diff --git a/scripts/check-installer.sh b/scripts/check-installer.sh
index 99bfab8a..2c9d0e4f 100755
--- a/scripts/check-installer.sh
+++ b/scripts/check-installer.sh
@@ -34,9 +34,12 @@ else
   pass "parses (dash not installed; POSIX check was approximate)"
 fi
 
+# The version is printed because it matters: SC2015 and friends move between
+# releases, so a local run that passes on a newer shellcheck than CI's is not
+# the same check. When CI disagrees with you, this line is why.
 if command -v shellcheck >/dev/null 2>&1; then
   shellcheck -s sh "$SCRIPT" || fail "shellcheck found problems in the installer"
-  pass "shellcheck clean"
+  pass "shellcheck clean ($(shellcheck --version | awk '/^version:/ {print $2}'))"
 else
   echo "· shellcheck not installed; skipped"
 fi
diff --git a/site/public/install.sh b/site/public/install.sh
index 0d723039..2a250be9 100644
--- a/site/public/install.sh
+++ b/site/public/install.sh
@@ -488,8 +488,16 @@ now_s() { date +%s; }
 # path so that --yes and the environment variables reach the same code.
 # ─────────────────────────────────────────────────────────────────────────
 
-raw_on()  { [ "$INTERACTIVE" = 1 ] && stty raw -echo <"$TTY" 2>/dev/null || true; }
-raw_off() { [ "$INTERACTIVE" = 1 ] && stty -raw echo <"$TTY" 2>/dev/null || true; }
+# A terminal that cannot be put into raw mode is not fatal: the menus still
+# draw, they just read a whole line instead of a keypress.
+raw_on() {
+    [ "$INTERACTIVE" = 1 ] || return 0
+    stty raw -echo <"$TTY" 2>/dev/null || true
+}
+raw_off() {
+    [ "$INTERACTIVE" = 1 ] || return 0
+    stty -raw echo <"$TTY" 2>/dev/null || true
+}
 
 # read_key leaves the decimal code of one keypress in KEY. Arrow keys arrive
 # as three bytes; the escape prefix is consumed here so callers only ever see
@@ -2938,7 +2946,9 @@ parse_args() {
 }
 
 need_value() {
-    [ $# -ge 2 ] && [ -n "$2" ] || die "$1 needs a value"
+    if [ $# -lt 2 ] || [ -z "$2" ]; then
+        die "$1 needs a value"
+    fi
     printf '%s' "$2"
 }
 
diff --git a/site/public/install.sh.sha256 b/site/public/install.sh.sha256
index 4e4fad4b..5f94a105 100644
--- a/site/public/install.sh.sha256
+++ b/site/public/install.sh.sha256
@@ -1 +1 @@
-e5fddbe977c5e7ba3601db7acac3e00b66fb87f4bc4d32816fdc11b9bd16775e  install.sh
+393db1b2d1b91afeceb20f8b5ad904b5c3377e19480f85da9d635871f6d262a1  install.sh