diff --git a/config.h.in b/config.h.in
index f845cc620bb4d8dd1c5e99bd23764bb196347955..70ad448897c36f38befe386e559e9a494aa52871 100644
--- a/config.h.in
+++ b/config.h.in
@@ -1,3 +1,5 @@
 #define _GNU_SOURCE
 #define G_LOG_DOMAIN "pressure-vessel"
 #mesondefine VERSION
+
+#include "subprojects/libglnx/config.h"
diff --git a/debian/gitlab-ci.yml b/debian/gitlab-ci.yml
index c0f7f4ea1cb005347674a46c5f27a667570e2297..3b47f568953206c63e282209fdebd816434929c4 100644
--- a/debian/gitlab-ci.yml
+++ b/debian/gitlab-ci.yml
@@ -50,13 +50,28 @@ build:devel:
         - |
             set -eux
 
+            apt-get -y --no-install-recommends install \
+            clang \
+            clang-tools \
+            ${NULL+}
+
             git clone \
             -b${STEAM_RUNTIME_TOOLS_GIT_BRANCH} \
             ${STEAM_RUNTIME_TOOLS_GIT_REPO} \
             subprojects/steam-runtime-tools
 
-            meson _build
+            meson --werror _build
+            ninja -C _build
+            ninja -C _build install
+            meson test --verbose -C _build
+
+            export CC=clang
+            export CXX=clang++
+
+            rm -fr _build
+            meson --werror _build
             ninja -C _build
+            ninja -C _build scan-build
             ninja -C _build install
             meson test --verbose -C _build
 
@@ -103,6 +118,7 @@ build:scout:
               --prefix="$(pwd)/_build/prefix" \
               -Dpython=python3.5 \
               -Dsrcdir=src \
+              --werror \
               _build
             ninja -C _build
             meson test --verbose -C _build
diff --git a/debian/rules b/debian/rules
index 1da344afb6a6aa5be8c53f2628ff61f8ca88b7cb..165fe78a924f2bb5d7e66de589150bf8c19375dc 100755
--- a/debian/rules
+++ b/debian/rules
@@ -7,6 +7,12 @@ export LC_ALL=C.UTF-8
 
 include /usr/share/dpkg/default.mk
 
+meson_options =
+
+ifeq ($(DEB_DISTRIBUTION),UNRELEASED)
+meson_options += --werror
+endif
+
 %:
 	dh $@
 
@@ -30,6 +36,7 @@ override_dh_auto_configure:
 		-Dpython=/usr/bin/$$python \
 		-Dsrcdir=src \
 		-Dversion=$(DEB_VERSION) \
+		$(meson_options) \
 	; then \
 		cat _build/meson-logs/meson-log.txt; \
 		exit 1; \
diff --git a/meson.build b/meson.build
index fde052ad63ba8d5b3a8fff39c25f228fec05f2f8..ba209631e207da76ddd8409786bc045d63653f70 100644
--- a/meson.build
+++ b/meson.build
@@ -21,7 +21,12 @@
 # TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 # SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-project('pressure-vessel', 'c')
+project(
+  'pressure-vessel', 'c',
+  default_options: [
+    'warning_level=2',
+  ],
+)
 
 prove = find_program('prove', required : false)
 python = find_program(get_option('python'), required : true)
@@ -43,7 +48,6 @@ warning_cflags = [
     '-Wextra',
     '-Warray-bounds',
     '-Wcast-align',
-    '-Wdeclaration-after-statement',
     '-Wdouble-promotion',
     '-Wduplicated-branches',
     '-Wduplicated-cond',
@@ -52,7 +56,6 @@ warning_cflags = [
     '-Wformat=2',
     '-Wimplicit-function-declaration',
     '-Winit-self',
-    '-Winline',
     '-Wjump-misses-init',
     '-Wlogical-op',
     '-Wmissing-declarations',
@@ -78,10 +81,13 @@ warning_cflags = [
     '-Wwrite-strings',
 ]
 no_warning_cflags = [
+    'cast-align',
     'declaration-after-statement',
     'missing-field-initializers',
+    'pedantic',
     'sign-compare',
     'unused-parameter',
+    'variadic-macros',
 ]
 # This trips some warnings in the libglnx subproject but not in
 # pressure-vessel itself
@@ -150,9 +156,13 @@ conf_data.set_quoted('VERSION', version)
 
