diff --git a/.github/workflows/bsd.yml b/.github/workflows/bsd.yml
index 56abfdf862..f3ffa9ab8e 100644
--- a/.github/workflows/bsd.yml
+++ b/.github/workflows/bsd.yml
@@ -81,7 +81,7 @@ jobs:
           # which then breaks the CMake configure.
           git config --global --add safe.directory '*'
           echo "=============== FreeBSD Start Deps ====================="
-          ./ci/common.deps.sh
+          ./ci/common.deps.sh FREEBSD
           echo "=============== FreeBSD Deps Success ====================="
           echo "=============== FreeBSD Start Build ====================="
           ./ci/freebsd.build.sh
diff --git a/ci/common.deps.sh b/ci/common.deps.sh
index 5f4d35e5cf..851f41d224 100755
--- a/ci/common.deps.sh
+++ b/ci/common.deps.sh
@@ -1,26 +1,69 @@
 #!/usr/bin/env bash
+# Sourced by ci/*.deps.sh and run directly by .github/workflows/bsd.yml, so it
+# cannot rely on the caller being strict: src/addons/CMakeLists.txt globs
+# whatever is present, so a failed clone or checkout yields a green build of the
+# wrong tree.
 
 (
+set -euo pipefail
+
+CI_PLATFORM="${1:-}"
+case "${CI_PLATFORM}" in
+  LINUX | MACOS | WIN32 | WASM | FREEBSD) ;;
+  *)
+    echo "common.deps.sh: missing or unknown platform '${CI_PLATFORM}'" >&2
+    echo "  usage: source ci/common.deps.sh <LINUX|MACOS|WIN32|WASM|FREEBSD>" >&2
+    exit 1
+    ;;
+esac
+
 cd src/addons
 
+# Containers and the FreeBSD NFS share run git as another uid than the checkout owner.
+if [[ -n "${GITHUB_ACTIONS:-}${CI:-}" ]]; then
+  git config --global --add safe.directory '*'
+fi
+
+REQUESTED=()
+
+checkout_ref() {
+  local url=${1} ref=${2}
+
+  if ! git fetch --force origin "${ref}"; then
+    echo "error: ${url}: no such ref '${ref}' on the remote" >&2
+    return 1
+  fi
+  git checkout --force --detach FETCH_HEAD
+  # The ref may add or move submodules relative to the default branch that was
+  # cloned recursively above: sync them or the addon builds with the wrong trees.
+  git submodule sync --recursive
+  git submodule update --init --recursive --jobs 16
+}
+
 clone_addon() {
   local url=${1}
   local ref=${2:-}
-  local folder=$(echo "${url}" | awk -F'/' '{print $NF}')
+  local folder
+  folder=$(echo "${url}" | awk -F'/' '{print $NF}')
+
+  REQUESTED+=("${folder}|${ref}|${url}")
 
   # Shallow in CI (throwaway checkouts); full history locally so git blame works.
   local shallow=()
   if [[ -n "${GITHUB_ACTIONS:-}${CI:-}" && -z "${ref}" ]]; then
     shallow=(--depth 1 --shallow-submodules)
   fi
+  # ${arr[@]+"${arr[@]}"}: bash 3.2 (/bin/bash on macOS) sees "${empty[@]}" as unbound under -u.
 
   (
   if [[ ! -d "$folder" ]]; then
     if [[ -n "${SKIP_SUBMODULE:-}" ]]; then
       # Skip a heavy nested submodule score never compiles (SKIP_SUBMODULE is
       # "<super-path> <submodule-name>"): clone, init that super, mark it none, recurse.
-      # ${arr[@]+...} guard: macOS bash 3.2 errors on empty arrays under set -u
-      local sdepth=(); [[ ${#shallow[@]} -gt 0 ]] && sdepth=(--depth 1)
+      local sdepth=()
+      if [[ ${#shallow[@]} -gt 0 ]]; then
+        sdepth=(--depth 1)
+      fi
       git clone ${sdepth[@]+"${sdepth[@]}"} "$url" "$folder"
       (
         cd "$folder"
@@ -29,40 +72,72 @@ clone_addon() {
         git submodule update --init --recursive ${sdepth[@]+"${sdepth[@]}"}
       )
     else
-      git clone --recursive -j16 ${shallow[@]+"${shallow[@]}"} "$url"
+      git clone --recursive -j16 ${shallow[@]+"${shallow[@]}"} "$url" "$folder"
     fi
-    if [[ "x${ref}" != "x" ]]; then
-    (
+
+    if [[ -n "${ref}" ]]; then
       cd "$folder"
-      git checkout "${ref}"
-      # The ref may add or move submodules relative to the default branch
-      # that was cloned recursively above: sync them or the addon builds
-      # (or silently skips, see the note at the top) with the wrong trees.
-      git submodule sync --recursive
-      git submodule update --init --recursive
-    )
+      checkout_ref "$url" "$ref"
     fi
   else
-    # Try to update the submodule if it's really super clean
+    # Try to update the addon if it's really super clean
     cd "$folder"
-    git update-index --really-refresh
-    if output=$(git status --porcelain  --untracked-files=no) && [ -z "$output" ]; then
-      if output=$(git diff-index --quiet HEAD) && [ -z "$output" ]; then
-        git pull || true
-        if [[ "x${ref}" != "x" ]]; then
-        (
-          cd "$folder"
-          git checkout "${ref}"
-          git submodule sync --recursive
-          git submodule update --init --recursive
-        )
-        fi
+    git update-index --really-refresh || true
+    if [[ -n "$(git status --porcelain --untracked-files=no)" ]]; then
+      if [[ -n "${ref}" ]]; then
+        echo "error: ${folder} has local modifications, refusing to check out '${ref}'" >&2
+        exit 1
       fi
+      echo "note: ${folder} has local modifications, leaving it as-is" >&2
+    elif [[ -n "${ref}" ]]; then
+      checkout_ref "$url" "$ref"
+    else
+      git pull --ff-only || echo "note: could not update ${folder}, using the local checkout" >&2
+      git submodule sync --recursive
+      git submodule update --init --recursive --jobs 16
     fi
   fi
   )
 }
 
