diff --git a/applyset-deploy.sh b/applyset-deploy.sh
index 81bc8dc..e7d4e5b 100644
--- a/applyset-deploy.sh
+++ b/applyset-deploy.sh
@@ -3,9 +3,10 @@
 set -euo pipefail
 
 first_server="${SERVERS%% *}"
-previous_manifest=$(ssh -T "root@$first_server" << EOF
-if [[ -f "$GCROOTDIR/${NAME}.yml" ]]; then
-	cat "$GCROOTDIR/${NAME}.yml"
+previous_manifest=$(
+	envsubst <<EOF | ssh -T "root@$first_server"
+if [[ -f "$GCROOTDIR/$NAME.yml" ]]; then
+	cat "$GCROOTDIR/$NAME.yml"
 fi
 EOF
 )
@@ -14,30 +15,26 @@ set +e
 if [ -z "$previous_manifest" ]; then
 	echo No previous manifest found!
 else
-	$DYFF between <(echo $previous_manifest) $MANIFEST \
+	$DYFF between <(echo "$previous_manifest") "$MANIFEST" \
 		--exclude-regexp metadata.labels.kubenix/hash \
 		--exclude-regexp labels.kubenix/hash \
-		--set-exit-code 
-
-	if [ $? -eq 0 ]; then
-		exit 0
-	fi
+		--set-exit-code
 fi
 set -e
 
-read -r -p "Continue? " response
+read -r -p "Continue? " _
 
 echo Uploading closure...
 for server in $SERVERS; do
-	echo Uploading closure to $server...
-	nix copy --to "ssh://root@$server.dmz" $MANIFEST
+	echo Uploading closure to "$server"...
+	nix copy --to "ssh://root@$server.dmz" "$MANIFEST"
 	ssh "root@$server.dmz" "mkdir -p $GCROOTDIR && ln -sf $MANIFEST $GCROOTDIR/${NAME}.yml"
 done
 
 echo Applying Kubernetes manifest...
 export KUBECTL_APPLYSET=true
-vals eval -fail-on-missing-key-in-map <$MANIFEST | \
-kubectl apply -f - \
-	--prune \
-	--applyset applyset-$NAME \
-	--namespace $NAMESPACE
+vals eval -fail-on-missing-key-in-map <"$MANIFEST" |
+	kubectl apply -f - \
+		--prune \
+		--applyset applyset-"$NAME" \
+		--namespace "$NAMESPACE"
diff --git a/kubenix.nix b/kubenix.nix
index 64806b8..86355e9 100644
--- a/kubenix.nix
+++ b/kubenix.nix
@@ -64,7 +64,7 @@ flake-utils.lib.eachDefaultSystem
       pkgs.symlinkJoin
       {
         name = "applyset-deploy.sh";
-        paths = [deployScript pkgs.vals pkgs.kubectl];
+        paths = [deployScript pkgs.vals pkgs.kubectl pkgs.gettext];
         buildInputs = [pkgs.makeWrapper];
         passthru.manifest = result;
         meta.mainProgram = "applyset-deploy.sh";