 0
 fi
 
@@ -18,7 +19,7 @@ EOF
 # ASAN and syscall filters aren't compatible with each other.
 find /usr /etc -name '*.service' -type f -exec sed -i 's/^\(MemoryDeny\|SystemCall\)/# \1/' {} +
 
-# `systemd-hwdb update` takes > 50s when built with sanitizers so let's not run it by default.
+# 'systemd-hwdb update' takes > 50s when built with sanitizers so let's not run it by default.
 systemctl mask systemd-hwdb-update.service
 
 ASAN_RT_PATH="$(grep libasan.so < <(ldd /usr/lib/systemd/systemd) | cut -d ' ' -f 3)"
diff --git a/mkosi.images/system/mkosi.sync b/mkosi.images/system/mkosi.sync
index a4f0ab94ec1..6856af7c6b0 100755
--- a/mkosi.images/system/mkosi.sync
+++ b/mkosi.images/system/mkosi.sync
@@ -1,8 +1,9 @@
 #!/bin/bash
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
+set -o nounset
 
-if ((NO_SYNC)); then
+if ((${NO_SYNC:-0})); then
     exit 0
 fi