diff --git a/riot/install.sh b/riot/install.sh
index 9b5a0a0757..b89a767446 100755
--- a/riot/install.sh
+++ b/riot/install.sh
@@ -1,12 +1,29 @@
 #!/bin/bash
+set -e
 RIOT_BRANCH=develop
 
-BASE_DIR=$(readlink -f $(dirname $0))
+BASE_DIR=$(cd $(dirname $0) && pwd)
 if [ -d $BASE_DIR/riot-web ]; then
     echo "riot is already installed"
     exit
 fi
 
+# Install ComplexHttpServer (a drop in replacement for Python's SimpleHttpServer
+# but with support for multiple threads) into a virtualenv.
+(
+    virtualenv $BASE_DIR/env
+    source $BASE_DIR/env/bin/activate
+
+    # Having been bitten by pip SSL fail too many times, I don't trust the existing pip
+    # to be able to --upgrade itself, so grab a new one fresh from source.
+    curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
+    python get-pip.py
+
+    pip install ComplexHttpServer
+
+    deactivate
+)
+
 cd $BASE_DIR
 curl -L https://github.com/vector-im/riot-web/archive/${RIOT_BRANCH}.zip --output riot.zip
 unzip -q riot.zip
diff --git a/riot/start.sh b/riot/start.sh
index 0af9f4faef..be226ed257 100755
--- a/riot/start.sh
+++ b/riot/start.sh
@@ -1,6 +1,8 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -e
+
 PORT=5000
-BASE_DIR=$(readlink -f $(dirname $0))
+BASE_DIR=$(cd $(dirname $0) && pwd)
 PIDFILE=$BASE_DIR/riot.pid
 CONFIG_BACKUP=config.e2etests_backup.json
 
@@ -21,7 +23,8 @@ cp $BASE_DIR/config-template/config.json .
 LOGFILE=$(mktemp)
 # run web server in the background, showing output on error
 (
-    python -m SimpleHTTPServer $PORT > $LOGFILE 2>&1 &
+    source $BASE_DIR/env/bin/activate
+    python -m ComplexHTTPServer $PORT > $LOGFILE 2>&1 &
     PID=$!
     echo $PID > $PIDFILE
     # wait so subshell does not exit
@@ -40,7 +43,7 @@ LOGFILE=$(mktemp)
 )&
 # to be able to return the exit code for immediate errors (like address already in use)
 # we wait for a short amount of time in the background and exit when the first
-# child process exists
+# child process exits
 sleep 0.5 &
 # wait the first child process to exit (python or sleep)
 wait -n; RESULT=$?
diff --git a/riot/stop.sh b/riot/stop.sh
index a3e07f574f..eb99fa11cc 100755
--- a/riot/stop.sh
+++ b/riot/stop.sh
@@ -1,5 +1,7 @@
 #!/bin/bash
-BASE_DIR=$(readlink -f $(dirname $0))
+set -e
+
+BASE_DIR=$(cd $(dirname $0) && pwd)
 PIDFILE=riot.pid
 CONFIG_BACKUP=config.e2etests_backup.json
 
diff --git a/run.sh b/run.sh
index 569940e1ae..0e03b733ce 100755
--- a/run.sh
+++ b/run.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+set -e
 
 stop_servers() {
 	./riot/stop.sh
diff --git a/synapse/install.sh b/synapse/install.sh
index 4761e359fa..c289b0f0ba 100755
--- a/synapse/install.sh
+++ b/synapse/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set -e
+
 # config
 SYNAPSE_BRANCH=develop
 INSTALLATION_NAME=consent
@@ -6,7 +8,7 @@ SERVER_DIR=installations/$INSTALLATION_NAME
 CONFIG_TEMPLATE=consent
 PORT=5005
 # set current directory to script directory
-BASE_DIR=$(readlink -f $(dirname $0))
+BASE_DIR=$(cd $(dirname $0) && pwd)
 
 if [ -d $BASE_DIR/$SERVER_DIR ]; then
     echo "synapse is already installed"
@@ -22,7 +24,12 @@ mv synapse-$SYNAPSE_BRANCH $SERVER_DIR
 cd $SERVER_DIR
 virtualenv -p python3 env
 source env/bin/activate
-pip install --upgrade pip
+
+# Having been bitten by pip SSL fail too many times, I don't trust the existing pip
+# to be able to --upgrade itself, so grab a new one fresh from source.
+curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
+python get-pip.py
+
 pip install --upgrade setuptools
 pip install matrix-synapse[all]
 python -m synapse.app.homeserver \
@@ -32,8 +39,13 @@ python -m synapse.app.homeserver \
     --report-stats=no
 # apply configuration
 cp -r $BASE_DIR/config-templates/$CONFIG_TEMPLATE/. ./
-sed -i "s#{{SYNAPSE_ROOT}}#$(pwd)/#g" homeserver.yaml
-sed -i "s#{{SYNAPSE_PORT}}#${PORT}#g" homeserver.yaml
-sed -i "s#{{FORM_SECRET}}#$(uuidgen)#g" homeserver.yaml
-sed -i "s#{{REGISTRATION_SHARED_SECRET}}#$(uuidgen)#g" homeserver.yaml
-sed -i "s#{{MACAROON_SECRET_KEY}}#$(uuidgen)#g" homeserver.yaml
+
+# Hashes used instead of slashes because we'll get a value back from $(pwd) that'll be
+# full of un-escapable slashes.
+# Use .bak suffix as using no suffix doesn't work macOS.
+sed -i.bak "s#{{SYNAPSE_ROOT}}#$(pwd)/#g" homeserver.yaml
+sed -i.bak "s#{{SYNAPSE_PORT}}#${PORT}#g" homeserver.yaml
+sed -i.bak "s#{{FORM_SECRET}}#$(uuidgen)#g" homeserver.yaml
+sed -i.bak "s#{{REGISTRATION_SHARED_SECRET}}#$(uuidgen)#g" homeserver.yaml
+sed -i.bak "s#{{MACAROON_SECRET_KEY}}#$(uuidgen)#g" homeserver.yaml
+rm *.bak
diff --git a/synapse/start.sh b/synapse/start.sh
index 12b89b31ed..379de3850c 100755
--- a/synapse/start.sh
+++ b/synapse/start.sh
@@ -1,5 +1,7 @@
 #!/bin/bash
-BASE_DIR=$(readlink -f $(dirname $0))
+set -e
+
+BASE_DIR=$(cd $(dirname $0) && pwd)
 cd $BASE_DIR
 cd installations/consent
 source env/bin/activate
@@ -9,4 +11,4 @@ EXIT_CODE=$?
 if [ $EXIT_CODE -ne 0 ]; then
 	cat $LOGFILE
 fi
-exit $EXIT_CODE
\ No newline at end of file
+exit $EXIT_CODE
diff --git a/synapse/stop.sh b/synapse/stop.sh
index d83ddd0e4a..a7716744ef 100755
--- a/synapse/stop.sh
+++ b/synapse/stop.sh
@@ -1,5 +1,7 @@
 #!/bin/bash
-BASE_DIR=$(readlink -f $(dirname $0))
+set -e
+
+BASE_DIR=$(cd $(dirname $0) && pwd)
 cd $BASE_DIR
 cd installations/consent
 source env/bin/activate