diff --git a/ci-tools/vulnerability-scan b/ci-tools/vulnerability-scan
index 355fd31cbca1643d82fe71260ecc11632e9a7a11..884a6b571e470eb783b62c573644481d4103c535 100755
--- a/ci-tools/vulnerability-scan
+++ b/ci-tools/vulnerability-scan
@@ -1,5 +1,7 @@
 #!/usr/bin/env sh
 
+set -eo pipefail
+
 #
 # `morph build ...` output is like
 #