diff --git a/scripts/activate_python.sh b/scripts/activate_python.sh
new file mode 100644
index 0000000..33883a4
--- /dev/null
+++ b/scripts/activate_python.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+# This is meant to be sourced.
+# Helper script for activating the correct python environment.
+# Sets a default env or you can provide your own activate path for testing
+
+DEFAULT_ENV=/cds/group/pcds/pyps/conda/venvs/ansible/bin/activate
+
+if [ -f "${ANSIBLE_PYTHON_ACTIVATE:=${DEFAULT_ENV}}" ]; then
+  source "${ANSIBLE_PYTHON_ACTIVATE}"
+else
+  echo "No Python activation script found at ${ANSIBLE_PYTHON_ACTIVATE}"
+  return 1
+fi
diff --git a/scripts/bootstrap_plc.sh b/scripts/bootstrap_plc.sh
index 0d5bd7b..9231b91 100755
--- a/scripts/bootstrap_plc.sh
+++ b/scripts/bootstrap_plc.sh
@@ -22,17 +22,14 @@ fi
 HOSTNAME="${1}"
 shift
 
-# Activate python env if we don't have ansible on the path
-if [ ! -x ansible-playbook ]; then
-  source /cds/group/pcds/pyps/conda/venvs/ansible/bin/activate
-fi
-
 USERNAME="${PLC_USERNAME:=Administrator}"
+
 THIS_SCRIPT="$(realpath "${0}")"
 THIS_DIR="$(dirname "${THIS_SCRIPT}")"
-ANSIBLE_ROOT="$(realpath "${THIS_DIR}/..")"
-INVENTORY_PATH="${ANSIBLE_ROOT}/inventory/plcs.yaml"
-SSH_CONFIG="${ANSIBLE_ROOT}/ssh_config"
+source "${THIS_DIR}"/paths.sh
+
+# Use the correct python env
+source "${THIS_DIR}"/activate_python.sh
 
 # Check the inventory for your plc
 if grep -q "${HOSTNAME}:" "${INVENTORY_PATH}"; then
@@ -52,6 +49,8 @@ fi
 
 # Register the ssh key with the ssh agent if needed
 source "${THIS_DIR}/ssh_agent_helper.sh"
+# Stop the ssh agent at exit if we started it here
+trap ssh_agent_helper_cleanup EXIT
 
 # Send the public key to the plc, if it has not already been done
 ssh-copy-id -i "${SSH_KEY_FILENAME}" -o PreferredAuthentications=keyboard-interactive "${USERNAME}@${HOSTNAME}"
@@ -93,6 +92,3 @@ scp -F "${SSH_CONFIG}" -i "${SSH_KEY_FILENAME}" -r "${SOURCE_DIR}" "${USERNAME}@
 
 # Run the local install version of the bootstrap playbook
 ansible-playbook "${ANSIBLE_ROOT}/tcbsd-bootstrap-from-local-playbook.yaml" --extra-vars "target=${HOSTNAME} ansible_ssh_private_key_file=${SSH_KEY_FILENAME}" --ask-become-pass "$@"
-
-# Stop the ssh agent if we started it here
-ssh_agent_helper_cleanup
diff --git a/scripts/dry_run.sh b/scripts/dry_run.sh
index 56dab27..d5257ed 100755
--- a/scripts/dry_run.sh
+++ b/scripts/dry_run.sh
@@ -10,6 +10,8 @@
 #   $ ./dry_run.sh tst_all
 #
 # Groups are defined in the inventory file.
+set -e
+
 if [ -z "${1}" ]; then
   echo "Ansible target required"
   exit 1
diff --git a/scripts/paths.sh b/scripts/paths.sh
new file mode 100644
index 0000000..46fd047
--- /dev/null
+++ b/scripts/paths.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+# Sourceable script to set common vars for the various scripts.
+# This sets a bunch of environment variables related to known paths
+# and puts us into the ansible directory for the duration of the
+# encapsulating script.
+set -e
+
+THIS_SCRIPT="$(realpath "${BASH_SOURCE[0]}")"
+THIS_DIR="$(dirname "${THIS_SCRIPT}")"
+
+ANSIBLE_ROOT="$(realpath "${THIS_DIR}/..")"
+export ANSIBLE_ROOT
+INVENTORY_PATH="${ANSIBLE_ROOT}/inventory/plcs.yaml"
+export INVENTORY_PATH
+SSH_CONFIG="${ANSIBLE_ROOT}/ssh_config"
+export SSH_CONFIG
+
+cd "${ANSIBLE_ROOT}"
diff --git a/scripts/provision_plc.sh b/scripts/provision_plc.sh
index bce4699..2cf1669 100755
--- a/scripts/provision_plc.sh
+++ b/scripts/provision_plc.sh
@@ -10,6 +10,8 @@
 #   $ ./provision_plc.sh tst_all
 #
 # Groups are defined in the inventory file.
+set -e
+
 if [ -z "${1}" ]; then
   echo "Ansible target required"
   exit 1
@@ -20,21 +22,18 @@ shift
 
