diff --git a/grml-live b/grml-live
index 5a87a300..75461202 100755
--- a/grml-live
+++ b/grml-live
@@ -28,7 +28,7 @@ fi
 GRML_LIVE_VERSION='***UNRELEASED***'
 
 # global variables
-PN="$(basename $0)"
+PN=$(basename "$0")
 CMDLINE="$0 $@"
 ADDONS_LIST_FILE='/boot/isolinux/addons_list.cfg'
 # }}}
@@ -152,7 +152,8 @@ if ! [ -r "$LIVE_CONF" ] ; then
   ewarn "Configuration file $LIVE_CONF can not be read, ignoring"
 else
   einfo "Sourcing configuration file $LIVE_CONF"
-  . $LIVE_CONF
+  # shellcheck source=/dev/null
+  . "$LIVE_CONF"
   eend $?
 fi
 # }}}
@@ -160,13 +161,13 @@ fi
 # umount all directories {{{
 umount_all() {
    # make sure we don't leave any mounts - FAI doesn't remove them always
-   umount $CHROOT_OUTPUT/proc/sys/fs/binfmt_misc 2>/dev/null || /bin/true
-   umount $CHROOT_OUTPUT/proc 2>/dev/null || /bin/true
-   umount $CHROOT_OUTPUT/run/udev 2>/dev/null || /bin/true
-   umount $CHROOT_OUTPUT/run  2>/dev/null || /bin/true
-   umount $CHROOT_OUTPUT/sys  2>/dev/null || /bin/true
-   umount $CHROOT_OUTPUT/dev/pts 2>/dev/null || /bin/true
-   umount $CHROOT_OUTPUT/dev 2>/dev/null || /bin/true
+   umount "$CHROOT_OUTPUT/proc/sys/fs/binfmt_misc 2>/dev/null" || /bin/true
+   umount "$CHROOT_OUTPUT/proc 2>/dev/null" || /bin/true
+   umount "$CHROOT_OUTPUT/run/udev 2>/dev/null" || /bin/true
+   umount "$CHROOT_OUTPUT/run  2>/dev/null" || /bin/true
+   umount "$CHROOT_OUTPUT/sys  2>/dev/null" || /bin/true
+   umount "$CHROOT_OUTPUT/dev/pts 2>/dev/null" || /bin/true
+   umount "$CHROOT_OUTPUT/dev 2>/dev/null" || /bin/true
 
    if [ -n "$EXTRACT_ISO_NAME" ] ; then
      umount "$EXTRACT_ISO_NAME" 2>/dev/null || /bin/true
@@ -174,7 +175,7 @@ umount_all() {
 
    # certain FAI versions sadly leave a ramdisk behind, so better safe than sorry
    if [ -x /usr/lib/fai/mkramdisk ] ; then
-     /usr/lib/fai/mkramdisk -u "$(readlink -f ${CHROOT_OUTPUT}/var/lib/dpkg)" >/dev/null 2>&1 || /bin/true
+     /usr/lib/fai/mkramdisk -u "$(readlink -f "${CHROOT_OUTPUT}"/var/lib/dpkg)" >/dev/null 2>&1 || /bin/true
    fi
 
    [ -n "$MIRROR_DIRECTORY" ] && umount "${CHROOT_OUTPUT}/${MIRROR_DIRECTORY}"
@@ -189,7 +190,7 @@ store_logfiles() {
   rm -rf "$CHROOT_OUTPUT"/var/log/fai
 
   # store copy of autogenerated configuration file
-  cp ${GRML_FAI_CONFIG}/nfsroot.conf "$LOG_OUTPUT"/fai/
+  cp "${GRML_FAI_CONFIG}/nfsroot.conf" "$LOG_OUTPUT"/fai/
 
   # copy fai package list
   cp "$CHROOT_OUTPUT"/var/log/install_packages.list "$LOG_OUTPUT"/fai/
@@ -217,7 +218,7 @@ bailout() {
   fi
 
