diff --git a/task/prefetch-dependencies-oci-ta/0.1/prefetch-dependencies-oci-ta.yaml b/task/prefetch-dependencies-oci-ta/0.1/prefetch-dependencies-oci-ta.yaml
index 87deeb25b5..3d833e92c1 100644
--- a/task/prefetch-dependencies-oci-ta/0.1/prefetch-dependencies-oci-ta.yaml
+++ b/task/prefetch-dependencies-oci-ta/0.1/prefetch-dependencies-oci-ta.yaml
@@ -151,6 +151,10 @@ spec:
     - name: sanitize-cachi2-config-file-with-yq
       image: quay.io/konflux-ci/yq:latest@sha256:343c2ca0a347ae87fe43750ee0873e1fe813f77eff56e9722c840bb75d97fef2
       script: |
+        #!/bin/bash
+
+        set -euo pipefail
+
         if [ -n "${CONFIG_FILE_CONTENT}" ]; then
           # we need to drop 'goproxy_url' for safety reasons until cachi2 decides what the SBOM
           # impact of this configuration option will be:
@@ -163,6 +167,10 @@ spec:
         - name: INPUT
           value: $(params.input)
       script: |
+        #!/bin/bash
+
+        set -euo pipefail
+
         if [ -z "${INPUT}" ]; then
           # Confirm input was provided though it's likely the whole task would be skipped if it wasn't
           echo "No prefetch will be performed because no input was provided for cachi2 fetch-deps"
@@ -183,6 +191,9 @@ spec:
           value: $(params.ACTIVATION_KEY)
       script: |
         #!/bin/bash
+
+        set -euo pipefail
+
         if [ -f /shared/skip ]; then
           echo "Skipping."
           exit 0
@@ -325,6 +336,8 @@ spec:
       script: |
         #!/bin/bash
 
+        set -euo pipefail
+
         if [ -f /shared/skip ]; then
           echo "Skipping."
           exit 0
@@ -398,6 +411,9 @@ spec:
       image: quay.io/redhat-appstudio/cachi2:0.15.0@sha256:b141cb5cf4d98e6c5f668f1fe172e1d68f2a44ac1027403fbcff94ce1e68185d
       script: |
         #!/bin/bash
+
+        set -euo pipefail
+
         if [ -f /shared/skip ]; then
           echo "Skipping."
           exit 0
diff --git a/task/prefetch-dependencies/0.1/prefetch-dependencies.yaml b/task/prefetch-dependencies/0.1/prefetch-dependencies.yaml
index 9a859d42de..9de30b6c59 100644
--- a/task/prefetch-dependencies/0.1/prefetch-dependencies.yaml
+++ b/task/prefetch-dependencies/0.1/prefetch-dependencies.yaml
@@ -71,6 +71,10 @@ spec:
   - name: sanitize-cachi2-config-file-with-yq
     image: quay.io/konflux-ci/yq:latest@sha256:343c2ca0a347ae87fe43750ee0873e1fe813f77eff56e9722c840bb75d97fef2
     script: |
+      #!/bin/bash
+
+      set -euo pipefail
+
       if [ -n "${CONFIG_FILE_CONTENT}" ]
       then
         # we need to drop 'goproxy_url' for safety reasons until cachi2 decides what the SBOM
@@ -87,6 +91,10 @@ spec:
     - name: INPUT
       value: $(params.input)
     script: |
+      #!/bin/bash
+
+      set -euo pipefail
+
       if [ -z "${INPUT}" ]
       then
         # Confirm input was provided though it's likely the whole task would be skipped if it wasn't
@@ -109,6 +117,9 @@ spec:
       type: string
     script: |
       #!/bin/bash
+
+      set -euo pipefail
+
       if [ -f /shared/skip ]; then
         echo "Skipping."
         exit 0
@@ -258,6 +269,8 @@ spec:
     script: |
       #!/bin/bash
 
+      set -euo pipefail
+
       if [ -f /shared/skip ]; then
         echo "Skipping."
         exit 0
@@ -334,6 +347,9 @@ spec:
     # the cluster will set imagePullPolicy to IfNotPresent
     script: |
       #!/bin/bash
+
+      set -euo pipefail
+
       if [ -f /shared/skip ]; then
         echo "Skipping."
         exit 0