diff --git a/tools/ecosystem-generate.sh b/tools/ecosystem-generate.sh
index 8c556fd..fc76b8c 100755
--- a/tools/ecosystem-generate.sh
+++ b/tools/ecosystem-generate.sh
@@ -12,6 +12,8 @@
 # branch (recorded below + in each binding's compose-order.txt). WORKDIR defaults to a $HOME
 # path (NEVER /tmp — it is reaped).
 set -euo pipefail
+# A command substitution runs with errexit too, as in refresh-binding.sh.
+shopt -s inherit_errexit
 
 PIN_REF="${1:?usage: ecosystem-generate.sh <pin-tag|sha> [workdir]}"
 WORK="${2:-$HOME/ecosystem-gen}"
diff --git a/tools/provision-meos.sh b/tools/provision-meos.sh
index cb82b02..25e2626 100755
--- a/tools/provision-meos.sh
+++ b/tools/provision-meos.sh
@@ -39,6 +39,8 @@
 #   catalog-path=<abs path to meos-idl.json>
 #   libmeos-prefix=<abs runtime prefix, or empty when --build-libmeos is not given>
 set -euo pipefail
+# A command substitution runs with errexit too, as in refresh-binding.sh.
+shopt -s inherit_errexit
 
 usage() { sed -n '2,/^set -euo/{/^set -euo/d;s/^# \{0,1\}//;p;}' "$0"; }
 
diff --git a/tools/refresh-binding.sh b/tools/refresh-binding.sh
index b20f149..4871eb0 100755
--- a/tools/refresh-binding.sh
+++ b/tools/refresh-binding.sh
@@ -45,6 +45,10 @@
 #   --force             Rebuild libmeos even when the MobilityDB commit is unchanged.
 #   -h, --help
 set -euo pipefail
+# A command substitution runs with errexit too, so a step that fails inside one stops the
+# refresh: resolve_repo's fetch of a ref the remote does not have would otherwise leave the
+# earlier checkout in place and the refresh would derive from it.
+shopt -s inherit_errexit
 
 usage() { sed -n '2,/^set -euo/{/^set -euo/d;s/^# \{0,1\}//;p;}' "$0"; }