diff --git a/keyserver/bash/backup-phabricator.sh b/keyserver/bash/backup-phabricator.sh
index 121870c12..757fb7f62 100755
--- a/keyserver/bash/backup-phabricator.sh
+++ b/keyserver/bash/backup-phabricator.sh
@@ -1,57 +1,57 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # run as: ssh user on root wheel
 # run from: wherever
 
 # The path to Phabricator on our server
 PHABRICATOR_PATH=/var/www/phacility/phabricator
 
 # The path to the backup directory on our server
 BACKUP_PATH=/mnt/backup
 
 # The user that will be owning the backup files
 BACKUP_USER=comm
 
 # The maximum amount of space to spend on Phabricator backups
 MAX_DISK_USAGE_KB=204800 # 200 MiB
 
 set -e
 [[ `whoami` = root ]] || exec sudo su -c "$0"
 
 cd "$PHABRICATOR_PATH"
 
 OUTPUT_FILE="$BACKUP_PATH/phabricator.$(date +'%Y-%m-%d-%R').sql.gz"
 
 function remove_oldest_backup {
   OLDEST_BACKUP=$(find "$BACKUP_PATH" -maxdepth 1 -name 'phabricator.*.sql.gz' -type f -printf '%T+ %p\0' | sort -z | head -z -n 1 | cut -d ' ' -f2- | cut -d '' -f1)
   if [[ ! "$OLDEST_BACKUP" ]]; then
     return 1
   fi
   rm -f "$OLDEST_BACKUP"
   return 0
 }
 
 RETRIES=2
 while [[ $RETRIES -ge 0 ]]; do
   if ./bin/storage dump --compress --overwrite --output "$OUTPUT_FILE" > /dev/null 2>&1; then
     break
   fi
   rm -f "$OUTPUT_FILE"
 
   remove_oldest_backup || break
   ((RETRIES--))
 done
 
 chown $BACKUP_USER:$(id -gn $BACKUP_USER) "$OUTPUT_FILE" || true
 
 while true; do
   TOTAL_USAGE=$(sudo du -cs "$BACKUP_PATH"/phabricator.*.sql.gz | grep total | awk '{ print $1 }')
   if [[ $TOTAL_USAGE -le $MAX_DISK_USAGE_KB ]]; then
     break
   fi
   BACKUP_COUNT=$(ls -hla "$BACKUP_PATH"/phabricator.*.sql.gz | wc -l)
   if [[ $BACKUP_COUNT -lt 2 ]]; then
     break
   fi
   remove_oldest_backup || break
 done
diff --git a/keyserver/bash/deploy.sh b/keyserver/bash/deploy.sh
index 4655cb146..75dd3a881 100755
--- a/keyserver/bash/deploy.sh
+++ b/keyserver/bash/deploy.sh
@@ -1,56 +1,56 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # run as: ssh user on root wheel
 # run from: wherever
 # param: path to link to
 
 # The maximum amount of space to spend on checkouts. By default we leave around
 # old deployments in case we want to roll back. The limit includes the current
 # prod checkout, but will never delete prod.
 MAX_DISK_USAGE_KB=3145728 # 3 GiB
 
 # The user that spawns the Node server
 DAEMON_USER=comm
 
 # Input to git clone
 GIT_CLONE_PARAMS=https://github.com/CommE2E/comm.git
 
 set -e
 [[ `whoami` = root ]] || exec sudo su -c "$0 $1"
 
 # STEP 1: clone source into new directory
 CHECKOUT_PATH=$1.$(date +%F-%H-%M)
 rm -rf "$CHECKOUT_PATH" # badass. risky
 mkdir -p "$CHECKOUT_PATH"
 chown $DAEMON_USER:$DAEMON_USER "$CHECKOUT_PATH"
 su $DAEMON_USER -c "git clone $GIT_CLONE_PARAMS '$CHECKOUT_PATH'"
 su $DAEMON_USER -c "cp -r '$1'/keyserver/secrets '$CHECKOUT_PATH'/keyserver/secrets"
 su $DAEMON_USER -c "cp -r '$1'/keyserver/facts '$CHECKOUT_PATH'/keyserver/facts"
 cd "$CHECKOUT_PATH"
 su $DAEMON_USER -c "keyserver/bash/setup.sh"
 
 # STEP 2: test if the binary crashes within 60 seconds
 set +e
 su $DAEMON_USER -c "cd keyserver && PORT=3001 timeout 60 bash/run-prod.sh"
 [[ $? -eq 124 ]] || exit 1
 set -e
 
 # STEP 3: flip it over
 systemctl stop comm || true
 rm "$1"
 ln -s "$CHECKOUT_PATH" "$1"
 chown -h $DAEMON_USER:$DAEMON_USER "$1"
 systemctl restart comm
 
