diff --git a/justfile b/justfile
index 5c77acf7..f3cfa00c 100644
--- a/justfile
+++ b/justfile
@@ -23,6 +23,8 @@ clean:
 # ensure valid virtualenv
 virtualenv:
     #!/usr/bin/env bash
+    set -euo pipefail
+
     # allow users to specify python version in .env
     PYTHON_VERSION=${PYTHON_VERSION:-$DEFAULT_PYTHON}
 
@@ -35,12 +37,17 @@ virtualenv:
 
 _compile src dst *args: virtualenv
     #!/usr/bin/env bash
+    set -euo pipefail
+
     # exit if src file is older than dst file (-nt = 'newer than', but we negate with || to avoid error exit code)
     test "${FORCE:-}" = "true" -o {{ src }} -nt {{ dst }} || exit 0
     $BIN/pip-compile --allow-unsafe --generate-hashes --output-file={{ dst }} {{ src }} {{ args }}
 
 
 _env:
+    #!/usr/bin/env bash
+    set -euo pipefail
+
     test -f .env || cp dotenv-sample .env
 
 
@@ -57,6 +64,8 @@ requirements-dev *args: requirements-prod
 # ensure prod requirements installed and up to date
 prodenv: requirements-prod
     #!/usr/bin/env bash
+    set -euo pipefail
+
     # exit if .txt file has not changed since we installed them (-nt == "newer than', but we negate with || to avoid error exit code)
     test requirements.prod.txt -nt $VIRTUAL_ENV/.prod || exit 0
 
@@ -70,6 +79,8 @@ prodenv: requirements-prod
 # ensure dev requirements installed and up to date
 devenv:  _env prodenv requirements-dev && install-precommit
     #!/usr/bin/env bash
+    set -euo pipefail
+
     # exit if .txt file has not changed since we installed them (-nt == "newer than', but we negate with || to avoid error exit code)
     test requirements.dev.txt -nt $VIRTUAL_ENV/.dev || exit 0
 
@@ -80,6 +91,8 @@ devenv:  _env prodenv requirements-dev && install-precommit
 # ensure precommit is installed
 install-precommit:
     #!/usr/bin/env bash
+    set -euo pipefail
+
     BASE_DIR=$(git rev-parse --show-toplevel)
     test -f $BASE_DIR/.git/hooks/pre-commit || $BIN/pre-commit install
 
@@ -87,6 +100,8 @@ install-precommit:
 # upgrade dev or prod dependencies (specify package to upgrade single package, all by default)
 upgrade env package="": virtualenv
     #!/usr/bin/env bash
+    set -euo pipefail
+
     opts="--upgrade"
     test -z "{{ package }}" || opts="--upgrade-package {{ package }}"
     FORCE=true "{{ just_executable() }}" requirements-{{ env }} $opts