diff --git a/usr/bin/archboot-launcher.sh b/usr/bin/archboot-launcher.sh
index 04a1c5d1b..59f8c3648 100755
--- a/usr/bin/archboot-launcher.sh
+++ b/usr/bin/archboot-launcher.sh
@@ -27,11 +27,11 @@ _desktop () {
     _dialog  --title " Internet Browser " --menu "" 8 40 4 \
     "chromium" "Browser From Google" \
     "firefox" "Browser From Mozilla" 2>${_ANSWER} || return 1
-    _BROWSER="$(cat ${_ANSWER})"
+    _BROWSER=$(cat "${_ANSWER}")
     sd "STANDARD_BROWSER=.*" "STANDARD_BROWSER=${_BROWSER}" /etc/archboot/defaults
     source /etc/locale.conf
     clear
-    update -${_EXIT} || exit 1
+    update -"${_EXIT}" || exit 1
     exit 0
 }
 
diff --git a/usr/bin/archboot-localize.sh b/usr/bin/archboot-localize.sh
index be0461ec1..53c6da302 100755
--- a/usr/bin/archboot-localize.sh
+++ b/usr/bin/archboot-localize.sh
@@ -66,6 +66,7 @@ _localize_task() {
     echo "LANG=${_LOCALE}.UTF-8" > /.localize
     echo LC_COLLATE=C >> /etc/locale.conf
     localectl set-locale "${_LOCALE}.UTF-8" &>"${_NO_LOG}"
+    #shellcheck disable=SC2016
     sd '(^[a-z])' '#$1' /etc/locale.gen
     sd "^#${_LOCALE}.UTF-8" "${_LOCALE}.UTF-8" /etc/locale.gen
     locale-gen &>"${_NO_LOG}"
diff --git a/usr/bin/archboot-network.sh b/usr/bin/archboot-network.sh
index e1aa062f2..1a9c23ad1 100755
--- a/usr/bin/archboot-network.sh
+++ b/usr/bin/archboot-network.sh
@@ -21,6 +21,7 @@ _online_switch() {
 }
 
 _net_interfaces() {
+    #shellcheck disable=SC2016
     fd -E '/lo' . '/sys/class/net' -x rg '(.*)' -r '{/} $1' {}/address | sort -u
 }
 
diff --git a/usr/bin/archboot-not-installed.sh b/usr/bin/archboot-not-installed.sh
index b4475e32d..c2331b30a 100755
--- a/usr/bin/archboot-not-installed.sh
+++ b/usr/bin/archboot-not-installed.sh
@@ -10,7 +10,7 @@ rm -r /usr/share/{licenses,locale} /usr/lib/{systemd,tmpfiles.d}
 pacman -Sy
 #shellcheck disable=SC2013
 for i in $(pacman -Q | cut -d ' ' -f1); do
-    rm -r "${_PACMAN_LIB}"/local/$(pacman -Q ${i} | sd ' ' '-')
+    rm -r "${_PACMAN_LIB}"/local/"$(pacman -Q ${i} | sd ' ' '-')"
     #shellcheck disable=SC2086
     if pacman -Sdd ${i} --noconfirm >>log.txt; then
         echo "${i}" >> not-installed.orig.txt
diff --git a/usr/bin/archboot-pacsetup.sh b/usr/bin/archboot-pacsetup.sh
index 2aac6c805..1f3e2dc1a 100755
--- a/usr/bin/archboot-pacsetup.sh
+++ b/usr/bin/archboot-pacsetup.sh
@@ -64,6 +64,7 @@ _enable_testing() {
         _DOTESTING=""
         _dialog --title " Testing Repositories " --defaultno --yesno "Do you want to enable testing repositories?\n\nOnly enable this if you need latest\navailable packages for testing purposes!" 8 50 && _DOTESTING=1
         if [[ -n "${_DOTESTING}" ]]; then
+            #shellcheck disable=SC2016
             sd '^#(\[[c,e].*-testing\]\n)#' '$1' "${1}/etc/pacman.conf"
         fi
     else
diff --git a/usr/bin/archboot-testsuite.sh b/usr/bin/archboot-testsuite.sh
index c909b7c86..be22997eb 100755
--- a/usr/bin/archboot-testsuite.sh
+++ b/usr/bin/archboot-testsuite.sh
@@ -94,6 +94,7 @@ echo -e "Starting none tracked files in \e[1m10\e[m seconds... \e[1;92mCTRL-C\e[
 sleep 10
 _run_test "none tracked files in /usr/lib... this takes a while"
 for i in $(fd -u -E '/modules/' -E '/udev/' -E 'gconv-modules.cache' -E '/locale-archive' . /usr/lib); do
+    #shellcheck disable=SC2086
     pacman -Qo ${i} &>${_NO_LOG} || echo ${i} >> pacman-error.log
 done
 _result pacman-error.log
diff --git a/usr/lib/archboot/common.sh b/usr/lib/archboot/common.sh
index 3bc158129..00d849352 100644
--- a/usr/lib/archboot/common.sh
+++ b/usr/lib/archboot/common.sh
@@ -91,7 +91,7 @@ _dialog() {
 
 # $1: percentage $2: message
 _progress() {
-cat 2>${_NO_LOG} <<EOF
+cat 2>"${_NO_LOG}" <<EOF
 XXX
 ${1}
 ${2}
diff --git a/usr/lib/archboot/installer/common.sh b/usr/lib/archboot/installer/common.sh
index de0f790d0..8f961251e 100644
--- a/usr/lib/archboot/installer/common.sh
+++ b/usr/lib/archboot/installer/common.sh
@@ -66,7 +66,7 @@ _chroot_mount()
         mount sys "${_DESTDIR}/sys" -t sysfs -o nosuid,noexec,nodev,ro
         # needed for efi bootloader installation routines
         if mount | rg -qw 'efivarfs'; then
-            mount efivarfs ${_DESTDIR}/sys/firmware/efi/efivars -t efivarfs -o nosuid,noexec,nodev
+            mount efivarfs "${_DESTDIR}"/sys/firmware/efi/efivars -t efivarfs -o nosuid,noexec,nodev
         fi
         mount udev "${_DESTDIR}/dev" -t devtmpfs -o mode=0755,nosuid
         mount devpts "${_DESTDIR}/dev/pts" -t devpts -o mode=0620,gid=5,nosuid,noexec
diff --git a/usr/lib/archboot/run/container.sh b/usr/lib/archboot/run/container.sh
index 81a2c8045..7e3c50999 100755
--- a/usr/lib/archboot/run/container.sh
+++ b/usr/lib/archboot/run/container.sh
@@ -27,6 +27,7 @@ if echo "${_BASENAME}" | rg -qw "${_RUNNING_ARCH}"; then
         # enable [*-testing] if enabled in host
         if rg -q "^\[core-testing" /etc/pacman.conf; then
             echo "Enable [core-testing] and [extra-testing] repository in container..."
+            #shellcheck disable=SC2016
             sd '^#(\[[c,e].*-testing\]\n)#' '$1' "${1}/etc/pacman.conf"
         fi
     fi