 # STEP 4: clean out old checkouts
 checkouts=($(ls -dtr "$1".*))
 for checkout in "${checkouts[@]}"; do
   if [[ "$checkout" = "$CHECKOUT_PATH" ]]; then
     break
   fi
   TOTAL_USAGE=$(sudo du -cs $1* | grep total | awk '{ print $1 }')
   if [[ $TOTAL_USAGE -le $MAX_DISK_USAGE_KB ]]; then
     break
   fi
   rm -rf "$checkout"
 done
diff --git a/keyserver/bash/run-prod.sh b/keyserver/bash/run-prod.sh
index 1b56a6d7d..cd9d443d0 100755
--- a/keyserver/bash/run-prod.sh
+++ b/keyserver/bash/run-prod.sh
@@ -1,9 +1,9 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # run as: node user
 # run from: keyserver dir
 
 set -e
 
 . ~/.nvm/nvm.sh
 nvm exec npm run prod
diff --git a/keyserver/bash/setup.sh b/keyserver/bash/setup.sh
index 20e6c57eb..e4bf0f606 100755
--- a/keyserver/bash/setup.sh
+++ b/keyserver/bash/setup.sh
@@ -1,17 +1,17 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # run as: node user
 # run from: root of repo
 
 set -e
 
 . ~/.nvm/nvm.sh
 
 chmod -R u=rwX,g=rX,o=rX .
 chmod -R u=rwX,g=,o= keyserver/secrets
 
 pushd server && nvm install && popd
 yarn cleaninstall
 yarn workspace web prod
 yarn workspace landing prod
 yarn workspace keyserver prod-build
diff --git a/keyserver/bash/source-nvm.sh b/keyserver/bash/source-nvm.sh
index cb5d1d5a1..7e01ed6b0 100755
--- a/keyserver/bash/source-nvm.sh
+++ b/keyserver/bash/source-nvm.sh
@@ -1,10 +1,10 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # source as: logged in user
 # source from: package.json (via npm/yarn scripts)
 
 unset PREFIX
 [ -s "/usr/local/opt/nvm/nvm.sh" ] && . "/usr/local/opt/nvm/nvm.sh" # Intel Mac
 [ -s "/opt/homebrew/opt/nvm/nvm.sh" ] && . "/opt/homebrew/opt/nvm/nvm.sh" # M1 Mac
 [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh" # Ubuntu
 nvm install --no-progress
diff --git a/services/scripts/build_base_image.sh b/services/scripts/build_base_image.sh
index 8602ad072..c0c3dec4a 100755
--- a/services/scripts/build_base_image.sh
+++ b/services/scripts/build_base_image.sh
@@ -1,11 +1,11 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 
 if [ "$#" -gt 1 ]; then
   echo "usage: $0 [TAG]"
   exit 1
 fi
 
 tag=${1:-"1.1"}
 docker build -t commapp/services-base:${tag} base-image
diff --git a/services/scripts/list_services.sh b/services/scripts/list_services.sh
index 80559d824..24c51888d 100755
--- a/services/scripts/list_services.sh
+++ b/services/scripts/list_services.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 
 ls | grep -vE 'base-image|docker.compose.yml|package.json|scripts'
diff --git a/services/scripts/run_all_services.sh b/services/scripts/run_all_services.sh
index dad4156d4..7f3a52cb0 100755
--- a/services/scripts/run_all_services.sh
+++ b/services/scripts/run_all_services.sh
@@ -1,11 +1,11 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 
 SERVICES_LIST=`./scripts/list_services.sh`
 SERVICES=""
 for SERVICE in $SERVICES_LIST; do
   SERVICES="$SERVICES $SERVICE-server"
 done
 
 docker-compose up $SERVICES
diff --git a/services/scripts/run_server_image.sh b/services/scripts/run_server_image.sh
index c729a7096..cf8dbf6e5 100755
--- a/services/scripts/run_server_image.sh
+++ b/services/scripts/run_server_image.sh
@@ -1,33 +1,33 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 
 if [ "$#" -lt 1 ] || [ "$#" -gt 2 ]; then
   echo "Illegal number of parameters, expected:"
   echo "- one argument with a name of the service, currently available services:"
   ./scripts/list_services.sh
   echo "- one optional argument with port"
   echo "- example: ./services/scripts/run_server_image.sh tunnelbroker 12345"
   exit 1;
 fi
 
 SERVICE=$1
 if [ "$SERVICE" == "tunnelbroker" ]; then
   if [ ! -z "$2" ]; then
     export COMM_SERVICES_PORT_TUNNELBROKER=$2
   fi
 elif [ "$SERVICE" == "backup" ]; then
   if [ ! -z "$2" ]; then
     export COMM_SERVICES_PORT_BACKUP=$2
   fi
 elif [ "$SERVICE" == "blob" ]; then
   if [ ! -z "$2" ]; then
     export COMM_SERVICES_PORT_BLOB=$2
   fi
 else
   echo "No such service ${SERVICE}, aborting"
   exit 1
 fi
 
 docker-compose build $SERVICE-server
 docker-compose up $SERVICE-server
diff --git a/services/scripts/test_all_services.sh b/services/scripts/test_all_services.sh
index 9581a45d6..e7a1b8c76 100755
--- a/services/scripts/test_all_services.sh
+++ b/services/scripts/test_all_services.sh
@@ -1,9 +1,9 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 
 SERVICES=`./scripts/list_services.sh`
 
 for SERVICE in $SERVICES; do
   ./scripts/test_service.sh $SERVICE
 done
diff --git a/services/scripts/test_service.sh b/services/scripts/test_service.sh
index 834881e85..4780d712c 100755
--- a/services/scripts/test_service.sh
+++ b/services/scripts/test_service.sh
@@ -1,19 +1,19 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 
 SERVICES=`./scripts/list_services.sh`
 SERVICE=`echo "$SERVICES" | grep $1` || echo "No such service: $1"
 
 if [ "$SERVICE" != "$1" ]; then
   echo "Expected one of these:"
   echo "$SERVICES"
   exit 1;
 fi;
 
 export COMM_TEST_SERVICES=1
 
 echo "${SERVICE} service will be tested"
 
 docker-compose build ${SERVICE}-server
 docker-compose run ${SERVICE}-server