   # get rid of automatically generated conffiles
-  rm -f ${GRML_FAI_CONFIG}/nfsroot.conf
+  rm -f "${GRML_FAI_CONFIG}/nfsroot.conf"
 
   if [ -n "$CHOWN_USER" ]; then
     log "Setting ownership"
@@ -241,7 +242,7 @@ trap umount_all EXIT
 
 # log output:
 # usage: log "string to log"
-log() { [ -n "$LOGFILE" ] && echo "$*" >> $LOGFILE ; }
+log() { [ -n "$LOGFILE" ] && echo "$*" >> "$LOGFILE" ; }
 
 # cut string at character number int = $1
 # usage: cut_string 5 "1234567890" will output "12345"
@@ -254,15 +255,15 @@ cut_string() {
 # usage: extend_string_begin 5 "123" will output "  123"
 extend_string_begin() {
   [ -n "$2" ] || return 1
-  local COUNT="$(echo $2 | wc -c)"
-  local FILL="$(expr $COUNT - $1)"
+  local COUNT=$(echo "$2" | wc -c)
+  local FILL=$(expr "$COUNT" - "$1")
   while [ "$FILL" -gt 1 ] ; do
     echo -n " "
-    local FILL=$(expr $FILL - 1)
+    local FILL=$(expr "$FILL" - 1)
   done
   while [ "$FILL" -lt 1 ] ; do
     echo -n " "
-    local FILL=$(expr $FILL + 1)
+    local FILL=$(expr "$FILL" + 1)
   done
   echo "$2" | head -c "$1"; echo -ne "\n"
 }
@@ -272,15 +273,15 @@ extend_string_begin() {
 extend_string_end() {
   [ -n "$2" ] || return 1
   echo -n "$2" | head -c "$1"
-  local COUNT="$(echo $2 | wc -c)"
-  local FILL="$(expr $COUNT - $1)"
+  local COUNT=$(echo "$2" | wc -c)
+  local FILL=$(expr "$COUNT" - "$1")
   while [ "$FILL" -gt 1 ] ; do
     echo -n " "
-    local FILL=$(expr $FILL - 1)
+    local FILL=$(expr "$FILL" - 1)
   done
   while [ "$FILL" -lt 1 ] ; do
     echo -n " "
-    local FILL=$(expr $FILL + 1)
+    local FILL=$(expr "$FILL" + 1)
   done
   echo -ne "\n"
 }
@@ -383,17 +384,17 @@ while getopts "a:C:c:d:D:e:g:i:I:o:r:s:S:t:U:v:w:AbBFhnNqQuVz" opt; do
     b) BUILD_ONLY=1 ;;
     B) BUILD_DIRTY=1 ;;
     c) CLASSES="$OPTARG" ;;
-    C) LOCAL_CONFIG="$(readlink -f $OPTARG)" ;;
+    C) LOCAL_CONFIG="$(readlink -f "$OPTARG")" ;;
     d) DATE="$OPTARG" ;;
-    D) GRML_FAI_CONFIG="$(readlink -f $OPTARG)" ;;
-    e) EXTRACT_ISO_NAME="$(readlink -f $OPTARG)" ;;
+    D) GRML_FAI_CONFIG="$(readlink -f "$OPTARG")" ;;
+    e) EXTRACT_ISO_NAME="$(readlink -f "$OPTARG")" ;;
     g) GRML_NAME="$OPTARG" ;;
     h) usage ; bailout 0 ;;
     i) ISO_NAME="$OPTARG" ;;
     I) CHROOT_INSTALL="$OPTARG" ;;
     n) SKIP_MKISOFS=1 ;;
     N) BOOTSTRAP_ONLY=1; SKIP_MKISOFS=1; SKIP_MKSQUASHFS=1 ;;
-    o) OUTPUT="$(readlink -f $OPTARG)" ;;
+    o) OUTPUT="$(readlink -f "$OPTARG")" ;;
     q) SKIP_MKSQUASHFS=1 ;;
     Q) SKIP_NETBOOT=1 ;;
     r) RELEASENAME="$OPTARG" ;;
@@ -426,7 +427,8 @@ if [ -z "$LOCAL_CONFIG" ]; then
 fi
 if [ -n "$LOCAL_CONFIG" ]; then
   if [ -r "$LOCAL_CONFIG" ]; then
-    . $LOCAL_CONFIG
+    # shellcheck source=/dev/null
+    . "$LOCAL_CONFIG"
   else
     eerror "Could not read specified local configuration file \"$LOCAL_CONFIG\"."
     bailout 1
@@ -445,7 +447,7 @@ fi
 
