diff --git a/usr/bin/archboot-pacsetup.sh b/usr/bin/archboot-pacsetup.sh
index 58c2d706f..0cfc43255 100755
--- a/usr/bin/archboot-pacsetup.sh
+++ b/usr/bin/archboot-pacsetup.sh
@@ -72,7 +72,7 @@ _enable_testing() {
 
 _task_pacman_keyring_install() {
     _pacman_keyring
-    #shellcheck disable=SC2086
+    #shellcheck disable=SC2068
     pacman -Sy --noconfirm --noprogressbar ${_KEYRING[@]} &>"${_LOG}"
     rm /.archboot
 }
diff --git a/usr/bin/archboot-quickinst.sh b/usr/bin/archboot-quickinst.sh
index e29967999..7a14ef60f 100755
--- a/usr/bin/archboot-quickinst.sh
+++ b/usr/bin/archboot-quickinst.sh
@@ -36,7 +36,7 @@ _prepare_pacman() {
     fi
     _pacman_keyring
     ${_PACMAN} -Sy
-    #shellcheck disable=SC2086
+    #shellcheck disable=SC2086,SC2068
     pacman -Sy ${_PACMAN_CONF} --noconfirm --noprogressbar ${_KEYRING[@]} || exit 1
 }
 
@@ -44,7 +44,7 @@ _prepare_pacman() {
 _install_packages() {
     . /etc/archboot/defaults
     _auto_packages
-    #shellcheck disable=SC2086
+    #shellcheck disable=SC2068
     ${_PACMAN} -S ${_PACKAGES[@]}
 }
 
diff --git a/usr/bin/archboot-server-update.sh b/usr/bin/archboot-server-update.sh
index 994ed8b8f..3a222cef6 100755
--- a/usr/bin/archboot-server-update.sh
+++ b/usr/bin/archboot-server-update.sh
@@ -30,6 +30,7 @@ for i in ${_SERVER_ARCH}; do
     # update container to latest packages
     systemd-nspawn -q -D "${i}" pacman --noconfirm -Syu
     rg -o 'upgraded (.*) \(' -r '$1' "${i}"/var/log/pacman.log > upgrade-"${i}".log
+    #shellcheck disable=SC2068
     for k in ${_TRIGGER[@]}; do
         # if trigger successful, release new image to server
         if rg -qw "${k}" upgrade-"${i}".log; then
diff --git a/usr/lib/archboot/common.sh b/usr/lib/archboot/common.sh
index a382941cf..03fd465f2 100644
--- a/usr/lib/archboot/common.sh
+++ b/usr/lib/archboot/common.sh
@@ -7,15 +7,15 @@ _CACHEDIR="/var/cache/pacman/pkg"
 _CONFIG_DIR="/etc/archboot"
 _DLPROG="curl -L -s"
 _FIX_PACKAGES=(
+  gcc-libs
+  glib2
+  glibc
+  icu
   libelf
   libevent
-  talloc
-  gcc-libs
-  glibc
-  glib2
-  icu
-  pcre2
   nss
+  pcre2
+  talloc
   terminus-font
 )
 _INTEL_UCODE="boot/intel-ucode.img"
@@ -42,9 +42,9 @@ _RUNNING_KERNEL="$(uname -r)"
 _SPLASH="/usr/share/archboot/uki/archboot-background.bmp"
 _STANDARD_PACKAGES=(
   gparted
-  xorg-xhost
   mtools
   noto-fonts
+  xorg-xhost
 )
 _VNC_PACKAGE="tigervnc"
 _WAYLAND_PACKAGE="egl-wayland"
@@ -56,7 +56,7 @@ _VC_NUM="${_LOG/\/dev\/tty/}"
 _VC="VC${_VC_NUM}"
 if echo "${_BASENAME}" | rg -qw aarch64; then
     _ARCHBOOT="archboot-arm"
-    _KEYRING+="archlinuxarm-keyring"
+    _KEYRING+=(archlinuxarm-keyring)
     _ARCH="aarch64"
 elif echo "${_BASENAME}" | rg -qw riscv64; then
     _ARCHBOOT="archboot-riscv"
diff --git a/usr/lib/archboot/container.sh b/usr/lib/archboot/container.sh
index 22fc93b63..4e6117a21 100644
--- a/usr/lib/archboot/container.sh
+++ b/usr/lib/archboot/container.sh
@@ -94,7 +94,7 @@ _prepare_pacman() {
     echo "Removing Archboot repository sync db..."
     rm -f "${_PACMAN_LIB}"/sync/archboot.db
     echo "Updating Arch Linux keyring..."
