diff --git a/deployment/proxmox/provision.sh b/deployment/proxmox/provision.sh
index 61156c6..dba60b3 100755
--- a/deployment/proxmox/provision.sh
+++ b/deployment/proxmox/provision.sh
@@ -1,17 +1,17 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 set -euC
 
 ################################################################################
 ## Constants
 
-readonly apiurl=https://192.168.51.81:8006/api2/json
+readonly api_url=https://192.168.51.81:8006/api2/json
 
 ## FIXME: There seems to be a problem with file upload where the task is
 ## registered to `node051` no matter what node we are actually uploading to? For
 ## now, let us just use `node051` everywhere.
 readonly node=node051
 
-readonly tmpdir=/tmp/proxmox-provision-$RANDOM$RANDOM
+readonly tmpdir=/tmp/proxmox-provision-$RANDOM
 mkdir $tmpdir
 
 ################################################################################
@@ -22,7 +22,9 @@ password=
 sockets=1
 cores=1
 memory=2048
-vmids=
+vm_ids=
+
+debug=false
 
 help () {
   cat <<EOF
@@ -40,39 +42,47 @@ Other options:
   --sockets INT     Number of sockets (default: $sockets)
   --cores INT       Number of cores (default: $cores)
   --memory INT      Memory (default: $memory)
+  --debug           Run this script in debug mode
 
 Others:
   -h|-?|--help      Show this help and exit
 EOF
 }
 
+# shellcheck disable=SC2059
 die () { printf '\033[31m'; printf "$@"; printf '\033[0m\n'; exit 2; }
+# shellcheck disable=SC2059
 die_with_help () { printf '\033[31m'; printf "$@"; printf '\033[0m\n'; help; exit 2; }
 
+# shellcheck disable=SC2059
+debug () { if $debug; then printf >&2 '\033[37m'; printf >&2 "$@"; printf >&2 '\033[0m\n'; fi }
+
 while [ $# -gt 0 ]; do
   argument=$1
   shift
   case $argument in
-    --username) readonly username=$1; shift ;;
-    --password) readonly password=$1; shift ;;
+    --username) readonly username="$1"; shift ;;
+    --password) readonly password="$1"; shift ;;
 
     --sockets) sockets=$1; shift ;;
     --cores) cores=$1; shift ;;
     --memory) memory=$1; shift ;;
 
+    --debug) debug=true ;;
+
     -h|-\?|--help) help; exit 0 ;;
 
-    -*) die_with_help 'Unknown argument: `%s`.' "$argument" ;;
+    -*) die_with_help "Unknown argument: '%s'." "$argument" ;;
 
-    *) vmids="$vmids $argument" ;;
+    *) vm_ids="$vm_ids $argument" ;;
   esac
 done
 
 if [ -z "$username" ] || [ -z "$password" ]; then
   if [ -f .proxmox ]; then
-    { read username; read password; } < .proxmox
+    { read -r username; read -r password; } < .proxmox
   else
-    die_with_help 'Required: `--username` and `--password`.\n'
+    die_with_help "Required: '--username' and '--password'.\n"
   fi
 fi
 
@@ -83,12 +93,14 @@ readonly memory
 ## FIXME: When we figure out how to use other nodes than node051.
 # if [ -z "$node" ]; then
 #   printf 'Picking random node...'
-#   proxmox GET $apiurl/nodes
+#   proxmox GET "$api_url/nodes"
 #   node=$(from_response .data[].node | sort -R | head -n 1)
-#   printf ' done. Picked `%s`.\n' "$node"
+#   printf " done. Picked '%s'.\n" "$node"
 # fi
 # readonly node
 
+readonly debug
+
 ################################################################################
 ## Getting started
 
@@ -96,31 +108,38 @@ printf 'Authenticating...'
 response=$(
     http \
         --verify no \
-        POST $apiurl/access/ticket \
+        POST "$api_url/access/ticket" \
         "username=$username" \
         "password=$password"
     )
-readonly ticket=$(echo "$response" | jq -r .data.ticket)
-readonly csrfToken=$(echo "$response" | jq -r .data.CSRFPreventionToken)
+ticket=$(echo "$response" | jq -r .data.ticket)
+readonly ticket
+csrf_token=$(echo "$response" | jq -r .data.CSRFPreventionToken)
+readonly csrf_token
 printf ' done.\n'
 
 acquire_lock () {
-  until mkdir $tmpdir/lock-$1 2>/dev/null; do sleep 1; done
+  until mkdir "$tmpdir/lock-$1" 2>/dev/null; do sleep 1; done
 }
 release_lock () {
-  rmdir $tmpdir/lock-$1
+  rmdir "$tmpdir/lock-$1"
 }
 