 configure_file(
   input : 'config.h.in',
-  output : 'config.h',
+  output : '_pressure-vessel-config.h',
   configuration : conf_data,
 )
+add_project_arguments(
+  ['-include', '_pressure-vessel-config.h'],
+  language : 'c',
+)
 
 executable(
   'pressure-vessel-wrap',
diff --git a/src/bwrap.c b/src/bwrap.c
index c882decec4fb09568c65267e7383160309840353..dcd2b11b9685b9c90e8a302c5da66de3eba19029 100644
--- a/src/bwrap.c
+++ b/src/bwrap.c
@@ -17,9 +17,6 @@
  * along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "config.h"
-#include "subprojects/libglnx/config.h"
-
 #include <ftw.h>
 
 #include <gio/gio.h>
diff --git a/src/flatpak-bwrap.c b/src/flatpak-bwrap.c
index aecedf4062dd923472d517988e6f48ca9cfa681b..626e8eaa060393f43c0c589171cdbf005c9704ce 100644
--- a/src/flatpak-bwrap.c
+++ b/src/flatpak-bwrap.c
@@ -18,9 +18,6 @@
  *       Alexander Larsson <alexl@redhat.com>
  */
 
-#include "config.h"
-#include "subprojects/libglnx/config.h"
-
 #include <string.h>
 #include <fcntl.h>
 #include <stdio.h>
diff --git a/src/flatpak-run.c b/src/flatpak-run.c
index a07380b9db75d5581558be649bfdda9eab9e42d8..20c4fbcd997d5e4c8d31ca19efd349c0a4e46776 100644
--- a/src/flatpak-run.c
+++ b/src/flatpak-run.c
@@ -20,9 +20,6 @@
  * along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "config.h"
-#include "subprojects/libglnx/config.h"
-
 #include "flatpak-run-private.h"
 
 #include <sys/utsname.h>
@@ -395,7 +392,6 @@ gboolean
 flatpak_run_add_system_dbus_args (FlatpakBwrap   *app_bwrap)
 {
   const char *dbus_address = g_getenv ("DBUS_SYSTEM_BUS_ADDRESS");
-  g_autofree char *real_dbus_address = NULL;
   g_autofree char *dbus_system_socket = NULL;
 
   if (dbus_address != NULL)
diff --git a/src/flatpak-utils.c b/src/flatpak-utils.c
index 3cbc5726714f47a94c5cc2cc07eb411cf2ff1bb2..04112cdac1074a85614f1a5f6ef2a70078d83d9e 100644
--- a/src/flatpak-utils.c
+++ b/src/flatpak-utils.c
@@ -20,9 +20,6 @@
  *       Alexander Larsson <alexl@redhat.com>
  */
 
-#include "config.h"
-#include "subprojects/libglnx/config.h"
-
 #include "flatpak-utils-private.h"
 
 #include <string.h>
@@ -40,6 +37,10 @@
 #include <sys/ioctl.h>
 #include <termios.h>
 
+/* To keep this more similar to the original file, we explicitly disable
+ * this warning rather than fixing it */
+#pragma GCC diagnostic ignored "-Wshadow"
+
 #define RUNNING_ON_VALGRIND 0
 
 /* Sometimes this is /var/run which is a symlink, causing weird issues when we pass
diff --git a/src/glib-backports.c b/src/glib-backports.c
index a2220296af40033ad7895c78b7c618c193aa4a27..477c421a1e965ade4ffd782bc793819f46ff2d5f 100644
--- a/src/glib-backports.c
+++ b/src/glib-backports.c
@@ -22,7 +22,6 @@
  * along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "config.h"
 #include "glib-backports.h"
 
 #include <errno.h>
diff --git a/src/try-setlocale.c b/src/try-setlocale.c
index 3077ab9a1eafeaa04977d5582baeee88b024afca..2204fe19e7f1b1429781f63c1c154ef03cb330a5 100644
--- a/src/try-setlocale.c
+++ b/src/try-setlocale.c
@@ -23,8 +23,6 @@
  * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
 
-#include "config.h"
-
 #include <errno.h>
 #include <getopt.h>
 #include <locale.h>
diff --git a/src/utils.c b/src/utils.c
index ab3ab24745ad1ac64a061f60a9f207b5c313cd45..1076a78ecbf001d3732a7f59be449f477815808f 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -20,8 +20,6 @@
  * License along with this library. If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "config.h"
-#include "subprojects/libglnx/config.h"
 #include "utils.h"
 
