diff --git a/scripts/bootstrap_kvm.sh b/scripts/bootstrap_kvm.sh
index b6473d2..e239b7c 100755
--- a/scripts/bootstrap_kvm.sh
+++ b/scripts/bootstrap_kvm.sh
@@ -19,8 +19,8 @@
 KVM_PACKAGES="qemu-system-x86 ovmf dnsmasq ebtables iptables nfs-common jq curl"
 
 kvm_packages () {
-    DRY_RUN="${1}"
-    WITH_PACKAGES="${2}"
+    local DRY_RUN="${1}"
+    local WITH_PACKAGES="${2}"
 
     [[ ${WITH_PACKAGES} -eq ${FLAGS_TRUE} ]] || { info "paquets : ignorés (--nopackages)"; return 0; }
 
@@ -35,7 +35,7 @@ kvm_packages () {
 }
 
 kvm_kernel () {
-    DRY_RUN="${1}"
+    local DRY_RUN="${1}"
 
     info "kernel"
 
@@ -53,8 +53,8 @@ kvm_kernel () {
 
 # Bridge vide, up, sans STP.
 kvm_ensure_bridge () {
-    DRY_RUN="${1}"
-    NAME="${2}"
+    local DRY_RUN="${1}"
+    local NAME="${2}"
 
     if ! ip link show dev "${NAME}" >/dev/null 2>&1
     then
@@ -65,12 +65,13 @@ kvm_ensure_bridge () {
 }
 
 kvm_network () {
-    DRY_RUN="${1}"
-    WITH_NETWORK="${2}"
-    UPLINK="${3}"
-    BRIDGE="${4}"
-    PUBLIC_BRIDGE="${5}"
-    ROLLBACK_DELAY="${6}"
+    local DRY_RUN="${1}"
+    local WITH_NETWORK="${2}"
+    local UPLINK="${3}"
+    local BRIDGE="${4}"
+    local PUBLIC_BRIDGE="${5}"
+    local ROLLBACK_DELAY="${6}"
+    local MASTER ADDR_JSON IP PREFIX GW MIGRATE MIGRATE_SCRIPT
 
     [[ ${WITH_NETWORK} -eq ${FLAGS_TRUE} ]] || { info "réseau : ignoré (--nonetwork)"; return 0; }
 
@@ -154,13 +155,13 @@ EOF
 
 # Point d'entrée appelé par deploy.sh --bootstrap.
 bootstrap_host () {
-    DRY_RUN="${1}"
-    WITH_PACKAGES="${2}"
-    WITH_NETWORK="${3}"
-    UPLINK="${4}"
-    BRIDGE="${5}"
-    PUBLIC_BRIDGE="${6}"
-    ROLLBACK_DELAY="${7}"
+    local DRY_RUN="${1}"
+    local WITH_PACKAGES="${2}"
+    local WITH_NETWORK="${3}"
+    local UPLINK="${4}"
+    local BRIDGE="${5}"
+    local PUBLIC_BRIDGE="${6}"
+    local ROLLBACK_DELAY="${7}"
 
     kvm_packages "${DRY_RUN}" "${WITH_PACKAGES}"
     kvm_kernel   "${DRY_RUN}"
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 29b74c8..32b8599 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -24,7 +24,7 @@ exec_with_dry_run () {
     eval "${2}" 2> /tmp/error || \
     {
       echo -e "failed with following error";
-      output=$(cat /tmp/error | sed -e "s/^/ error -> /g");
+      local output; output=$(cat /tmp/error | sed -e "s/^/ error -> /g");
       echo -e "${output}";
       return 1;
     }
@@ -37,18 +37,19 @@ run () {
 }
 
 check_latest_script () {
-    REMOTE_URL="${1}"
-    LOCAL_PATH="${2}"
+    local REMOTE_URL="${1}"
+    local LOCAL_PATH="${2}"
+    local REMOTE_SUM LOCAL_SUM
 
-    REMOTE=$(curl --silent "${REMOTE_URL}" | sha256sum)
-    LOCAL=$(cat ${LOCAL_PATH} | sha256sum)
+    REMOTE_SUM=$(curl --silent "${REMOTE_URL}" | sha256sum)
+    LOCAL_SUM=$(cat ${LOCAL_PATH} | sha256sum)
 
-    [[ "${REMOTE}" == "${LOCAL}" ]] || return 1
+    [[ "${REMOTE_SUM}" == "${LOCAL_SUM}" ]] || return 1
     return 0
 }
 
 list_active_units () {
-    PATTERN="${1}"
+    local PATTERN="${1}"
     systemctl list-units --state=active --no-legend --plain "${PATTERN}" 2>/dev/null \
         | awk '{print $1}' || true
 }
@@ -56,6 +57,7 @@ list_active_units () {
 # Units non instanciables du profil (agent.service) : celles qu'on arrête et
 # démarre nommément.
 profile_main_units () {
+    local unit
     for unit in $(profile_units "${1}")
     do
         case "${unit}" in
@@ -66,6 +68,7 @@ profile_main_units () {
 }
 
 active_instances () {
+    local unit
     for unit in $(profile_units "${1}")
     do
         case "${unit}" in
@@ -75,9 +78,10 @@ active_instances () {
 }
 