-    #shellcheck disable=SC2086
+    #shellcheck disable=SC2086,SC2068
     pacman -Sy --config ${_PACMAN_CONF} --noconfirm --noprogressbar ${_KEYRING[@]} &>"${_NO_LOG}"
 }
 
@@ -160,27 +160,29 @@ _install_base_packages() {
         _MKINITCPIO=initramfs
     fi
     if [[ "${2}" == "use_binfmt" ]]; then
+        #shellcheck disable=SC2068,SC2145
         echo "Downloading ${_KEYRING[@]} ${_PACKAGES[@]} to ${1}..."
         if rg -qw 'archboot' /etc/hostname; then
-            #shellcheck disable=SC2086
+            #shellcheck disable=SC2086,SC2068
             ${_PACMAN} -Syw ${_KEYRING[@]} ${_PACKAGES[@]} ${_PACMAN_DEFAULTS} \
                         ${_PACMAN_DB} &>"${_LOG}" || exit 1
         else
-            #shellcheck disable=SC2086
+            #shellcheck disable=SC2086,SC2068
             ${_PACMAN} -Syw ${_KEYRING[@]} ${_PACKAGES[@]} ${_PACMAN_DEFAULTS} \
                        ${_PACMAN_DB} &>"${_NO_LOG}" || exit 1
         fi
     fi
+    #shellcheck disable=SC2068,SC2145
     echo "Installing ${_KEYRING[@]} ${_PACKAGES[@]} to ${1}..."
     if rg -qw 'archboot' /etc/hostname; then
-        #shellcheck disable=SC2086
+        #shellcheck disable=SC2086,SC2068
         ${_PACMAN} -Sy --assume-installed ${_MKINITCPIO} ${_KEYRING[@]} ${_PACKAGES[@]} \
                    ${_PACMAN_DEFAULTS} &>"${_LOG}" || exit 1
         echo "Downloading mkinitcpio to ${1}..."
         #shellcheck disable=SC2086
         ${_PACMAN} -Syw mkinitcpio ${_PACMAN_DEFAULTS} >"${_LOG}" 2>&1 || exit 1
     else
-        #shellcheck disable=SC2086
+        #shellcheck disable=SC2086,SC2068
         ${_PACMAN} -Sy --assume-installed ${_MKINITCPIO} ${_KEYRING[@]} ${_PACKAGES[@]} \
                    ${_PACMAN_DEFAULTS} &>"${_NO_LOG}" || exit 1
         echo "Downloading mkinitcpio to ${1}..."
@@ -199,15 +201,17 @@ _install_archboot() {
     if rg -qw 'archboot' /etc/hostname; then
         #shellcheck disable=SC2086
         ${_PACMAN} -Sy ${_ARCHBOOT} ${_PACMAN_DEFAULTS} &>"${_LOG}" || exit 1
+        #shellcheck disable=SC2145
         echo "Downloading ${_MAN_INFO_PACKAGES[@]} to ${1}..."
-        #shellcheck disable=SC2086
+        #shellcheck disable=SC2086,SC2068
         ${_PACMAN} -Syw ${_MAN_INFO_PACKAGES[@]} ${_PACMAN_DEFAULTS} \
                    ${_PACMAN_DB} &>"${_LOG}" || exit 1
     else
         #shellcheck disable=SC2086
         ${_PACMAN} -Sy ${_ARCHBOOT} ${_PACMAN_DEFAULTS} &>"${_NO_LOG}" || exit 1
+        #shellcheck disable=SC2145
         echo "Downloading ${_MAN_INFO_PACKAGES[@]} to ${1}..."
