diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index cb0470a..7796364 100755
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -euo pipefail # exit on error, error on undef var, error on any fail in pipe (not just last cmd); add -x to print each cmd; see gist bash_strict_mode.md
+set -eo pipefail # exit on error, error on any fail in pipe (not just last cmd); add -x to print each cmd; see gist bash_strict_mode.md
 
 # Remove chromium profile lock.
 # When running in docker and then killing it, on the next run chromium displayed a dialog to unlock the profile which made the script time out.
@@ -23,7 +23,9 @@ rm -f /tmp/.X1-lock
 export DISPLAY=:1 # need to export this, otherwise playwright complains with 'Looks like you launched a headed browser without having a XServer running.'
 Xvfb $DISPLAY -ac -screen 0 "${WIDTH}x${HEIGHT}x${DEPTH}" &
 echo "Xvfb display server created screen with resolution ${WIDTH}x${HEIGHT}"
-x11vnc -display $DISPLAY -forever -shared -rfbport $VNC_PORT -bg -nopw 2>/dev/null 1>&2 # -passwd "${VNC_PASSWORD}"
+pw="-nopw"
+[ -z "$VNC_PASSWORD" ] || pw="-passwd $VNC_PASSWORD"
+x11vnc -display $DISPLAY -forever -shared -rfbport $VNC_PORT -bg $pw 2>/dev/null 1>&2
 echo "VNC is running on port $VNC_PORT (no password!)"
 websockify -D --web "/usr/share/novnc/" $NOVNC_PORT "localhost:$VNC_PORT" 2>/dev/null 1>&2 &
 echo "noVNC (VNC via browser) is running on http://localhost:$NOVNC_PORT"