diff --git a/minimal/initramfs.yaml b/minimal/initramfs.yaml
index fe4bbeb..a650e34 100644
--- a/minimal/initramfs.yaml
+++ b/minimal/initramfs.yaml
@@ -2,6 +2,7 @@
 postprocess:
   - |
     #!/usr/bin/env bash
+    set -xeuo pipefail
     mkdir -p /usr/lib/dracut/dracut.conf.d
     cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF'
     # We want a generic image; hostonly makes no sense as part of a server side build
diff --git a/minimal/ostree.yaml b/minimal/ostree.yaml
index af49580..99e256e 100644
--- a/minimal/ostree.yaml
+++ b/minimal/ostree.yaml
@@ -5,6 +5,7 @@ postprocess:
   # Set up default root config
   - |
     #!/usr/bin/env bash
+    set -xeuo pipefail
     mkdir -p /usr/lib/ostree
     cat > /usr/lib/ostree/prepare-root.conf << EOF
     [composefs]
diff --git a/minimal/tmpfiles.yaml b/minimal/tmpfiles.yaml
index d37ef7f..0065b98 100644
--- a/minimal/tmpfiles.yaml
+++ b/minimal/tmpfiles.yaml
@@ -1,6 +1,7 @@
 postprocess:
   - |
     #!/bin/bash
+    set -xeuo pipefail
     cat >/usr/lib/tmpfiles.d/bootc-base-rpmstate.conf <<'EOF'
     # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=771713
     d /var/lib/rpm-state 0755 - - -
diff --git a/standard/autoupdates.yaml b/standard/autoupdates.yaml
index a416699..04b35f3 100644
--- a/standard/autoupdates.yaml
+++ b/standard/autoupdates.yaml
@@ -2,8 +2,7 @@
 postprocess:
   - |
     #!/usr/bin/env bash
-    set -euo pipefail
+    set -xeuo pipefail
     target=/usr/lib/systemd/system/default.target.wants
     mkdir -p $target
-    set -x
     ln -s ../bootc-fetch-apply-updates.timer $target
diff --git a/standard/generic-growfs.yaml b/standard/generic-growfs.yaml
index f64be92..5f4e0af 100644
--- a/standard/generic-growfs.yaml
+++ b/standard/generic-growfs.yaml
@@ -7,6 +7,6 @@ add-files:
 postprocess:
   - |
     #!/bin/bash
-    set -euo pipefail
+    set -xeuo pipefail
     mkdir -p /usr/lib/systemd/system/local-fs.target.wants
     ln -s ../bootc-generic-growpart.service /usr/lib/systemd/system/local-fs.target.wants/bootc-generic-growpart.service
diff --git a/standard/initramfs-full.yaml b/standard/initramfs-full.yaml
index b84a498..643a28c 100644
--- a/standard/initramfs-full.yaml
+++ b/standard/initramfs-full.yaml
@@ -2,6 +2,7 @@
 postprocess:
   - |
     #!/usr/bin/env bash
+    set -xeuo pipefail
     mkdir -p /usr/lib/dracut/dracut.conf.d
     cat > /usr/lib/dracut/dracut.conf.d/30-bootc-standard.conf << 'EOF'
     add_dracutmodules+=" lvm crypt fips "
diff --git a/standard/persistent-journal.yaml b/standard/persistent-journal.yaml
index ccc6c5f..bb2d0c9 100644
--- a/standard/persistent-journal.yaml
+++ b/standard/persistent-journal.yaml
@@ -5,7 +5,9 @@
 # rid of this once we move to sysusers and create the dir in the initrd.
 
 postprocess:
-  - | #!/bin/bash
+  - |
+    #!/bin/bash
+    set -xeuo pipefail
     mkdir -p /usr/lib/systemd/journald.conf.d/
     cat >/usr/lib/systemd/journald.conf.d/10-centos-bootc-persistent.conf << EOF
     [Journal]