 # assume sane defaults (if not set already) {{{
 [ -n "$ARCH" ]                    || ARCH="$(dpkg --print-architecture)"
-[ -n "$CLASSES" ]                 || CLASSES="GRMLBASE,GRML_FULL,$(echo ${ARCH} | tr 'a-z' 'A-Z')"
+[ -n "$CLASSES" ]                 || CLASSES="GRMLBASE,GRML_FULL,$(echo "${ARCH}" | tr 'a-z' 'A-Z')"
 [ -n "$DATE" ]                    || DATE="$(date +%Y-%m-%d)"
 [ -n "$DISTRI_INFO" ]             || DISTRI_INFO='Grml - Live Linux for system administrators'
 [ -n "$DISTRI_NAME" ]             || DISTRI_NAME="grml"
@@ -489,7 +491,7 @@ fi
 
 # trim characters that are known to cause problems inside $GRML_NAME;
 # for example isolinux does not like '-' inside the directory name
-[ -n "$GRML_NAME" ] && export SHORT_NAME="$(echo $GRML_NAME | tr -d ',./;\- ')"
+[ -n "$GRML_NAME" ] && export SHORT_NAME="$(echo "$GRML_NAME" | tr -d ',./;\- ')"
 
 # export variables to have them available in fai scripts:
 [ -n "$GRML_NAME" ]   && export GRML_NAME="$GRML_NAME"
@@ -575,10 +577,10 @@ fi
 
 # create log file {{{
 [ -n "$LOGFILE" ] || LOGFILE=${LOG_OUTPUT}/grml-live.log
-mkdir -p $(dirname "${LOGFILE}")
-touch $LOGFILE
-chown root:adm $LOGFILE
-chmod 664 $LOGFILE
+mkdir -p "$(dirname "${LOGFILE}")"
+touch "$LOGFILE"
+chown root:adm "$LOGFILE"
+chmod 664 "$LOGFILE"
 # }}}
 
 # clean/zero/remove logfiles {{{
@@ -587,7 +589,7 @@ if [ -n "$PRESERVE_LOGFILE" ] ; then
    echo "Preserving logfile $LOGFILE as requested via \$PRESERVE_LOGFILE"
 else
    # make sure it is empty
-   echo -n > $LOGFILE
+   echo -n > "$LOGFILE"
 fi
 
 if [ -n "$ZERO_FAI_LOGFILE" ] ; then
@@ -610,7 +612,8 @@ if [ -n "$CONFIG" ] ; then
       bailout 1
    else
       log "Sourcing $CONFIG"
-      . $CONFIG
+      # shellcheck source=/dev/null
+      . "$CONFIG"
    fi
 fi
 
@@ -629,7 +632,7 @@ einfo "Logging actions to logfile $LOGFILE"
 CONFIGDUMP=$(mktemp)
 set | grep -E \
   '^(GRML_NAME|RELEASENAME|DATE|VERSION|SUITE|ARCH|DISTRI_NAME|USERNAME|HOSTNAME|APT_PROXY)=' \
-  > ${CONFIGDUMP}
+  > "${CONFIGDUMP}"
 # }}}
 
