set -u
Now is an opportune time to do this, as the infixSalt conversion in `add-flags.sh` ensures that all the relevant `NIX_*` vars will be defined even if empty.