 #include <glib.h>
diff --git a/src/wrap-interactive.c b/src/wrap-interactive.c
index 9aa931a841983d889e221bbc058ebd1a290a87c9..946f3a98e509bb35618fec427ebbccd3a57adc1d 100644
--- a/src/wrap-interactive.c
+++ b/src/wrap-interactive.c
@@ -17,9 +17,6 @@
  * along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "config.h"
-#include "subprojects/libglnx/config.h"
-
 #include "wrap-interactive.h"
 
 #include <fcntl.h>
diff --git a/src/wrap.c b/src/wrap.c
index 018cc4a1947e91973b8656a4b0820c34994c9336..4bbf8470a1c62d7c8c3d4a02327cd0ece236526c 100644
--- a/src/wrap.c
+++ b/src/wrap.c
@@ -22,9 +22,6 @@
  * License along with this library. If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "config.h"
-#include "subprojects/libglnx/config.h"
-
 #include <glib.h>
 #include <glib/gstdio.h>
 #include <gio/gio.h>
@@ -103,7 +100,6 @@ find_bwrap (const char *tools_dir)
   };
   const char *tmp;
   g_autofree gchar *candidate = NULL;
-  g_autofree gchar *dirname = NULL;
   gsize i;
 
   g_return_val_if_fail (tools_dir != NULL, NULL);
@@ -671,7 +667,6 @@ bind_runtime (FlatpakBwrap *bwrap,
     NULL
   };
   g_autofree gchar *xrd = g_strdup_printf ("/run/user/%ld", (long) geteuid ());
-  g_autofree gchar *usr = NULL;
   gsize i, j;
   const gchar *member;
   g_autoptr(GString) dri_path = g_string_new ("");
@@ -697,8 +692,6 @@ bind_runtime (FlatpakBwrap *bwrap,
   g_return_val_if_fail (scratch != NULL, FALSE);
   g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
 
-  usr = g_build_filename (runtime, "usr", NULL);
-
   if (!pv_bwrap_bind_usr (bwrap, runtime, "/", error))
     return FALSE;
 
@@ -1445,21 +1438,21 @@ bind_runtime (FlatpakBwrap *bwrap,
    */
   if (g_file_test ("/etc/localtime", G_FILE_TEST_EXISTS))
     {
-      g_autofree char *localtime = NULL;
+      g_autofree char *target = NULL;
       gboolean is_reachable = FALSE;
-      g_autofree char *timezone = flatpak_get_timezone ();
-      g_autofree char *timezone_content = g_strdup_printf ("%s\n", timezone);
+      g_autofree char *tz = flatpak_get_timezone ();
+      g_autofree char *timezone_content = g_strdup_printf ("%s\n", tz);
 
-      localtime = glnx_readlinkat_malloc (-1, "/etc/localtime", NULL, NULL);
+      target = glnx_readlinkat_malloc (-1, "/etc/localtime", NULL, NULL);
 
-      if (localtime != NULL)
+      if (target != NULL)
         {
           g_autoptr(GFile) base_file = NULL;
           g_autoptr(GFile) target_file = NULL;
           g_autofree char *target_canonical = NULL;
 
           base_file = g_file_new_for_path ("/etc");
-          target_file = g_file_resolve_relative_path (base_file, localtime);
+          target_file = g_file_resolve_relative_path (base_file, target);
           target_canonical = g_file_get_path (target_file);
 
           is_reachable = g_str_has_prefix (target_canonical, "/usr/");
@@ -1468,7 +1461,7 @@ bind_runtime (FlatpakBwrap *bwrap,
       if (is_reachable)
         {
           flatpak_bwrap_add_args (bwrap,
-                                  "--symlink", localtime, "/etc/localtime",
+                                  "--symlink", target, "/etc/localtime",
                                   NULL);
         }
       else
@@ -2171,7 +2164,7 @@ main (int argc,
         {
           g_autofree gchar *quoted = g_shell_quote (env[i]);
 
-          g_message ("\t%s", env[i]);
+          g_message ("\t%s", quoted);
         }
 
       g_message ("Wrapped command:");