-        #shellcheck disable=SC2086
+        #shellcheck disable=SC2086,SC2068
         ${_PACMAN} -Syw ${_MAN_INFO_PACKAGES[@]} ${_PACMAN_DEFAULTS} \
                    ${_PACMAN_DB} &>"${_NO_LOG}" || exit 1
     fi
diff --git a/usr/lib/archboot/installer/base.sh b/usr/lib/archboot/installer/base.sh
index b2048001e..110c80af7 100644
--- a/usr/lib/archboot/installer/base.sh
+++ b/usr/lib/archboot/installer/base.sh
@@ -34,6 +34,7 @@ _geteditor() {
             "NANO") _EDITOR="nano"
                 if ! [[ -f "${_DESTDIR}/usr/bin/nano" ]]; then
                     _PACKAGES=(nano)
+                    #shellcheck disable=SC2145
                     _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " --gauge "Installing package(s):\n${_PACKAGES[@]}..." 7 75 0
                     _pacman_error
                     _dialog --no-mouse --title " Autoconfiguration " --infobox "Enable nano's syntax highlighting on installed system..." 3 70
@@ -45,6 +46,7 @@ _geteditor() {
             "NEOVIM") _EDITOR="nvim"
                 if ! [[ -f "${_DESTDIR}/usr/bin/nvim" ]]; then
                     _PACKAGES=(neovim)
+                    #shellcheck disable=SC2145
                     _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " --gauge "Installing package(s):\n${_PACKAGES[@]}..." 7 75 0
                     _pacman_error
                 fi
diff --git a/usr/lib/archboot/installer/bootloader.sh b/usr/lib/archboot/installer/bootloader.sh
index 97aa7b22e..7e18d6369 100644
--- a/usr/lib/archboot/installer/bootloader.sh
+++ b/usr/lib/archboot/installer/bootloader.sh
@@ -133,14 +133,16 @@ _uefi_common() {
     _PACKAGES=()
     _DEV=""
     _BOOTDEV=""
-    [[ -f "${_DESTDIR}/usr/bin/mkfs.vfat" ]] || _PACKAGES+="dosfstools"
-    [[ -f "${_DESTDIR}/usr/bin/efivar" ]] || _PACKAGES+="efivar"
-    [[ -f "${_DESTDIR}/usr/bin/efibootmgr" ]] || _PACKAGES+="efibootmgr"
+    [[ -f "${_DESTDIR}/usr/bin/mkfs.vfat" ]] || _PACKAGES+=(dosfstools)
+    [[ -f "${_DESTDIR}/usr/bin/efivar" ]] || _PACKAGES+=(efivar)
+    [[ -f "${_DESTDIR}/usr/bin/efibootmgr" ]] || _PACKAGES+=(efibootmgr)
     if [[ -n "${_UEFI_SECURE_BOOT}" ]]; then
-        [[ -f "${_DESTDIR}/usr/bin/mokutil" ]] || _PACKAGES+="mokutil"
-        [[ -f "${_DESTDIR}/usr/bin/sbsign" ]] || _PACKAGES+="sbsigntools"
+        [[ -f "${_DESTDIR}/usr/bin/mokutil" ]] || _PACKAGES+=(mokutil)
+        [[ -f "${_DESTDIR}/usr/bin/sbsign" ]] || _PACKAGES+=(sbsigntools)
     fi
-    if [[ -n "${_PACKAGES[@]}" ]]; then
+    #shellcheck disable=SC2128
+    if [[ -n "${_PACKAGES}" ]]; then
+        #shellcheck disable=SC2145
         _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " --gauge "Installing package(s):\n${_PACKAGES[@]}..." 7 75 0
         _pacman_error
     fi
@@ -244,7 +246,9 @@ _install_bootloader() {
     fi
     if [[ -n "${_UCODE}" ]]; then
         if ! [[ -f "${_DESTDIR}/boot/${_UCODE}" ]]; then
+            #shellcheck disable=SC2206
             _PACKAGES=(${_UCODE_PKG})
+            #shellcheck disable=SC2145
             _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " --gauge "Installing package(s):\n${_PACKAGES[@]}..." 7 75 0
             _pacman_error
         fi
diff --git a/usr/lib/archboot/installer/bootloader_grub.sh b/usr/lib/archboot/installer/bootloader_grub.sh
index 8b6933982..698596289 100644
--- a/usr/lib/archboot/installer/bootloader_grub.sh
+++ b/usr/lib/archboot/installer/bootloader_grub.sh