 # unpack iso/squashfs {{{
@@ -680,13 +683,13 @@ case "${SUITE}" in
   # avoid having to maintain DEBIAN_UNSTABLE *and* DEBIAN_SID class files:
         sid)               CLASSES="DEBIAN_UNSTABLE,$CLASSES" ;;
   # otherwise map e.g. bookworm to DEBIAN_BOOKWORM:
-          *)               CLASSES="DEBIAN_$(echo $SUITE | tr 'a-z' 'A-Z'),$CLASSES";;
+          *)               CLASSES="DEBIAN_$(echo "$SUITE" | tr 'a-z' 'A-Z'),$CLASSES";;
 esac
 export SUITE # make sure it's available in FAI scripts
 
 # validate whether the specified architecture class matches the
 # architecture (option), otherwise installation of kernel will fail
-if echo $CLASSES | grep -qw I386 ; then
+if echo "$CLASSES" | grep -qw I386 ; then
    if ! [[ "$ARCH" == "i386" ]] ; then
       log    "Error: You specified the I386 class but are trying to build something else (AMD64/ARM64?)."
       eerror "Error: You specified the I386 class but are trying to build something else (AMD64/ARM64?)."
@@ -694,7 +697,7 @@ if echo $CLASSES | grep -qw I386 ; then
       eend 1
       bailout
    fi
-elif echo $CLASSES | grep -qi amd64 ; then
+elif echo "$CLASSES" | grep -qi amd64 ; then
    if ! [[ "$ARCH" == "amd64" ]] ; then
       log    "Error: You specified the AMD64 class but are trying to build something else (I386/ARM64?)."
       eerror "Error: You specified the AMD64 class but are trying to build something else (I386/ARM64?)."
@@ -702,7 +705,7 @@ elif echo $CLASSES | grep -qi amd64 ; then
       eend 1
       bailout
    fi
-elif echo $CLASSES | grep -qi arm64 ; then
+elif echo "$CLASSES" | grep -qi arm64 ; then
    if ! [[ "$ARCH" == "arm64" ]] ; then
       log    "Error: You specified the ARM64 class but are trying to build something else (I386/AMD64?)."
       eerror "Error: You specified the ARM64 class but are trying to build something else (I386/AMD64?)."
@@ -777,9 +780,10 @@ else
 
       log "Executed FAI command line:"
       log "BUILD_ONLY=$BUILD_ONLY BOOTSTRAP_ONLY=$BOOTSTRAP_ONLY GRML_LIVE_CONFIG=$CONFIGDUMP WAYBACK_DATE=$WAYBACK_DATE fai $VERBOSE -C $GRML_FAI_CONFIG -s file:///$GRML_FAI_CONFIG/config -c$CLASSES -u $HOSTNAME $FAI_ACTION $CHROOT_OUTPUT $FAI_ARGS"
+      # shellcheck disable=SC2086 # $FAI_ARGS needs splitting
       BUILD_ONLY="$BUILD_ONLY" BOOTSTRAP_ONLY="$BOOTSTRAP_ONLY" GRML_LIVE_CONFIG="$CONFIGDUMP" fai $VERBOSE \
                   -C "$GRML_FAI_CONFIG" -s "file:///$GRML_FAI_CONFIG/config" -c"$CLASSES" \
-                  -u "$HOSTNAME" "$FAI_ACTION" "$CHROOT_OUTPUT" $FAI_ARGS | tee -a $LOGFILE
+                  -u "$HOSTNAME" "$FAI_ACTION" "$CHROOT_OUTPUT" $FAI_ARGS | tee -a "$LOGFILE"
       RC="$PIPESTATUS" # notice: bash-only
 
