diff --git a/pkgs/generate-secrets/default.nix b/pkgs/generate-secrets/default.nix
index e633876..5f88019 100644
--- a/pkgs/generate-secrets/default.nix
+++ b/pkgs/generate-secrets/default.nix
@@ -9,7 +9,7 @@ let
     exec ${pkgs.python3}/bin/python ${rpcauthSrc} "$@"
   '';
 in
-writeScript "generate-secrets" ''
+writers.writeBash "generate-secrets" ''
   export PATH=${lib.makeBinPath [ coreutils apg openssl gnugrep rpcauth ]}
   . ${./generate-secrets.sh} ${./openssl.cnf}
 ''
diff --git a/pkgs/generate-secrets/generate-secrets.sh b/pkgs/generate-secrets/generate-secrets.sh
index 4255289..229b774 100755
--- a/pkgs/generate-secrets/generate-secrets.sh
+++ b/pkgs/generate-secrets/generate-secrets.sh
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 opensslConf=${1:-openssl.cnf}
 
 makePasswordSecret() {