@@ -27,11 +27,13 @@ _grub_common_before() {
     _abort_bcachefs_bootpart || return 1
     if [[ ! -d "${_DESTDIR}/usr/lib/grub" ]]; then
         _PACKAGES=(grub)
+        #shellcheck disable=SC2145
         _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " --gauge "Installing package(s):\n${_PACKAGES[@]}..." 7 75 0
         _pacman_error
     fi
     if [[ ! -f "${_DESTDIR}/usr/share/grub/ter-u16n.pf2" ]]; then
         _PACKAGES=(terminus-font)
+        #shellcheck disable=SC2145
         _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " --gauge "Installing package(s):\n${_PACKAGES[@]}..." 7 75 0
         _pacman_error
     fi
diff --git a/usr/lib/archboot/installer/bootloader_limine.sh b/usr/lib/archboot/installer/bootloader_limine.sh
index 8a2b223fa..22c9a2c6a 100644
--- a/usr/lib/archboot/installer/bootloader_limine.sh
+++ b/usr/lib/archboot/installer/bootloader_limine.sh
@@ -4,6 +4,7 @@
 _limine_common() {
     if [[ ! -f "${_DESTDIR}/usr/bin/limine" ]]; then
         _PACKAGES=(limine)
+        #shellcheck disable=SC2145
         _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " --gauge "Installing package(s):\n${_PACKAGES[@]}..." 7 75 0
         _pacman_error
     fi
diff --git a/usr/lib/archboot/installer/bootloader_refind.sh b/usr/lib/archboot/installer/bootloader_refind.sh
index d43a8e529..c0c660673 100644
--- a/usr/lib/archboot/installer/bootloader_refind.sh
+++ b/usr/lib/archboot/installer/bootloader_refind.sh
@@ -4,6 +4,7 @@
 _refind_uefi() {
     if [[ ! -f "${_DESTDIR}/usr/bin/refind-install" ]]; then
         _PACKAGES=(refind)
+        #shellcheck disable=SC2145
         _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " --gauge "Installing package(s):\n${_PACKAGES[@]}..." 7 75 0
         _pacman_error
     fi
diff --git a/usr/lib/archboot/installer/bootloader_uki.sh b/usr/lib/archboot/installer/bootloader_uki.sh
index 9c8979692..6962d3be6 100644
--- a/usr/lib/archboot/installer/bootloader_uki.sh
+++ b/usr/lib/archboot/installer/bootloader_uki.sh
@@ -37,6 +37,7 @@ _uki_install() {
 _uki_uefi() {
     if [[ ! -f "${_DESTDIR}/usr/lib/systemd/ukify" ]]; then
         _PACKAGES=(systemd-ukify)
+        #shellcheck disable=SC2145
         _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " --gauge "Installing package(s):\n${_PACKAGES[@]}..." 7 75 0
         _pacman_error
     fi
diff --git a/usr/lib/archboot/installer/common.sh b/usr/lib/archboot/installer/common.sh
index 188eb32ac..cbdcaeef9 100644
--- a/usr/lib/archboot/installer/common.sh
+++ b/usr/lib/archboot/installer/common.sh
@@ -30,11 +30,12 @@ fi
 _PACMAN="pacman --root ${_DESTDIR} --cachedir=${_DESTDIR}${_CACHEDIR} --noconfirm"
 
 _linux_firmware() {
-    _PACKAGES="${_PACKAGES[@]//linux-firmware/}"
+    #shellcheck disable=SC2206
+    _PACKAGES=(${_PACKAGES[@]//linux-firmware/})
     #shellcheck disable=SC2013
     for i in $(choose 0 </proc/modules); do
         if modinfo "${i}" | rg -qw 'firmware:'; then
-            _PACKAGES+="linux-firmware"
+            _PACKAGES+=(linux-firmware)
             break
         fi
     done
@@ -42,14 +43,15 @@ _linux_firmware() {
 
 _marvell_firmware() {
     _MARVELL=""
-    _PACKAGES="${_PACKAGES[@]//linux-firmware-marvell/}"
+    #shellcheck disable=SC2206
+    _PACKAGES=(${_PACKAGES[@]//linux-firmware-marvell/})
     for i in $(fd -t f . /lib/modules/"${_RUNNING_KERNEL}" | rg -w 'wireless/marvell'); do
