diff --git a/etc/firewall.config b/etc/firewall.config
index be8f08c..4025c18 100644
--- a/etc/firewall.config
+++ b/etc/firewall.config
@@ -14,7 +14,7 @@
 
 # We make use of "[0-9]" in this config, so we need correct LC_COLLATE:
 unset LC_ALL
-LC_COLLATE=C
+export LC_COLLATE=C
 
 # In order to configure, one might need the active sshd port "$SSHPORT":
 # This port is read from /etc/ssh/sshd_config (default: "ssh")
diff --git a/sbin/firewall b/sbin/firewall
index 18f614b..98f2197 100755
--- a/sbin/firewall
+++ b/sbin/firewall
@@ -336,7 +336,7 @@ doexec=
 kernelset=:
 use_restore=:
 OPTIND=1
-while getopts '1ksSpPa:A:Hh?' opt
+while getopts '1ksSpPa:A:Hh' opt
 do	case $opt in
 	1)	use_restore=false;;
 	k)	kernelset=false;;
@@ -347,6 +347,7 @@ do	case $opt in
 	P)	PORTKNOCK=:;;
 	a)	Push ALLOWTCP "$OPTARG";;
 	A)	Push ALLOWUDP "$OPTARG";;
+	'?')	exit 1;;
 	*)	Usage 0;;
 	esac
 done
diff --git a/zsh/_firewall b/zsh/_firewall
index 864f784..8e0fc28 100644
--- a/zsh/_firewall
+++ b/zsh/_firewall
@@ -2,7 +2,7 @@
 local context state state_descr line
 typeset -A opt_args
 _arguments -s -S -A '-*' : \
-'(1 -)'{'-h','-\\?'}'[help]' \
+'(1 -)-h[help]' \
 '-k[skip calling sysctl.net]' \
 '(-S)-s[show only what would be executed]' \
 '(-s)-S[show before executing]' \