diff --git a/ceru/libceru.sh b/ceru/libceru.sh
index 24dca94..05e945d 100755
--- a/ceru/libceru.sh
+++ b/ceru/libceru.sh
@@ -100,6 +100,8 @@ function confirm-file-overwrite {
 	[[ "$OVERWRITE" = false ]] || confirm
 }
 
+function isnumeric { [[ "$1" =~ ^[0-9]+$ ]]; }
+
 # ====== Core ======
 function run-subcmd {
   # if CMD_MIN is empty, then CMD_MAJ is the root cmd (ie ceru)
diff --git a/ceru/subcmds/new/password b/ceru/subcmds/new/password
index ae640e7..12cc871 100755
--- a/ceru/subcmds/new/password
+++ b/ceru/subcmds/new/password
@@ -214,11 +214,9 @@ esac
 unset -f perr-unsupportedhash perr-forbiddenhash perr-recommendhash
 
 # ensure $ROUNDS is a valid numeric
-re='^[0-9]+$'
-if ! [[ "$ROUNDS" =~ ^[0-9]+$ ]] ; then
+if ! isnumeric "$ROUNDS"; then
 	throw-badval 1 "$ROUNDS" '-r|--rounds'
 fi
-unset -v re
 
 # Acquire password from stdin
 if [[ "$STDIN" == true ]]; then
diff --git a/ceru/subcmds/new/ssh-key b/ceru/subcmds/new/ssh-key
index 7e8605b..eeda49d 100755
--- a/ceru/subcmds/new/ssh-key
+++ b/ceru/subcmds/new/ssh-key
@@ -81,6 +81,10 @@ while [[ $# -gt 0 ]]; do
 done; unset -v ARG
 
 EXTRA=''
+# ensure $ROUNDS is a valid numeric
+if ! isnumeric "$ROUNDS"; then
+	throw-badval 1 "$ROUNDS" '-r|--rounds'
+fi
 
 case "$TYPE" in
 	ed25519)
@@ -93,6 +97,9 @@ case "$TYPE" in
 		;;
 esac
 
+if ! isnumeric "$BITS"; then
+	throw-badval 1 "$BITS" '-b|--bits'
+fi
 
 if [[ "$HWKEY" == true ]]; then
 	if [[ "$TYPE" == "rsa" ]]; then