         _MARVELL="${_MARVELL} $(basename "${i}" | sd '.ko.*$' '')"
     done
     # check marvell modules if already loaded
     for i in ${_MARVELL}; do
         if lsmod | rg -qw "${i}"; then
-            _PACKAGES+="linux-firmware-marvell"
+            _PACKAGES+=(linux-firmware-marvell)
             break
         fi
     done
@@ -98,40 +100,40 @@ _local_pacman_conf() {
 _auto_packages() {
     # Add filesystem packages
     if ${_LSBLK} FSTYPE | rg -q 'bcachefs'; then
-        ! echo "${_PACKAGES[@]}" | rg -qw 'bcachefs-tools' && _PACKAGES+="bcachefs-tools"
+        ! echo "${_PACKAGES[@]}" | rg -qw 'bcachefs-tools' && _PACKAGES+=(bcachefs-tools)
     fi
     if ${_LSBLK} FSTYPE | rg -q 'btrfs'; then
-        ! echo "${_PACKAGES[@]}" | rg -qw 'btrfs-progs' && _PACKAGES+="btrfs-progs"
+        ! echo "${_PACKAGES[@]}" | rg -qw 'btrfs-progs' && _PACKAGES+=(btrfs-progs)
     fi
     if ${_LSBLK} FSTYPE | rg -q 'ext'; then
-        ! echo "${_PACKAGES[@]}" | rg -qw 'e2fsprogs' && _PACKAGES+="e2fsprogs"
+        ! echo "${_PACKAGES[@]}" | rg -qw 'e2fsprogs' && _PACKAGES+=(e2fsprogs)
     fi
     if ${_LSBLK} FSTYPE | rg -q 'xfs'; then
-        ! echo "${_PACKAGES[@]}" | rg -qw 'xfsprogs' && _PACKAGES+="xfsprogs"
+        ! echo "${_PACKAGES[@]}" | rg -qw 'xfsprogs' && _PACKAGES+=(xfsprogs)
     fi
     if ${_LSBLK} FSTYPE | rg -q 'vfat'; then
-        ! echo "${_PACKAGES[@]}" | rg -qw 'dosfstools' && _PACKAGES+="dosfstools"
+        ! echo "${_PACKAGES[@]}" | rg -qw 'dosfstools' && _PACKAGES+=(dosfstools)
     fi
     # Add packages for complex blockdevices
     if ${_LSBLK} FSTYPE | rg -qw 'linux_raid_member'; then
-        ! echo "${_PACKAGES[@]}" | rg -qw 'mdadm' && _PACKAGES+="mdadm"
+        ! echo "${_PACKAGES[@]}" | rg -qw 'mdadm' && _PACKAGES+=(mdadm)
     fi
     if ${_LSBLK} FSTYPE | rg -qw 'LVM2_member'; then
-        ! echo "${_PACKAGES[@]}" | rg -qw 'lvm2' && _PACKAGES+="lvm2"
+        ! echo "${_PACKAGES[@]}" | rg -qw 'lvm2' && _PACKAGES+=(lvm2)
     fi
     if ${_LSBLK} FSTYPE | rg -qw 'crypto_LUKS'; then
-        ! echo "${_PACKAGES[@]}" | rg -qw 'cryptsetup' && _PACKAGES+="cryptsetup"
+        ! echo "${_PACKAGES[@]}" | rg -qw 'cryptsetup' && _PACKAGES+=(cryptsetup)
     fi
     #shellcheck disable=SC2010
     # Add iwd, if wlan is detected
     if fd . /sys/class/net | rg -q 'wlan'; then
-        ! echo "${_PACKAGES[@]}" | rg -qw 'iwd' && _PACKAGES+="iwd"
+        ! echo "${_PACKAGES[@]}" | rg -qw 'iwd' && _PACKAGES+=(iwd)
     fi
     # Add broadcom-wl, if module is detected
     if lsmod | rg -qw 'wl'; then
-        ! echo "${_PACKAGES[@]}" | rg -qw 'broadcom-wl' && _PACKAGES+="broadcom-wl"
+        ! echo "${_PACKAGES[@]}" | rg -qw 'broadcom-wl' && _PACKAGES+=(broadcom-wl)
     fi
-    rg -q '^FONT=ter' /etc/vconsole.conf && _PACKAGES+="terminus-font"
+    rg -q '^FONT=ter' /etc/vconsole.conf && _PACKAGES+=(terminus-font)
     # only add firmware if already used
     _linux_firmware
     _marvell_firmware
diff --git a/usr/lib/archboot/installer/configuration.sh b/usr/lib/archboot/installer/configuration.sh
index 5cad73108..d594be897 100644
--- a/usr/lib/archboot/installer/configuration.sh
+++ b/usr/lib/archboot/installer/configuration.sh
@@ -142,6 +142,7 @@ _user_management() {
                         "BASH") _SHELL="bash"
                                 if ! [[ -f "${_DESTDIR}/usr/share/bash-completion/completions/arch" ]]; then