 proxmox () {
   acquire_lock proxmox
-  http \
-    --form \
-    --verify no \
-    --ignore-stdin \
-    "$@" \
-    "Cookie:PVEAuthCookie=$ticket" \
-    "CSRFPreventionToken:$csrfToken"
+  debug 'request %s' "$*"
+  response=$(
+    http \
+      --form \
+      --verify no \
+      --ignore-stdin \
+      "$@" \
+      "Cookie:PVEAuthCookie=$ticket" \
+      "CSRFPreventionToken:$csrf_token"
+  )
+  debug 'response to request %s:\n  %s' "$*" "$response"
   release_lock proxmox
+  echo "$response"
 }
 
 ## Synchronous variant for when the `proxmox` function would just respond an
@@ -130,13 +149,13 @@ proxmox_sync () (
   upid=$(echo "$response" | jq -r .data)
 
   while :; do
-    response=$(proxmox GET $apiurl/nodes/$node/tasks/$upid/status)
+    response=$(proxmox GET "$api_url/nodes/$node/tasks/$upid/status")
     status=$(echo "$response" | jq -r .data.status)
 
     case $status in
       running) sleep 1 ;;
       stopped) break ;;
-      *) die 'unexpected status: `%s`' "$status" ;;
+      *) die "unexpected status: '%s'" "$status" ;;
     esac
   done
 )
@@ -146,16 +165,16 @@ proxmox_sync () (
 
 build_iso () {
   acquire_lock build
-  printf 'Building ISO for VM %d...\n' $1
+  printf 'Building ISO for VM %d...\n' "$1"
 
   nix build \
-    .#isoInstallers.provisioning.fedi$1 \
+    ".#isoInstallers.provisioning.fedi$1" \
     --log-format raw --quiet \
-    --out-link $tmpdir/installer-fedi$1
+    --out-link "$tmpdir/installer-fedi$1"
 
-  ln -sf $tmpdir/installer-fedi$1/iso/installer.iso $tmpdir/installer-fedi$1.iso
+  ln -sf "$tmpdir/installer-fedi$1/iso/installer.iso" "$tmpdir/installer-fedi$1.iso"
 
-  printf 'done building ISO for VM %d.\n' $1
+  printf 'done building ISO for VM %d.\n' "$1"
   release_lock build
 }
 
@@ -164,13 +183,13 @@ build_iso () {
 
 upload_iso () {
   acquire_lock upload
-  printf 'Uploading ISO for VM %d...\n' $1
+  printf 'Uploading ISO for VM %d...\n' "$1"
 
-  proxmox_sync POST $apiurl/nodes/$node/storage/local/upload \
-    filename@$tmpdir/installer-fedi$1.iso \
+  proxmox_sync POST "$api_url/nodes/$node/storage/local/upload" \
+    "filename@$tmpdir/installer-fedi$1.iso" \
     content==iso
 
-  printf 'done uploading ISO for VM %d.\n' $1
+  printf 'done uploading ISO for VM %d.\n' "$1"
   release_lock upload
 }
 
@@ -178,22 +197,22 @@ upload_iso () {
 ## Remove ISO
 
 remove_iso () {
-  printf 'Removing ISO for VM %d...\n' $1
+  printf 'Removing ISO for VM %d...\n' "$1"
 
-  proxmox_sync DELETE $apiurl/nodes/$node/storage/local/content/local:iso/installer-fedi$1.iso
+  proxmox_sync DELETE "$api_url/nodes/$node/storage/local/content/local:iso/installer-fedi$1.iso"
 
-  printf 'done removing ISO for VM %d.\n' $1
+  printf 'done removing ISO for VM %d.\n' "$1"
 }
 
 ################################################################################
 ## Create VM
 
 create_vm () {
-  printf 'Creating VM %d...\n' $1
+  printf 'Creating VM %d...\n' "$1"
 
-  proxmox_sync POST $apiurl/nodes/$node/qemu \
+  proxmox_sync POST "$api_url/nodes/$node/qemu" \
     \
-    vmid==$1 \
+    vmid=="$1" \
     name=="fedi$1" \
     pool==Fediversity \
     \
@@ -207,77 +226,77 @@ create_vm () {
     scsihw==virtio-scsi-single \
     scsi0=='linstor_storage:32,discard=on,ssd=on,iothread=on' \
     \
-    sockets==$sockets \
-    cores==$cores \
+    sockets=="$sockets" \
+    cores=="$cores" \
     cpu==x86-64-v2-AES \
     numa==1 \
     \
-    memory==$memory \
+    memory=="$memory" \
     \
     net0=='virtio,bridge=vnet1306'
 
