diff --git a/provisionersdk/agent.go b/provisionersdk/agent.go
index b4667863ed8cb..c14a93f1a2088 100644
--- a/provisionersdk/agent.go
+++ b/provisionersdk/agent.go
@@ -1,52 +1,20 @@
 package provisionersdk
 
 import (
+	_ "embed"
 	"fmt"
 	"strings"
 )
 
 var (
-	// On Windows, VS Code Remote requires a parent process of the
-	// executing shell to be named "sshd", otherwise it fails. See:
-	// https://github.com/microsoft/vscode-remote-release/issues/5699
-	windowsScript = `$ProgressPreference = "SilentlyContinue"
-Invoke-WebRequest -Uri ${ACCESS_URL}bin/coder-windows-${ARCH}.exe -OutFile $env:TEMP\sshd.exe
-Set-MpPreference -DisableRealtimeMonitoring $true -ExclusionPath $env:TEMP\sshd.exe
-$env:CODER_AGENT_AUTH = "${AUTH_TYPE}"
-$env:CODER_AGENT_URL = "${ACCESS_URL}"
-Start-Process -FilePath $env:TEMP\sshd.exe -ArgumentList "agent" -PassThru`
-
-	linuxScript = `#!/usr/bin/env sh
-set -eux pipefail
-BINARY_DIR=$(mktemp -d -t coder.XXXXXX)
-BINARY_NAME=coder
-BINARY_URL=${ACCESS_URL}bin/coder-linux-${ARCH}
-cd $BINARY_DIR
-if command -v curl >/dev/null 2>&1; then
-	curl -fsSL --compressed "${BINARY_URL}" -o "${BINARY_NAME}"
-elif command -v wget >/dev/null 2>&1; then
-	wget -q "${BINARY_URL}" -O "${BINARY_NAME}"
-elif command -v busybox >/dev/null 2>&1; then
-	busybox wget -q "${BINARY_URL}" -O "${BINARY_NAME}"
-else
-	echo "error: no download tool found, please install curl, wget or busybox wget"
-	exit 1
-fi
-chmod +x $BINARY_NAME
-export CODER_AGENT_AUTH="${AUTH_TYPE}"
-export CODER_AGENT_URL="${ACCESS_URL}"
-exec ./$BINARY_NAME agent`
-
-	darwinScript = `#!/usr/bin/env sh
-set -eux pipefail
-BINARY_DIR=$(mktemp -d -t coder.XXXXXX)
-BINARY_NAME=coder
-cd $BINARY_DIR
-curl -fsSL --compressed "${ACCESS_URL}bin/coder-darwin-${ARCH}" -o "${BINARY_NAME}"
-chmod +x $BINARY_NAME
-export CODER_AGENT_AUTH="${AUTH_TYPE}"
-export CODER_AGENT_URL="${ACCESS_URL}"
-exec ./$BINARY_NAME agent`
+	// These used to be hard-coded, but after growing significantly more complex
+	// it made sense to put them in their own files (e.g. for linting).
+	//go:embed scripts/bootstrap_windows.ps1
+	windowsScript string
+	//go:embed scripts/bootstrap_linux.sh
+	linuxScript string
+	//go:embed scripts/bootstrap_darwin.sh
+	darwinScript string
 
 	// A mapping of operating-system ($GOOS) to architecture ($GOARCH)
 	// to agent install and run script. ${DOWNLOAD_URL} is replaced
diff --git a/provisionersdk/scripts/bootstrap_darwin.sh b/provisionersdk/scripts/bootstrap_darwin.sh
new file mode 100644
index 0000000000000..a5f1af093db72
--- /dev/null
+++ b/provisionersdk/scripts/bootstrap_darwin.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env sh
+set -eux pipefail
+BINARY_DIR=$(mktemp -d -t coder.XXXXXX)
+BINARY_NAME=coder
+cd "$BINARY_DIR"
+curl -fsSL --compressed "${ACCESS_URL}bin/coder-darwin-${ARCH}" -o "${BINARY_NAME}"
+chmod +x $BINARY_NAME
+export CODER_AGENT_AUTH="${AUTH_TYPE}"
+export CODER_AGENT_URL="${ACCESS_URL}"
+exec ./$BINARY_NAME agent
diff --git a/provisionersdk/scripts/bootstrap_linux.sh b/provisionersdk/scripts/bootstrap_linux.sh
new file mode 100644
index 0000000000000..72062aef6953f
--- /dev/null
+++ b/provisionersdk/scripts/bootstrap_linux.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env sh
+set -eux pipefail
+BINARY_DIR=$(mktemp -d -t coder.XXXXXX)
+BINARY_NAME=coder
+BINARY_URL=${ACCESS_URL}bin/coder-linux-${ARCH}
+cd "$BINARY_DIR"
+if command -v curl >/dev/null 2>&1; then
+	curl -fsSL --compressed "${BINARY_URL}" -o "${BINARY_NAME}"
+elif command -v wget >/dev/null 2>&1; then
+	wget -q "${BINARY_URL}" -O "${BINARY_NAME}"
+elif command -v busybox >/dev/null 2>&1; then
+	busybox wget -q "${BINARY_URL}" -O "${BINARY_NAME}"
+else
+	echo "error: no download tool found, please install curl, wget or busybox wget"
+	exit 1
+fi
+chmod +x $BINARY_NAME
+export CODER_AGENT_AUTH="${AUTH_TYPE}"
+export CODER_AGENT_URL="${ACCESS_URL}"
+exec ./$BINARY_NAME agent
diff --git a/provisionersdk/scripts/bootstrap_windows.ps1 b/provisionersdk/scripts/bootstrap_windows.ps1
new file mode 100644
index 0000000000000..810012155bbc4
--- /dev/null
+++ b/provisionersdk/scripts/bootstrap_windows.ps1
@@ -0,0 +1,9 @@
+# On Windows, VS Code Remote requires a parent process of the
+# executing shell to be named "sshd", otherwise it fails. See:
+# https://github.com/microsoft/vscode-remote-release/issues/5699
+$ProgressPreference = "SilentlyContinue"
+Invoke-WebRequest -Uri ${ACCESS_URL}bin/coder-windows-${ARCH}.exe -OutFile $env:TEMP\sshd.exe
+Set-MpPreference -DisableRealtimeMonitoring $true -ExclusionPath $env:TEMP\sshd.exe
+$env:CODER_AGENT_AUTH = "${AUTH_TYPE}"
+$env:CODER_AGENT_URL = "${ACCESS_URL}"
+Start-Process -FilePath $env:TEMP\sshd.exe -ArgumentList "agent" -PassThru