                                     _PACKAGES=(bash-completion)
+                                    #shellcheck disable=SC2145
                                     _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " \
                                         --gauge "Installing package(s):\n${_PACKAGES[@]}..." 7 75 0
                                     _pacman_error
@@ -149,6 +150,7 @@ _user_management() {
                         "ZSH") _SHELL="zsh"
                                 if ! [[ -f "${_DESTDIR}/usr/bin/zsh" ]]; then
                                     _PACKAGES=(grml-zsh-config)
+                                    #shellcheck disable=SC2145
                                     _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " \
                                         --gauge "Installing package(s):\n${_PACKAGES[@]}..." 7 75 0
                                     _pacman_error
diff --git a/usr/lib/archboot/installer/pacman.sh b/usr/lib/archboot/installer/pacman.sh
index 34612ffbd..eb5c661a2 100644
--- a/usr/lib/archboot/installer/pacman.sh
+++ b/usr/lib/archboot/installer/pacman.sh
@@ -4,7 +4,7 @@
 
 
 _pacman() {
-    #shellcheck disable=SC2086,SC2069
+    #shellcheck disable=SC2086,SC2068
     ${_PACMAN} -Sy ${_PACKAGES[@]} &>"${_LOG}" && : > /tmp/.pacman-success
     rm /.archboot
 }
@@ -16,6 +16,7 @@ _run_pacman(){
     [[ ! -d "${_DESTDIR}${_PACMAN_LIB}" ]] && mkdir -p "${_DESTDIR}${_PACMAN_LIB}"
     : > /.archboot
     _pacman &
+     #shellcheck disable=SC2145
     _progress_wait "0" "99" "Installing package(s):\n${_PACKAGES[@]}..." "2"
     # pacman finished, display scrollable output
     if [[ -e "/tmp/.pacman-success" ]]; then
@@ -62,9 +63,11 @@ _run_autoconfig() {
 _install_packages() {
     _destdir_mounts || return 1
     # add packages from Archboot defaults
-    . /etc/arhboot/defaults
+    . /etc/archboot/defaults
     _auto_packages
+    #shellcheck disable=SC2145
     _dialog --title " Summary " --yesno "Next step will install the following packages for a minimal system:\n${_PACKAGES[@]}\n\nYou can watch the progress on your ${_VC} console." 9 75 || return 1
+    #shellcheck disable=SC2145
     _run_pacman | _dialog --title " Logging to ${_VC} | ${_LOG} " --gauge "Installing package(s):\n${_PACKAGES[@]}..." 8 75 0
     _pacman_error || return 1
     _NEXTITEM=3
diff --git a/usr/lib/archboot/login.sh b/usr/lib/archboot/login.sh
index 482238dca..276be1029 100644
--- a/usr/lib/archboot/login.sh
+++ b/usr/lib/archboot/login.sh
@@ -137,7 +137,7 @@ _run_autorun() {
         echo "Waiting for pacman keyring..."
         _pacman_keyring
         echo "Updating pacman keyring..."
-        #shellcheck disable=SC2086
+        #shellcheck disable=SC2086,SC2068
         pacman -Sy --noconfirm ${_KEYRING[@]} &>"${_LOG}"
         chmod 755 /etc/archboot/run/autorun.sh
         echo "Running custom autorun.sh..."
diff --git a/usr/lib/archboot/repository.sh b/usr/lib/archboot/repository.sh
index 7bdde9f64..8911a81ae 100644
--- a/usr/lib/archboot/repository.sh
+++ b/usr/lib/archboot/repository.sh
@@ -19,9 +19,11 @@ _download_packages() {
     else
         _pacman_key_system
     fi
-    _PACKAGES+="${_KEYRING[@]} ${_ARCHBOOT} ${_MAN_INFO_PACKAGES[@]}"
+    #shellcheck disable=SC2206
+    _PACKAGES+=(${_KEYRING[@]} ${_ARCHBOOT} ${_MAN_INFO_PACKAGES[@]})
+    #shellcheck disable=SC2145
     echo "Downloading ${_PACKAGES[@]} to ${1}..."
