diff --git a/usr/lib/archboot/iso.sh b/usr/lib/archboot/iso.sh
index e45c0dc16..a9fa7c2ef 100644
--- a/usr/lib/archboot/iso.sh
+++ b/usr/lib/archboot/iso.sh
@@ -171,7 +171,7 @@ _prepare_memtest() {
 _prepare_background() {
     echo "Preparing grub background..."
     [[ -d "${_ISODIR}/boot/grub" ]] || mkdir -p "${_ISODIR}/boot/grub"
-    cp ${_GRUB_BACKGROUND} "${_ISODIR}/boot/grub/archboot-background.png"
+    cp "${_GRUB_BACKGROUND}" "${_ISODIR}/boot/grub/archboot-background.png"
 }
 
 _prepare_uefi_image() {
diff --git a/usr/lib/archboot/login.sh b/usr/lib/archboot/login.sh
index c6c382082..942fe3f5f 100644
--- a/usr/lib/archboot/login.sh
+++ b/usr/lib/archboot/login.sh
@@ -137,6 +137,7 @@ _run_autorun() {
         echo "Waiting for pacman keyring..."
         _pacman_keyring
         echo "Updating pacman keyring..."
+        #shellcheck disable=SC2086
         pacman -Sy --noconfirm ${_KEYRING} &>"${_LOG}"
         chmod 755 /etc/archboot/run/autorun.sh
         echo "Running custom autorun.sh..."
diff --git a/usr/lib/archboot/release.sh b/usr/lib/archboot/release.sh
index e79bbaa79..61e368ae1 100644
--- a/usr/lib/archboot/release.sh
+++ b/usr/lib/archboot/release.sh
@@ -34,7 +34,7 @@ _create_iso() {
     . "${_W_DIR}/etc/archboot/${_ARCH}.conf"
     #shellcheck disable=SC2116,SC2046,2086
     _KERNEL="$(echo ${_W_DIR}${_KERNEL})"
-    _NAME="archboot-$(date +%Y.%m.%d-%H.%M)-$(_kver ${_KERNEL})"
+    _NAME="archboot-$(date +%Y.%m.%d-%H.%M)-$(_kver "${_KERNEL}")"
     if ! [[ "${_RUNNING_ARCH}" == "${_ARCH}" ]]; then
         ### to speedup build for riscv64 and aarch64 on x86_64, run compressor on host system
         echo "Generating initramdisks..."
@@ -83,7 +83,7 @@ _create_iso() {
     if [[ "${_ARCH}" == "riscv64" ]]; then
         for i in *.img; do
             if  echo "${i}" | rg -v 'local' | rg -vq 'latest'; then
-                mv ${_KERNEL} boot/
+                mv "${_KERNEL}" boot/
                 mcopy -m -i "${i}"@@1048576 ::/"${_INITRD}" ./"${_INITRD}"
             elif echo "${i}" | rg -q 'latest'; then
                 mcopy -m -i "${i}"@@1048576 ::/"${_INITRD}" ./"${_INITRD_LATEST}"
@@ -99,7 +99,7 @@ _create_iso() {
                 if [[ "${_ARCH}" == "aarch64" ]]; then
                     # replace aarch64 Image.gz with Image kernel for UKI
                     # compressed image is not working at the moment
-                    _KERNEL="$(echo ${_KERNEL} | sd '\.gz' '')"
+                    _KERNEL="$(echo "${_KERNEL}" | sd '\.gz' '')"
                     mv "${_KERNEL}" boot/
                 else
                     mv "${_W_DIR}/${_INTEL_UCODE}" boot/
@@ -130,9 +130,9 @@ _create_iso() {
             [[ "${initrd}" == "${_INITRD_LATEST}" ]] && _UKI="boot/${_NAME}-latest-${_ARCH}.efi"
             [[ "${initrd}" == "${_INITRD_LOCAL}" ]] && _UKI="boot/${_NAME}-local-${_ARCH}.efi"
             #shellcheck disable=SC2086
-            ${_NSPAWN} "${_W_DIR}" /usr/lib/systemd/ukify build --linux=${_KERNEL} \
-                ${_INTEL_UCODE} ${_AMD_UCODE} --initrd=${initrd} --cmdline="${_CMDLINE}" \
-                --os-release=@${_OSREL} --splash=${_SPLASH} --output=${_UKI} &>"${_NO_LOG}" || exit 1
+            ${_NSPAWN} "${_W_DIR}" /usr/lib/systemd/ukify build --linux="${_KERNEL}" \
+                ${_INTEL_UCODE} ${_AMD_UCODE} --initrd="${initrd}" --cmdline="${_CMDLINE}" \
+                --os-release=@"${_OSREL}" --splash="${_SPLASH}" --output="${_UKI}" &>"${_NO_LOG}" || exit 1
         done
         # fix permission and timestamp
         mv "${_W_DIR}"/boot ./
diff --git a/usr/lib/archboot/uki.sh b/usr/lib/archboot/uki.sh
index e55e2996d..2f149468b 100644
--- a/usr/lib/archboot/uki.sh
+++ b/usr/lib/archboot/uki.sh
@@ -62,9 +62,10 @@ _systemd_ukify() {
     cd "${_UKIDIR}" &>"${_NO_LOG}" || exit 1
     [[ -n "/${_INTEL_UCODE}" ]] && _INTEL_UCODE="--initrd=/${_INTEL_UCODE}"
     _AMD_UCODE="--initrd=/${_AMD_UCODE}"
-    /usr/lib/systemd/ukify build --linux=${_KERNEL} \
+    #shellcheck disable=SC2086
+    /usr/lib/systemd/ukify build --linux="${_KERNEL}" \
         ${_INTEL_UCODE} ${_AMD_UCODE} --initrd="${_INITRD}" --cmdline="${_CMDLINE}" \
-        --os-release=@${_OSREL} --splash=${_SPLASH} --output="../${_UKI}" &>"${_NO_LOG}" || exit 1
+        --os-release=@"${_OSREL}" --splash="${_SPLASH}" --output="../${_UKI}" &>"${_NO_LOG}" || exit 1
     cd ../ &>"${_NO_LOG}" || exit 1
 }