-  printf 'done creating VM %d.\n' $1
+  printf 'done creating VM %d.\n' "$1"
 }
 
 ################################################################################
 ## Install VM
 
 install_vm () (
-  printf 'Installing VM %d...\n' $1
+  printf 'Installing VM %d...\n' "$1"
 
-  proxmox_sync POST $apiurl/nodes/$node/qemu/$1/status/start
+  proxmox_sync POST "$api_url/nodes/$node/qemu/$1/status/start"
 
   while :; do
-    response=$(proxmox GET $apiurl/nodes/$node/qemu/$1/status/current)
+    response=$(proxmox GET "$api_url/nodes/$node/qemu/$1/status/current")
     status=$(echo "$response" | jq -r .data.status)
     case $status in
       running) sleep 1 ;;
       stopped) break ;;
-      *) printf ' unexpected status: `%s`\n' "$status"; exit 2 ;;
+      *) die " unexpected status: '%s'\n" "$status" ;;
     esac
   done
 
-  printf 'done installing VM %d.\n' $1
+  printf 'done installing VM %d.\n' "$1"
 )
 
 ################################################################################
 ## Start VM
 
 start_vm () {
-  printf 'Starting VM %d...\n' $1
+  printf 'Starting VM %d...\n' "$1"
 
-  proxmox_sync POST $apiurl/nodes/$node/qemu/$1/config \
+  proxmox_sync POST "$api_url/nodes/$node/qemu/$1/config" \
     ide2=='none,media=cdrom' \
     net0=='virtio,bridge=vnet1305'
 
-  proxmox_sync POST $apiurl/nodes/$node/qemu/$1/status/start
+  proxmox_sync POST "$api_url/nodes/$node/qemu/$1/status/start"
 
-  printf 'done starting VM %d.\n' $1
+  printf 'done starting VM %d.\n' "$1"
 }
 
 ################################################################################
 ## Main loop
 
-printf 'Provisioning VMs%s with:\n' "$vmids"
-printf '  sockets: %d\n' $sockets
-printf '  cores: %d\n' $cores
-printf '  memory: %d\n' $memory
+printf 'Provisioning VMs%s with:\n' "$vm_ids"
+printf '  sockets: %d\n' "$sockets"
+printf '  cores: %d\n' "$cores"
+printf '  memory: %d\n' "$memory"
 
 provision_vm () {
-  build_iso $1
-  upload_iso $1
-  create_vm $1
-  install_vm $1
-  start_vm $1
-  remove_iso $1
+  build_iso "$1"
+  upload_iso "$1"
+  create_vm "$1"
+  install_vm "$1"
+  start_vm "$1"
+  remove_iso "$1"
 }
 
-for vmid in $vmids; do
-  provision_vm $vmid &
+for vm_id in $vm_ids; do
+  provision_vm "$vm_id" &
 done
 wait
 
-printf 'done provisioning VMs%s.\n' "$vmids"
+printf 'done provisioning VMs%s.\n' "$vm_ids"
 
 ################################################################################
 ## Cleanup
diff --git a/deployment/proxmox/remove.sh b/deployment/proxmox/remove.sh
index 9564fae..b84323c 100755
--- a/deployment/proxmox/remove.sh
+++ b/deployment/proxmox/remove.sh
@@ -1,17 +1,17 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 set -euC
 
 ################################################################################
 ## Constants
 
-readonly apiurl=https://192.168.51.81:8006/api2/json
+readonly api_url=https://192.168.51.81:8006/api2/json
 
 ## FIXME: There seems to be a problem with file upload where the task is
 ## registered to `node051` no matter what node we are actually uploading to? For
 ## now, let us just use `node051` everywhere.
 readonly node=node051
 
-readonly tmpdir=/tmp/proxmox-provision-$RANDOM$RANDOM
+readonly tmpdir=/tmp/proxmox-provision-$RANDOM
 mkdir $tmpdir
 
 ################################################################################
@@ -19,7 +19,7 @@ mkdir $tmpdir
 
 username=
 password=
-vmids=
+vm_ids=
 
 help () {
   cat <<EOF
@@ -38,7 +38,9 @@ Others:
 EOF
 }
 
+# shellcheck disable=SC2059
 die () { printf '\033[31m'; printf "$@"; printf '\033[0m\n'; exit 2; }
+# shellcheck disable=SC2059
 die_with_help () { printf '\033[31m'; printf "$@"; printf '\033[0m\n'; help; exit 2; }
 
 while [ $# -gt 0 ]; do
@@ -50,17 +52,17 @@ while [ $# -gt 0 ]; do
 
     -h|-\?|--help) help; exit 0 ;;
 