-    #shellcheck disable=SC2086
+    #shellcheck disable=SC2086,SC2068
     ${_PACMAN} -Syw ${_PACKAGES[@]} ${_PACMAN_DEFAULTS} ${_PACMAN_DB} &>"${_NO_LOG}" || exit 1
 }
 
diff --git a/usr/lib/archboot/run/container-tarball.sh b/usr/lib/archboot/run/container-tarball.sh
index 3e9a6976e..c05572b8f 100755
--- a/usr/lib/archboot/run/container-tarball.sh
+++ b/usr/lib/archboot/run/container-tarball.sh
@@ -50,7 +50,7 @@ _fix_network "${1}"
 # update container to latest packages
 echo "Installing pacman to container..."
 mkdir -p "${1}/${_PACMAN_ARCH}${_PACMAN_LIB}"
-#shellcheck disable=SC2086
+#shellcheck disable=SC2068
 systemd-nspawn -D "${1}" pacman --root "/${_PACMAN_ARCH}" -Sy awk ${_KEYRING[@]} \
                --ignore systemd-resolvconf --noconfirm &>"${_NO_LOG}"
 _generate_keyring "${1}/${_PACMAN_ARCH}" || exit 1
diff --git a/usr/lib/archboot/uki.sh b/usr/lib/archboot/uki.sh
index 199fd5163..d6806814f 100644
--- a/usr/lib/archboot/uki.sh
+++ b/usr/lib/archboot/uki.sh
@@ -59,7 +59,7 @@ _prepare_initramfs() {
 
 _systemd_ukify() {
     echo "Generating ${_ARCH} UKI image..."
-    [[ -n "/${_INTEL_UCODE}" ]] && _INTEL_UCODE="--initrd=/${_INTEL_UCODE}"
+    [[ -n "${_INTEL_UCODE}" ]] && _INTEL_UCODE="--initrd=/${_INTEL_UCODE}"
     _AMD_UCODE="--initrd=/${_AMD_UCODE}"
     #shellcheck disable=SC2086
     /usr/lib/systemd/ukify build --linux="${_KERNEL}" \
diff --git a/usr/lib/archboot/update/desktop.sh b/usr/lib/archboot/update/desktop.sh
index 25e00069b..1583bd2db 100644
--- a/usr/lib/archboot/update/desktop.sh
+++ b/usr/lib/archboot/update/desktop.sh
@@ -35,12 +35,14 @@ _run_pacman() {
 
 _update_packages() {
 _IGNORE=()
-    if [[ -n "${_GRAPHIC_IGNORE[@]}" ]]; then
+    if [[ -n "${_GRAPHIC_IGNORE}" ]]; then
+        #shellcheck disable=SC2068
         for i in ${_GRAPHIC_IGNORE[@]}; do
-            _IGNORE+="--ignore ${i}"
+            #shellcheck disable=SC2206
+            _IGNORE+=(--ignore ${i})
         done
     fi
-    #shellcheck disable=SC2086
+    #shellcheck disable=SC2086,SC2068
     LC_ALL=C.UTF-8 pacman -Syu ${_IGNORE[@]} --noconfirm &>"${_LOG}"
     if [[ ! -e "/.full_system" ]]; then
         _cleanup
@@ -127,11 +129,13 @@ _custom_wayland_xorg() {
     if [[ -n "${_CUSTOM_WL}" ]]; then
         echo -e "\e[1mStep 1/2:\e[m Installing custom wayland..."
         echo "          This will need some time..."
+        #shellcheck disable=SC2145
         _prepare_graphic "${_WAYLAND_PACKAGE} ${_CUSTOM_WAYLAND[@]}" > "${_LOG}" 2>&1
     fi
     if [[ -n "${_CUSTOM_X}" ]]; then
         echo -e "\e[1mStep 1/2:\e[m Installing custom xorg..."
         echo "          This will need some time..."