       if [ "$RC" != 0 ] ; then
@@ -810,21 +814,21 @@ else
       CHECKLOG="$LOG_OUTPUT"/fai/
       if [ -r "$CHECKLOG/software.log" ] ; then
          # 1 errors during executing of commands
-         grep 'dpkg: error processing' $CHECKLOG/software.log >> $LOGFILE && ERROR=1
-         grep 'E: Method http has died unexpectedly!' $CHECKLOG/software.log >> $LOGFILE && ERROR=2
-         grep 'ERROR: chroot' $CHECKLOG/software.log >> $LOGFILE && ERROR=3
-         grep 'E: Failed to fetch' $CHECKLOG/software.log >> $LOGFILE && ERROR=4
-         grep 'Unable to write mmap - msync (28 No space left on device)' $CHECKLOG/software.log >> $LOGFILE && ERROR=5
+         grep 'dpkg: error processing' "$CHECKLOG/software.log" >> "$LOGFILE" && ERROR=1
+         grep 'E: Method http has died unexpectedly!' "$CHECKLOG/software.log" >> "$LOGFILE" && ERROR=2
+         grep 'ERROR: chroot' "$CHECKLOG/software.log" >> "$LOGFILE" && ERROR=3
+         grep 'E: Failed to fetch' "$CHECKLOG/software.log" >> "$LOGFILE" && ERROR=4
+         grep 'Unable to write mmap - msync (28 No space left on device)' "$CHECKLOG/software.log" >> "$LOGFILE" && ERROR=5
       fi
 
       # FAI versions <6.0 used to write to shell.log
       if [ -r "$CHECKLOG/shell.log" ] ; then
-         grep 'FAILED with exit code' $CHECKLOG/shell.log >> $LOGFILE && ERROR=6
+         grep 'FAILED with exit code' "$CHECKLOG/shell.log" >> "$LOGFILE" && ERROR=6
       fi
 
       # FAI versions >=6.0 always writes to scripts.log
       if [ -r "$CHECKLOG/scripts.log" ] ; then
-         grep 'FAILED with exit code' $CHECKLOG/scripts.log >> $LOGFILE && ERROR=6
+         grep 'FAILED with exit code' "$CHECKLOG/scripts.log" >> "$LOGFILE" && ERROR=6
       fi
 
       if [ -r "$CHECKLOG/fai.log" ] ; then
@@ -1073,17 +1077,17 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
 
     # if we don't have an initrd we a) can't boot and b) there was an error
     # during build, so check for the file:
-    INITRD="$(ls $CHROOT_OUTPUT/boot/initrd* 2>/dev/null| grep -v '.bak$' | sort -r | head -1)"
+    INITRD=$(ls "$CHROOT_OUTPUT/boot/initrd*" 2>/dev/null| grep -v '.bak$' | sort -r | head -1)
     if [ -n "$INITRD" ] ; then
-      cp $INITRD "$BUILD_OUTPUT"/boot/"${SHORT_NAME}"/initrd.img
-      find $CHROOT_OUTPUT/boot/ -name initrd\*.bak -exec rm {} \;
+      cp "$INITRD" "$BUILD_OUTPUT"/boot/"${SHORT_NAME}"/initrd.img
+      find "$CHROOT_OUTPUT"/boot/ -name initrd\*.bak -exec rm {} \;
     else
       log    "Error: No initrd found inside $CHROOT_OUTPUT/boot/ - Exiting"
       eerror "Error: No initrd found inside $CHROOT_OUTPUT/boot/ - Exiting" ; eend 1
       bailout 10
     fi
 