 THIS_SCRIPT="$(realpath "${0}")"
 THIS_DIR="$(dirname "${THIS_SCRIPT}")"
-ANSIBLE_ROOT="$(realpath "${THIS_DIR}/..")"
+source "${THIS_DIR}"/paths.sh
 
-# Activate python env if we don't have ansible on the path
-if [ ! -x ansible-playbook ]; then
-  source /cds/group/pcds/pyps/conda/venvs/ansible/bin/activate
-fi
+# Use the correct python env
+source "${THIS_DIR}"/activate_python.sh
 
 # Register the ssh key with the ssh agent if needed
 source "${THIS_DIR}/ssh_agent_helper.sh"
+# Stop the ssh agent at exit if we started it here
+trap ssh_agent_helper_cleanup EXIT
 
 # Run the provision playbook
 ansible-playbook "${ANSIBLE_ROOT}/tcbsd-provision-playbook.yaml" --extra-vars "target=${TARGET} ansible_ssh_private_key_file=${SSH_KEY_FILENAME}" --ask-become-pass "$@"
 
-# Stop the ssh agent if we started it here
-ssh_agent_helper_cleanup
-
 # Prompt to update deployment docs
 "${THIS_DIR}"/docs_prompt.sh
diff --git a/scripts/setup_new_plc.sh b/scripts/setup_new_plc.sh
index d8774f1..74e007f 100755
--- a/scripts/setup_new_plc.sh
+++ b/scripts/setup_new_plc.sh
@@ -18,10 +18,9 @@ THIS_DIR="$(dirname "${THIS_SCRIPT}")"
 
 # Register the ssh key with the ssh agent if needed
 source "${THIS_DIR}/ssh_agent_helper.sh"
+# Stop the ssh agent at exit if we started it here
+trap ssh_agent_helper_cleanup EXIT
 
 # Run both playbooks and one-time pre-playbook setup
 "${THIS_DIR}"/bootstrap_plc.sh "${1}"
 "${THIS_DIR}"/provision_plc.sh "${1}"
-
-# Stop the ssh agent if we started it here
-ssh_agent_helper_cleanup
diff --git a/scripts/ssh_agent_helper.sh b/scripts/ssh_agent_helper.sh
old mode 100755
new mode 100644
index 8c4ff29..f904fa9
--- a/scripts/ssh_agent_helper.sh
+++ b/scripts/ssh_agent_helper.sh
@@ -7,6 +7,7 @@
 # Expected usage:
 #
 # source ssh_agent_helper.sh
+set -e
 
 SSH_KEY_FILENAME="${HOME}/.ssh/tcbsd_key_rsa"
 export SSH_KEY_FILENAME
@@ -28,6 +29,8 @@ ssh_agent_helper_cleanup() {
     fi
 }
 export ssh_agent_helper_cleanup
+# Clean up immediately if something in this script fails
+trap ssh_agent_helper_cleanup ERR
 
 # Create an ssh key, if it does not already exist
 if [ ! -f "${SSH_KEY_FILENAME}" ]; then
diff --git a/scripts/update_admin_pass.sh b/scripts/update_admin_pass.sh
index 1b2eb63..09203ff 100755
--- a/scripts/update_admin_pass.sh
+++ b/scripts/update_admin_pass.sh
@@ -21,16 +21,14 @@ fi
 USERNAME="${PLC_USERNAME:=Administrator}"
 THIS_SCRIPT="$(realpath "${0}")"
 THIS_DIR="$(dirname "${THIS_SCRIPT}")"
-ANSIBLE_ROOT="$(realpath "${THIS_DIR}/..")"
-SSH_CONFIG="${ANSIBLE_ROOT}/ssh_config"
+source "${THIS_DIR}"/paths.sh
 
 # Register the ssh key with the ssh agent if needed
 source "${THIS_DIR}/ssh_agent_helper.sh"
+# Stop the ssh agent at exit if we started it here
+trap ssh_agent_helper_cleanup EXIT
 
 for HOSTNAME in "$@"; do
     echo "Logging into ${HOSTNAME}"
     ssh -F "${SSH_CONFIG}" -i "${SSH_KEY_FILENAME}" -t "${USERNAME}@${HOSTNAME}" passwd
 done
-
-# Stop the ssh agent if we started it here
-ssh_agent_helper_cleanup