+        #shellcheck disable=SC2145
         _prepare_graphic "${_XORG_PACKAGE} ${_CUSTOM_XORG[@]}" > "${_LOG}" 2>&1
     fi
     echo -e "\e[1mStep 2/2:\e[m Setting up browser...\e[m"
diff --git a/usr/lib/archboot/update/gnome.sh b/usr/lib/archboot/update/gnome.sh
index 0d14eb909..4301cd8d4 100644
--- a/usr/lib/archboot/update/gnome.sh
+++ b/usr/lib/archboot/update/gnome.sh
@@ -35,6 +35,7 @@ _prepare_gnome() {
 }
 
 _install_gnome() {
+    #shellcheck disable=SC2206
     _PACKAGES=(${_WAYLAND_PACKAGE} ${_STANDARD_PACKAGES[@]} ${_GNOME_PACKAGES[@]})
     _prepare_gnome
 }
diff --git a/usr/lib/archboot/update/manage.sh b/usr/lib/archboot/update/manage.sh
index a29d4c22e..da3c54af7 100644
--- a/usr/lib/archboot/update/manage.sh
+++ b/usr/lib/archboot/update/manage.sh
@@ -306,6 +306,7 @@ _new_environment() {
 _full_system() {
     _progress "1" "Refreshing pacman package database..."
     pacman -Sy >"${_LOG}" 2>&1 || exit 1
+    #shellcheck disable=SC2207
     _PACKAGES=($(pacman -Qqn))
     _COUNT=0
     _PACKAGE_COUNT="$(pacman -Qqn | wc -l)"
@@ -314,6 +315,7 @@ _full_system() {
     else
         _MKINITCPIO="initramfs"
     fi
+    #shellcheck disable=SC2068
     for i in ${_PACKAGES[@]}; do
         if [[ "$((_COUNT*100/_PACKAGE_COUNT-4))" -gt 1 ]]; then
             _progress "$((_COUNT*100/_PACKAGE_COUNT-4))" "Reinstalling all packages, installing ${i} now..."
diff --git a/usr/lib/archboot/update/plasma.sh b/usr/lib/archboot/update/plasma.sh
index e66ead712..92b70ff90 100644
--- a/usr/lib/archboot/update/plasma.sh
+++ b/usr/lib/archboot/update/plasma.sh
@@ -70,6 +70,7 @@ _prepare_plasma() {
 }
 
 _install_plasma() {
+	#shellcheck disable=SC2206
     _PACKAGES=(${_WAYLAND_PACKAGE} ${_STANDARD_PACKAGES[@]} ${_PLASMA_PACKAGES[@]})
     _prepare_plasma
 }
diff --git a/usr/lib/archboot/update/sway.sh b/usr/lib/archboot/update/sway.sh
index a3da21f59..31e9d63bd 100644
--- a/usr/lib/archboot/update/sway.sh
+++ b/usr/lib/archboot/update/sway.sh
@@ -102,6 +102,7 @@ EOF
 }
 
 _install_sway() {
+    #shellcheck disable=SC2206
     _PACKAGES=(${_WAYLAND_PACKAGE} ${_STANDARD_PACKAGES[@]} ${_SWAY_PACKAGES[@]})
     if ! [[ -e /usr/bin/sway ]]; then
         _prepare_graphic "${_PACKAGES[@]}"
diff --git a/usr/lib/archboot/update/xfce.sh b/usr/lib/archboot/update/xfce.sh
index 6546628cf..3ed5cf492 100644
--- a/usr/lib/archboot/update/xfce.sh
+++ b/usr/lib/archboot/update/xfce.sh
@@ -3,6 +3,7 @@
 # created by Tobias Powalowski <tpowa@archlinux.org>
 _install_xfce() {
     if ! [[ -e /usr/bin/startxfce4 ]]; then
+        #shellcheck disable=SC2145
         _prepare_graphic "${_XORG_PACKAGE} ${_VNC_PACKAGE} ${_STANDARD_PACKAGES[@]} ${_XFCE_PACKAGES[@]}"
     fi
     _prepare_browser >"${_LOG}" 2>&1