diff --git a/scripts/build.sh b/scripts/build.sh
index c5036b4..7059fb7 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -8,24 +8,47 @@ set -euo pipefail
 root=$(cd "$(dirname "$0")/.." && pwd)
 work=${WORK_DIR:-$root/build}
 version=${FCITX_VERSION:-$(pkg-config --modversion Fcitx5Core)}
+
+die() { echo "build.sh: $*" >&2; exit 1; }
+command -v git >/dev/null || die "git is needed to fetch the sources"
+
+# The sources are fetched by commit hash and the hash is checked afterwards. A
+# tag can be moved and a downloaded archive can be swapped, a commit hash cannot
+# be faked, Git verifies the content against it. This plugin runs inside the
+# input method and sees everything that is typed, so what it is built from
+# matters.
+#
+# Commit the Fcitx5 release tag points to, check it yourself when adding one:
+#   git ls-remote https://github.com/fcitx/fcitx5 "refs/tags/<version>^{}"
+declare -A known_commits=(
+    ["5.1.23"]="27cca6e0239938b2d53937061d0980c087856b22"
+)
+commit=${FCITX_COMMIT:-${known_commits[$version]:-}}
+[ -n "$commit" ] || die "no pinned commit for Fcitx5 $version. Look up the commit of its tag and pass it as FCITX_COMMIT=<sha>"
 # Commit of the yoga submodule pinned by Fcitx5 (third_party/yoga).
 yoga_commit=${YOGA_COMMIT:-042f5013152eb81c1552dec945b88f7b95ca350f}
 
+# fetch_commit <url> <dir> <commit>, leaves <dir> checked out at exactly <commit>
+fetch_commit() {
+    local url=$1 dir=$2 want=$3
+    if [ -d "$dir/.git" ] && [ "$(git -C "$dir" rev-parse HEAD 2>/dev/null)" = "$want" ]; then
+        return 0
+    fi
+    rm -rf "$dir"
+    mkdir -p "$dir"
+    git -C "$dir" init -q
+    git -C "$dir" fetch -q --depth 1 "$url" "$want" || die "could not fetch $want from $url"
+    git -C "$dir" checkout -q FETCH_HEAD
+    [ "$(git -C "$dir" rev-parse HEAD)" = "$want" ] || die "$url gave a different commit than $want"
+}
+
 srcdir=$work/fcitx5-$version
 mkdir -p "$work"
-
-if [ ! -d "$srcdir" ]; then
-    echo ">> fetching Fcitx5 $version"
-    curl -fsSL "https://github.com/fcitx/fcitx5/archive/refs/tags/$version.tar.gz" |
-        tar -xz -C "$work"
-fi
-if [ ! -f "$srcdir/third_party/yoga/yoga/CMakeLists.txt" ]; then
-    echo ">> fetching yoga $yoga_commit"
-    rm -rf "$srcdir/third_party/yoga"
-    mkdir -p "$srcdir/third_party/yoga"
-    curl -fsSL "https://github.com/facebook/yoga/archive/$yoga_commit.tar.gz" |
-        tar -xz -C "$srcdir/third_party/yoga" --strip-components=1
-fi
+echo ">> fetching Fcitx5 $version ($commit)"
+fetch_commit https://github.com/fcitx/fcitx5 "$srcdir" "$commit"
+echo ">> fetching yoga ($yoga_commit)"
+fetch_commit https://github.com/facebook/yoga "$srcdir/third_party/yoga" "$yoga_commit"
+[ -z "${FETCH_ONLY:-}" ] || { echo ">> sources are in place"; exit 0; }
 
 echo ">> overlaying m3ui"
 rm -rf "$srcdir/src/ui/m3ui"
diff --git a/scripts/enable-autostart.sh b/scripts/enable-autostart.sh
index f927541..af67144 100755
--- a/scripts/enable-autostart.sh
+++ b/scripts/enable-autostart.sh
@@ -17,6 +17,11 @@ addondir=$(dirname "$lib")
 system_addondir=$(pkg-config --variable=addondir Fcitx5Core 2>/dev/null || true)
 system_addondir=${system_addondir:-/usr/lib64/fcitx5}
 dirs="$addondir:$system_addondir"
+# The paths are written into an Exec line and a service file, refuse anything
+# that would need quoting there instead of producing a broken or surprising line.
+case $dirs in
+    *[[:space:]\"\'\\\$\`%]*) echo "unsupported characters in $dirs" >&2; exit 1 ;;
+esac
 
 autostart=$config/autostart/org.fcitx.Fcitx5.desktop
 service=$data/dbus-1/services/org.fcitx.Fcitx5.service