-    KERNEL_IMAGE="$(ls $CHROOT_OUTPUT/boot/vmlinuz* 2>/dev/null | sort -r | head -1)"
+    KERNEL_IMAGE=$(ls "$CHROOT_OUTPUT/boot/vmlinuz*" 2>/dev/null | sort -r | head -1)
     if [ -n "$KERNEL_IMAGE" ] ; then
       cp "$KERNEL_IMAGE" "$BUILD_OUTPUT"/boot/"${SHORT_NAME}"/vmlinuz
     else
@@ -1095,10 +1099,10 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
     # we need to set "$BOOTID" before we invoke adjust_boot_files for the
     # first time, being inside grub_setup below
     if [ -n "$NO_BOOTID" ] ; then
-      log   'Skipping bootid feature as requested via $NO_BOOTID.'
-      einfo 'Skipping bootid feature as requested via $NO_BOOTID.'
+      log   "Skipping bootid feature as requested via \$NO_BOOTID."
+      einfo "Skipping bootid feature as requested via \$NO_BOOTID."
     else
-      [ -n "$BOOTID" ] || BOOTID="$(echo ${GRML_NAME}${VERSION} | tr -d ',./;\- ')"
+      [ -n "$BOOTID" ] || BOOTID=$(echo "${GRML_NAME}${VERSION}" | tr -d ',./;\- ')
       mkdir -p "$BUILD_OUTPUT"/conf
       einfo "Generating /conf/bootid.txt with entry ${BOOTID}."
       log   "Generating /conf/bootid.txt with entry ${BOOTID}."
@@ -1115,8 +1119,8 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
       mkdir -p "${BUILD_OUTPUT}"/conf
       rm -f "${BUILD_OUTPUT}"/conf/bootfile*  # ensure we don't leave any old(er) files behind
 
-      einfo "Generating "${BUILD_OUTPUT}"/conf/bootfile* files"
-      log   "Generating "${BUILD_OUTPUT}"/conf/bootfile* files"
+      einfo "Generating ${BUILD_OUTPUT}/conf/bootfile* files"
+      log   "Generating ${BUILD_OUTPUT}/conf/bootfile* files"
 
       BOOT_FILE="/conf/bootfile_$(cat "${CHROOT_OUTPUT}"/boot/grub/bootfile.txt)"
       echo "# This file is relevant for GRUB boot with the Grml ISO." > "${BUILD_OUTPUT}/${BOOT_FILE}"
@@ -1166,7 +1170,7 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
     # copy _required_ isolinux files
     if [ -d "${CHROOT_OUTPUT}/usr/lib/ISOLINUX" ] ; then
       copy_addon_file isolinux.bin /usr/lib/ISOLINUX isolinux
-      for file in ${CHROOT_OUTPUT}/usr/lib/syslinux/modules/bios/*.c32 ; do
+      for file in "${CHROOT_OUTPUT}"/usr/lib/syslinux/modules/bios/*.c32 ; do
         copy_addon_file "$(basename "$file")"  /usr/lib/syslinux/modules/bios/ isolinux
       done
     else # syslinux versions <= 3:4.05+dfsg-6+deb8u1
@@ -1177,10 +1181,10 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
 
     # *always* copy files to output directory so the variables
     # get adjusted according to the build.
-    cp ${TEMPLATE_DIRECTORY}/boot/isolinux/*  "$BUILD_OUTPUT"/boot/isolinux/
+    cp "${TEMPLATE_DIRECTORY}"/boot/isolinux/*  "$BUILD_OUTPUT"/boot/isolinux/
 
     mkdir -p "${BUILD_OUTPUT}/boot/grub"
-    cp -a ${TEMPLATE_DIRECTORY}/boot/grub/* "$BUILD_OUTPUT"/boot/grub/
+    cp -a "${TEMPLATE_DIRECTORY}"/boot/grub/* "$BUILD_OUTPUT"/boot/grub/
 
     if [ -n "$NO_ADDONS" ] ; then
       rm -f "$BUILD_OUTPUT"/boot/grub/addons.cfg
@@ -1246,8 +1250,8 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
         copy_addon_file memdisk /usr/lib/syslinux addons
 
