diff --git a/tools/python/pywrapper_template.txt b/tools/python/pywrapper_template.txt
index 236a381..c217a3a 100644
--- a/tools/python/pywrapper_template.txt
+++ b/tools/python/pywrapper_template.txt
@@ -1,11 +1,13 @@
-#!/bin/sh -u
+#!/bin/sh
+
 # Don't set -e because we don't have robust trapping and printing of errors.
+set -u
 
 # We use /bin/sh rather than /bin/bash for portability. See discussion here:
 # https://groups.google.com/forum/?nomobile=true#!topic/bazel-dev/4Ql_7eDcLC0
 # We do lose the ability to set -o pipefail.
 
-STRICT=%STRICT%
+STRICT="%STRICT%"
 
 if [ "$STRICT" = "1" ]; then
   FAILURE_HEADER="\
@@ -43,11 +45,11 @@
 #     https://github.com/bazelbuild/bazel/issues/8415
 
 # Try the "python%VERSION%" command name first, then fall back on "python".
-PYTHON_BIN=`PATH="$PATH" which python%VERSION% || echo ""`
-USED_FALLBACK=0
+PYTHON_BIN="$(PATH="$PATH" which python%VERSION% 2> /dev/null)"
+USED_FALLBACK="0"
 if [ -z "${PYTHON_BIN:-}" ]; then
-  PYTHON_BIN=`PATH="$PATH" which python || echo ""`
-  USED_FALLBACK=1
+  PYTHON_BIN="$(PATH="$PATH" which python 2>/dev/null)"
+  USED_FALLBACK="1"
 fi
 if [ -z "${PYTHON_BIN:-}" ]; then
   die "Neither 'python%VERSION%' nor 'python' were found on the target \
@@ -63,7 +65,7 @@
 
 if [ "$STRICT" = "1" ]; then
   # Verify that we grabbed an interpreter with the right version.
-  VERSION_STR=`"$PYTHON_BIN" -V 2>&1` \
+  VERSION_STR="$("$PYTHON_BIN" -V 2>&1)" \
       || die "Could not get interpreter version via '$PYTHON_BIN -V'"
   if ! echo "$VERSION_STR" | grep -q " %VERSION%\." ; then
       die "According to '$PYTHON_BIN -V', version is '$VERSION_STR', but we \