diff --git a/scripts/apply-patches.sh b/scripts/apply-patches.sh
index b7362cf..40f879d 100755
--- a/scripts/apply-patches.sh
+++ b/scripts/apply-patches.sh
@@ -49,14 +49,16 @@ else
   git -C "$WORK_DIR" fetch --tags --prune upstream
 fi
 
-cd "$WORK_DIR"
+cd "$WORK_DIR" || die "cannot enter $WORK_DIR"
 
 git cat-file -e "${REV}^{commit}" 2>/dev/null \
   || die "pinned revision $REV not found in upstream. Run 'make update' to re-pin."
 
 # Abandon any half-finished am from a previous run before resetting.
 gitdir="$(git rev-parse --git-dir)"
-[[ -d "$gitdir/rebase-apply" ]] && git am --abort >/dev/null 2>&1 || true
+if [[ -d "$gitdir/rebase-apply" ]]; then
+  git am --abort >/dev/null 2>&1 || true
+fi
 
 info "Resetting work/ to upstream $(git rev-parse --short "$REV")"
 # -f is required: without it checkout refuses to run against a dirty tree, which
@@ -82,7 +84,6 @@ fi
 
 info "Applying $n patch(es)"
 if ! git am --3way --keep-cr --whitespace=nowarn "$PATCHES_DIR"/*.patch; then
-  failed="$(basename "$(cat "$(git rev-parse --git-dir)/rebase-apply/original-commit" 2>/dev/null || true)" 2>/dev/null || true)"
   cat >&2 <<EOF
 
 ${C_RED}${C_BOLD}==> patch application failed${C_RESET}
diff --git a/scripts/build.sh b/scripts/build.sh
index 039d7d3..52bb44a 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -13,14 +13,15 @@ require_cmd cargo "Run 'make setup' first."
 CARGO_CMD="${CARGO_CMD:-build}"
 PKG="${PKG:-$BIN_PKG}"
 
-cd "$WORK_DIR"
+cd "$WORK_DIR" || die "cannot enter $WORK_DIR"
 
 # bin/protoc is a DotSlash wrapper; it needs dotslash on PATH to self-resolve.
 # If that is unavailable, hand the build script a system protoc instead so it
 # does not silently skip codegen.
 if ! ./bin/protoc --version >/dev/null 2>&1; then
   if command -v protoc >/dev/null 2>&1 && [[ -z "${PROTOC:-}" ]]; then
-    export PROTOC="$(command -v protoc)"
+    PROTOC="$(command -v protoc)"
+    export PROTOC
     warn "bin/protoc unusable (dotslash missing?) -- using PROTOC=$PROTOC"
   else
     die "no working protoc. Run 'make setup'."
diff --git a/scripts/lib.sh b/scripts/lib.sh
index d6494e0..47373b0 100755
--- a/scripts/lib.sh
+++ b/scripts/lib.sh
@@ -19,11 +19,15 @@ REV_FILE="$ROOT/upstream.rev"
 # Branch created inside work/, and the tag marking the pristine upstream commit
 # that patches are generated against. `base` is the boundary: everything after
 # it is ours.
+#
+# shellcheck disable=SC2034  # consumed by the scripts that source this file
 WORK_BRANCH="fork"
 BASE_TAG="base"
 
 # The package that produces the shipping binary.
+# shellcheck disable=SC2034  # consumed by the scripts that source this file
 BIN_PKG="xai-grok-pager-bin"
+# shellcheck disable=SC2034  # consumed by the scripts that source this file
 BIN_NAME="xai-grok-pager"
 
 if [[ -t 1 ]]; then
@@ -88,12 +92,10 @@ ensure_upstream() {
 
 # Number of .patch files currently in patches/ (0 when the dir is empty).
 count_patches() {
-  local n=0
   shopt -s nullglob
-  local f
-  for f in "$PATCHES_DIR"/*.patch; do n=$((n + 1)); done
+  local files=("$PATCHES_DIR"/*.patch)
   shopt -u nullglob
-  printf '%s' "$n"
+  printf '%s' "${#files[@]}"
 }
 
 # Guard against running rebuild/build while a patch application is half-done.
diff --git a/scripts/rebuild-patches.sh b/scripts/rebuild-patches.sh
index 852822b..63d27fa 100755
--- a/scripts/rebuild-patches.sh
+++ b/scripts/rebuild-patches.sh
@@ -7,7 +7,7 @@
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 assert_work_ready
-cd "$WORK_DIR"
+cd "$WORK_DIR" || die "cannot enter $WORK_DIR"
 
 if [[ -n "$(git status --porcelain)" ]]; then
   warn "work/ has uncommitted changes -- they will NOT be exported."
diff --git a/scripts/setup.sh b/scripts/setup.sh
index 2c69e4e..efac8a7 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -62,8 +62,9 @@ if [[ -z "$resolved" ]]; then
     step "falling back to system protoc: $(protoc --version)"
   elif [[ -d "$WORK_DIR" || -d "$UPSTREAM_DIR" ]]; then
     step "no working protoc -- installing protobuf-compiler"
-    sudo apt-get update -qq && sudo apt-get install -y -qq protobuf-compiler \
-      || die "could not provide a protoc. Install DotSlash (https://dotslash-cli.com) or protobuf-compiler manually."
+    if ! { sudo apt-get update -qq && sudo apt-get install -y -qq protobuf-compiler; }; then
+      die "could not provide a protoc. Install DotSlash (https://dotslash-cli.com) or protobuf-compiler manually."
+    fi
     step "system protoc: $(protoc --version)"
   else
     warn "no checkout yet -- protoc will be verified on first 'make apply'"