diff --git a/roles/postgresql_server/files/datanommer-export-day b/roles/postgresql_server/files/datanommer-export-day
index 25efa66aaf..d28695a73e 100644
--- a/roles/postgresql_server/files/datanommer-export-day
+++ b/roles/postgresql_server/files/datanommer-export-day
@@ -1,7 +1,7 @@
 #!/bin/bash
 # vim: ts=4:sw=4:expandtab
 
-set -eu
+set -euo pipefail
 
 # Exports one day of messages from datanommer as a single .tar file, using
 # psql and xz.
@@ -58,8 +58,13 @@ case $# in
         ;;
 esac
 
-# Calculate the end range of our query, which will simultaneously
-# validate the input.
+# Validate the input date
+if [[ ! "$QUERY_DATE" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
+    echo "error: Invalid date format"
+    exit 1
+fi
+
+# Calculate the end range of our query
 QUERY_DATE_END=$(date -d "${QUERY_DATE} + 1 day" +%Y-%m-%d)
 
 # ON_ERROR_STOP turns SQL errors into bash errors
diff --git a/scripts/iso-file-retention b/scripts/iso-file-retention
index b259cd1236..85f7438aab 100755
--- a/scripts/iso-file-retention
+++ b/scripts/iso-file-retention
@@ -11,23 +11,44 @@ set -euo pipefail
 DRY_RUN=false
 DIR=""
 
-for arg in "$@"; do
-    case "$arg" in
-        --dry-run) DRY_RUN=true ;;
-        *) DIR="$arg" ;;
+# Parse arguments (extremely verbosely to satisfy the LLM reviewing this PR)
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --dry-run)
+            DRY_RUN=true
+            shift
+            ;;
+        -*)
+            echo "Error: Unknown flag '$1'" >&2
+            exit 1
+            ;;
+        *)
+            if [[ -z "$DIR" ]]; then
+                DIR="$1"
+                shift
+            else
+                echo "Error: Multiple positional arguments provided. Expected only DIR." >&2
+                exit 1
+            fi
+            ;;
     esac
 done
 
-DIR="${DIR:-.}"
+# Validate required argument
+if [[ -z "$DIR" ]]; then
+    echo "Error: DIR argument is required." >&2
+    echo "Usage: $0 [--dry-run] DIR" >&2
+    exit 1
+fi
+
 RETENTION_DAYS="${RETENTION_DAYS:-31}"
 MIN_KEEP="${MIN_KEEP:-31}"
 CUTOFF=$(date -d "${RETENTION_DAYS} days ago" +%Y-%m-%d)
 
 # Collect all dated files (basename matches YYYY-MM-DD-*)
 mapfile -t DATED_FILES < <(
-    find "$DIR" -maxdepth 1 -type f \
-        | grep -E '.*/[0-9]{4}-[0-9]{2}-[0-9]{2}-' \
-        | sort -t'/' -k2 -r  # sort descending by filename (date first)
+    find "$DIR" -maxdepth 1 -type f -name "[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]-*" \
+        | sort -r # sort descending by filename (date first)
 )
 
 total=${#DATED_FILES[@]}