diff --git a/build_sysext b/build_sysext
index 95bc35c569..954f8790df 100755
--- a/build_sysext
+++ b/build_sysext
@@ -83,6 +83,10 @@ FLAGS "$@" || exit 1
 
 eval set -- "${FLAGS_ARGV}"
 
+# Only now can we die on error.  shflags functions leak non-zero error codes,
+# so will die prematurely if 'switch_to_strict_mode' is specified before now.
+switch_to_strict_mode -uo pipefail
+
 # Validate command line parameters
 
 SYSEXTNAME="${1:-}"
@@ -129,8 +133,6 @@ _get_sysext_arch() {
     fi
 }
 
-set -euo pipefail
-
 cleanup() {
   local dirs=(
     "${BUILD_DIR}/fs-root"