-    -*) die_with_help 'Unknown argument: `%s`.' "$argument" ;;
+    -*) die_with_help "Unknown argument: '%s'." "$argument" ;;
 
-    *) vmids="$vmids $argument" ;;
+    *) vm_ids="$vm_ids $argument" ;;
   esac
 done
 
 if [ -z "$username" ] || [ -z "$password" ]; then
   if [ -f .proxmox ]; then
-    { read username; read password; } < .proxmox
+    { read -r username; read -r password; } < .proxmox
   else
-    die_with_help 'Required: `--username` and `--password`.\n'
+    die_with_help "Required: '--username' and '--password'.\n"
   fi
 fi
 
@@ -71,19 +73,21 @@ printf 'Authenticating...'
 response=$(
     http \
         --verify no \
-        POST $apiurl/access/ticket \
+        POST $api_url/access/ticket \
         "username=$username" \
         "password=$password"
     )
-readonly ticket=$(echo "$response" | jq -r .data.ticket)
-readonly csrfToken=$(echo "$response" | jq -r .data.CSRFPreventionToken)
+ticket=$(echo "$response" | jq -r .data.ticket)
+readonly ticket
+csrf_token=$(echo "$response" | jq -r .data.CSRFPreventionToken)
+readonly csrf_token
 printf ' done.\n'
 
 acquire_lock () {
-  until mkdir $tmpdir/lock-$1 2>/dev/null; do sleep 1; done
+  until mkdir "$tmpdir/lock-$1" 2>/dev/null; do sleep 1; done
 }
 release_lock () {
-  rmdir $tmpdir/lock-$1
+  rmdir "$tmpdir/lock-$1"
 }
 
 proxmox () {
@@ -93,7 +97,7 @@ proxmox () {
     --form \
     "$@" \
     "Cookie:PVEAuthCookie=$ticket" \
-    "CSRFPreventionToken:$csrfToken"
+    "CSRFPreventionToken:$csrf_token"
   release_lock proxmox
 }
 
@@ -104,13 +108,13 @@ proxmox_sync () (
   upid=$(echo "$response" | jq -r .data)
 
   while :; do
-    response=$(proxmox GET $apiurl/nodes/$node/tasks/$upid/status)
+    response=$(proxmox GET "$api_url/nodes/$node/tasks/$upid/status")
     status=$(echo "$response" | jq -r .data.status)
 
     case $status in
       running) sleep 1 ;;
       stopped) break ;;
-      *) die 'unexpected status: `%s`' "$status" ;;
+      *) die "unexpected status: '%s'" "$status" ;;
     esac
   done
 )
@@ -119,43 +123,43 @@ proxmox_sync () (
 ## Stop VM
 
 stop_vm () {
-  printf 'Stopping VM %d...\n' $1
+  printf 'Stopping VM %d...\n' "$1"
 
-  proxmox_sync POST $apiurl/nodes/$node/qemu/$1/status/stop \
+  proxmox_sync POST "$api_url/nodes/$node/qemu/$1/status/stop" \
     'overrule-shutdown'==1
 
-  printf 'done stopping VM %d.\n' $1
+  printf 'done stopping VM %d.\n' "$1"
 }
 
 ################################################################################
 ## Delete VM
 
 delete_vm () {
-  printf 'Deleting VM %d...\n' $1
+  printf 'Deleting VM %d...\n' "$1"
 
-  proxmox_sync DELETE $apiurl/nodes/$node/qemu/$1 \
+  proxmox_sync DELETE "$api_url/nodes/$node/qemu/$1" \
     'destroy-unreferenced-disks'==1 \
     'purge'==1
 
-  printf 'done deleting VM %d.\n' $1
+  printf 'done deleting VM %d.\n' "$1"
 }
 
 ################################################################################
 ## Main loop
 
-printf 'Removing VMs%s...\n' "$vmids"
+printf 'Removing VMs%s...\n' "$vm_ids"
 
 remove_vm () {
-  stop_vm $1
-  delete_vm $1
+  stop_vm "$1"
+  delete_vm "$1"
 }
 
-for vmid in $vmids; do
-  remove_vm $vmid &
+for vm_id in $vm_ids; do
+  remove_vm "$vm_id" &
 done
 wait
 
-printf 'done removing VMs%s.\n' "$vmids"
+printf 'done removing VMs%s.\n' "$vm_ids"
 
 ################################################################################
 ## Cleanup