+verify_addons() {
+  local failed=()
+  local entry folder ref url head want
+
+  echo "score add-ons:"
+  for entry in ${REQUESTED[@]+"${REQUESTED[@]}"}; do
+    folder=${entry%%|*}
+    ref=${entry#*|}; ref=${ref%%|*}
+    url=${entry##*|}
+
+    if [[ ! -d "${folder}" ]]; then
+      failed+=("${folder}: not cloned")
+      continue
+    fi
+    if [[ ! -f "${folder}/CMakeLists.txt" ]]; then
+      failed+=("${folder}: incomplete clone, no CMakeLists.txt")
+      continue
+    fi
+
+    head=$(git -C "${folder}" rev-parse HEAD)
+    if [[ -n "${ref}" ]]; then
+      want=$(git ls-remote "${url}" "${ref}" | awk 'NR == 1 { print $1 }')
+      want=${want:-${ref}}
+      if [[ "${head}" != "${want}"* ]]; then
+        failed+=("${folder}: on ${head}, expected ${want} (${ref})")
+        continue
+      fi
+    fi
+    printf '  %-34s %s %s\n' "${folder}" "${head:0:12}" "${ref}"
+  done
+
+  if [[ ${#failed[@]} -gt 0 ]]; then
+    echo "error: the following add-ons were not set up correctly:" >&2
+    printf '  %s\n' "${failed[@]}" >&2
+    return 1
+  fi
+}
+
 clone_addon https://github.com/ossia/iscore-addon-network
 clone_addon https://github.com/ossia/score-addon-synthimi
 clone_addon https://github.com/ossia/score-addon-jk
@@ -78,8 +153,6 @@ clone_addon https://github.com/ossia/score-addon-cv
 clone_addon https://github.com/ossia/score-addon-onnx
 clone_addon https://github.com/ossia/score-addon-puara
 
-CI_PLATFORM="${1:-DEFAULT}"
-
 if [[ "$CI_PLATFORM" != "WASM" ]];
 then
   clone_addon         https://github.com/ossia/score-addon-ble
@@ -97,6 +170,12 @@ fi
 if [[ "$CI_PLATFORM" == "LINUX" || "$CI_PLATFORM" == "WIN32" ]]; then
   clone_addon https://github.com/ossia/score-addon-librediffusion
 fi
-)
 
+verify_addons
+)
 
+score_addons_status=$?
+if [[ ${score_addons_status} -ne 0 ]]; then
+  echo "error: failed to set up the score add-ons, see above" >&2
+  exit ${score_addons_status}
+fi
diff --git a/ci/freebsd.deps.sh b/ci/freebsd.deps.sh
index bcdb633dbb..4bf5df1a0b 100755
--- a/ci/freebsd.deps.sh
+++ b/ci/freebsd.deps.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+set -eux
 
 source ci/common.setup.sh
 
diff --git a/ci/osx.brew.deps.sh b/ci/osx.brew.deps.sh
index a7e14917ad..3fa9bf133c 100755
--- a/ci/osx.brew.deps.sh
+++ b/ci/osx.brew.deps.sh
@@ -1,11 +1,15 @@
 #!/bin/bash -eux
 
-set +e
-
 export HOMEBREW_NO_AUTO_UPDATE=1
-brew update && (brew list cmake || brew install cmake)
-brew install ninja qt boost ffmpeg@7 fftw portaudio jack sdl lv2 lilv suil freetype
-brew uninstall --ignore-dependencies qt@5 || true
+
+# brew failures are tolerated; the add-on checkout below is not.
+(
+  set +e
+  brew update && (brew list cmake || brew install cmake)
+  brew install ninja qt boost ffmpeg@7 fftw portaudio jack sdl lv2 lilv suil freetype
+  brew uninstall --ignore-dependencies qt@5
+  true
+)
 
 source ci/common.deps.sh MACOS
 
diff --git a/ci/win32.deps.sh b/ci/win32.deps.sh
index 5fba1a8736..391995feca 100755
--- a/ci/win32.deps.sh
+++ b/ci/win32.deps.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/bash -eu
 
 choco install -y ninja
 choco install -y rsync
@@ -13,7 +13,7 @@ fi
 
 (
 set -x
-mkdir /c/ossia-sdk-$SDK_ARCH
+mkdir -p /c/ossia-sdk-$SDK_ARCH
 cd /c/ossia-sdk-$SDK_ARCH
 curl -L https://github.com/ossia/sdk/releases/download/sdk38/sdk-mingw-$SDK_ARCH.7z --output sdk-mingw-$SDK_ARCH.7z
 7z x sdk-mingw-$SDK_ARCH.7z
diff --git a/ci/win32.msvc.deps.sh b/ci/win32.msvc.deps.sh
index 7a9175311a..60c1393f6e 100644
--- a/ci/win32.msvc.deps.sh
+++ b/ci/win32.msvc.deps.sh
@@ -1,11 +1,11 @@
-#!/bin/bash
+#!/bin/bash -eu
 
 choco install -y ninja
 choco install -y rsync
 
 (
 set -x
-mkdir /c/ossia-sdk-msvc
+mkdir -p /c/ossia-sdk-msvc
 cd /c/ossia-sdk-msvc
 curl -L https://github.com/ossia/sdk/releases/download/sdk35/sdk-msvc-x86_64.7z --output sdk-msvc.7z
 7z x sdk-msvc.7z