 stop_services () {
-    DRY_RUN="${1}"
-    PROFILE="${2}"
-    INSTANCES="${3}"
+    local DRY_RUN="${1}"
+    local PROFILE="${2}"
+    local INSTANCES="${3}"
+    local unit
 
     for unit in $(profile_main_units "${PROFILE}")
     do
@@ -91,9 +95,10 @@ stop_services () {
 }
 
 start_services () {
-    DRY_RUN="${1}"
-    PROFILE="${2}"
-    INSTANCES="${3}"
+    local DRY_RUN="${1}"
+    local PROFILE="${2}"
+    local INSTANCES="${3}"
+    local unit
 
     for unit in ${INSTANCES}
     do
@@ -132,11 +137,12 @@ profile_bootstrap () {
 }
 
 run_bootstrap () {
-    DRY_RUN="${1}"
-    PROFILE="${2}"
-    GIT_SERVER="${3}"
-    REPO_PATH="${4}"
-    BRANCH="${5}"
+    local DRY_RUN="${1}"
+    local PROFILE="${2}"
+    local GIT_SERVER="${3}"
+    local REPO_PATH="${4}"
+    local BRANCH="${5}"
+    local NAME BOOTSTRAP_URL
 
     NAME=$(profile_bootstrap "${PROFILE}") || die "profil inconnu : ${PROFILE}"
     [[ -n "${NAME}" ]] || { info "bootstrap : rien à préparer pour le profil ${PROFILE}"; return 0; }
@@ -155,18 +161,18 @@ run_bootstrap () {
 }
 
 resolve_tag () {
-    TAG="${1}"
-    GIT_SERVER="${2}"
-    REPO_PATH="${3}"
+    local TAG="${1}"
+    local GIT_SERVER="${2}"
+    local REPO_PATH="${3}"
 
     [[ -n "${TAG}" ]] && { echo "${TAG}"; return 0; }
     curl --silent "${GIT_SERVER}api/v1/repos/${REPO_PATH}releases/?limit=1" | jq -r '.[0].tag_name'
 }
 
 release_assets () {
-    GIT_SERVER="${1}"
-    REPO_PATH="${2}"
-    RELEASE_TAG="${3}"
+    local GIT_SERVER="${1}"
+    local REPO_PATH="${2}"
+    local RELEASE_TAG="${3}"
 
     curl --silent "${GIT_SERVER}api/v1/repos/${REPO_PATH}releases/tags/${RELEASE_TAG}" | jq -c '.assets[]'
 }
@@ -180,9 +186,10 @@ asset_url () {
 }
 
 fetch_assets () {
-    DRY_RUN="${1}"
-    PROFILE="${2}"
-    ASSETS="${3}"
+    local DRY_RUN="${1}"
+    local PROFILE="${2}"
+    local ASSETS="${3}"
+    local unit short UNIT_URL BIN_URL FULL_NAME
 
     info "assets de la release ${TAG} pour le profil ${PROFILE}"
 
@@ -208,8 +215,9 @@ fetch_assets () {
 }
 
 install_units () {
-    DRY_RUN="${1}"
-    PROFILE="${2}"
+    local DRY_RUN="${1}"
+    local PROFILE="${2}"
+    local UNITS unit
 
     UNITS=$(profile_units "${PROFILE}") || die "profil inconnu : ${PROFILE}"
     [[ -n "${UNITS}" ]] || { info "units : aucune pour le profil ${PROFILE}"; return 0; }
@@ -237,9 +245,10 @@ install_units () {
 }
 
 switch_binaries () {
-    DRY_RUN="${1}"
-    PROFILE="${2}"
-    ASSETS="${3}"
+    local DRY_RUN="${1}"
+    local PROFILE="${2}"
+    local ASSETS="${3}"
+    local BINARIES INSTANCES short FULL_NAME
 
     BINARIES=$(profile_binaries "${PROFILE}")
     [[ -n "${BINARIES}" ]] || { info "bascule : aucun exécutable pour le profil ${PROFILE}"; return 0; }
@@ -285,7 +294,7 @@ main () {
 
     if [[ ${FLAGS_up_script} -eq ${FLAGS_TRUE} ]]
     then
-        SCRIPT_URL="${FLAGS_git_server}${FLAGS_repo_path}raw/branch/${FLAGS_branch}${SCRIPT_PATH}"
+        local SCRIPT_URL="${FLAGS_git_server}${FLAGS_repo_path}raw/branch/${FLAGS_branch}${SCRIPT_PATH}"
         if ! check_latest_script "${SCRIPT_URL}" "${0}"
         then
             run "${FLAGS_dryrun}" "curl --silent '${SCRIPT_URL}' -o '${0}'"
@@ -296,6 +305,8 @@ main () {
     [[ ${FLAGS_bootstrap} -eq ${FLAGS_TRUE} ]] && \
         run_bootstrap "${FLAGS_dryrun}" "${FLAGS_profile}" "${FLAGS_git_server}" "${FLAGS_repo_path}" "${FLAGS_branch}"
 
+    local TAG BIN_PATH UNIT_PATH LN_PATH ASSETS
+
     TAG=$(resolve_tag "${FLAGS_tag}" "${FLAGS_git_server}" "${FLAGS_repo_path}")
     [[ -n "${TAG}" && "${TAG}" != "null" ]] || die "impossible de déterminer la release à déployer"