         # copy only files so we can handle bsd4grml on its own
-        for file in ${TEMPLATE_DIRECTORY}/boot/addons/* ; do
-          test -f $file && cp $file "$BUILD_OUTPUT"/boot/addons/
+        for file in "${TEMPLATE_DIRECTORY}"/boot/addons/* ; do
+          test -f "$file" && cp "$file" "$BUILD_OUTPUT"/boot/addons/
         done
 
         eend 0
@@ -1257,7 +1261,7 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
           einfo "Skipping installation of bsd4grml as requested via \$NO_ADDONS_BSD4GRML."; eend 0
         else
           if [ -d "$TEMPLATE_DIRECTORY"/boot/addons/bsd4grml ] ; then
-            cp -a ${TEMPLATE_DIRECTORY}/boot/addons/bsd4grml "$BUILD_OUTPUT"/boot/addons/
+            cp -a "${TEMPLATE_DIRECTORY}"/boot/addons/bsd4grml "$BUILD_OUTPUT"/boot/addons/
           else
             log   "Missing addon file: bsd4grml"
             ewarn "Missing addon file: bsd4grml" ; eend 0
@@ -1273,7 +1277,7 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
     echo "source /boot/grub/header.cfg" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
     for config in "${BUILD_OUTPUT}"/boot/grub/*_default.cfg "${BUILD_OUTPUT}"/boot/grub/*_options.cfg ; do
       [ -r "$config" ] || continue
-      echo "source ${config##$BUILD_OUTPUT}" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
+      echo "source ${config##"$BUILD_OUTPUT"}" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
     done
     if [ -z "$NO_ADDONS" ] ; then
       echo "source /boot/grub/addons.cfg" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
@@ -1315,7 +1319,7 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
     fi
 
     mkdir -p "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/
-    cp -a ${TEMPLATE_DIRECTORY}/GRML/* "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/
+    cp -a "${TEMPLATE_DIRECTORY}"/GRML/* "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/
 
     if [ -r "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/grml-version ] ; then
       sed -i "s/%RELEASE_INFO%/$RELEASE_INFO/" "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/grml-version
@@ -1342,8 +1346,8 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
     for param in ARCH DATE DISTRI_INFO DISTRI_NAME DISTRI_SPLASH GRML_NAME SQUASHFS_NAME \
       RELEASE_INFO SHORT_NAME VERSION ; do
       for file in $(find "${BUILD_OUTPUT}" -name "*%$param%*") ; do
-        value="$(eval echo '$'"$param")"
-        mv ${file} ${file/\%${param}\%/$value}
+        value=$(eval echo '$'"$param")
+        mv "${file}" "${file/\%${param}\%/$value}"
       done
     done
 
@@ -1362,7 +1366,7 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
       echo "include grml.cfg"        >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
 
       for f in "${BUILD_OUTPUT}"/boot/isolinux/submenu*.cfg ; do
-        echo "include $(basename $f)"     >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
+        echo "include $(basename "$f")"     >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
       done
 
       echo "include options.cfg"     >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
@@ -1392,8 +1396,8 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
 
     # use old style console based isolinux method only if requested:
     if [[ "${ISOLINUX_METHOD}" == "console" ]] ; then
-      log 'Using console based isolinux method as requested via $ISOLINUX_METHOD.'
-      einfo 'Using console based isolinux method as requested via $ISOLINUX_METHOD.'
+      log "Using console based isolinux method as requested via \$ISOLINUX_METHOD."
+      einfo "Using console based isolinux method as requested via \$ISOLINUX_METHOD."
       if grep -q '^include console.cfg' "${BUILD_OUTPUT}/boot/isolinux/distri.cfg" ; then
         einfo "include for console.cfg already found, nothing to do."
         eend 0
@@ -1428,7 +1432,7 @@ if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
 
     # autostart for Windows:
     if [ -d "${TEMPLATE_DIRECTORY}/windows/autostart/" ] ; then
-      cp ${TEMPLATE_DIRECTORY}/windows/autostart/* "$BUILD_OUTPUT"/
+      cp "${TEMPLATE_DIRECTORY}"/windows/autostart/* "$BUILD_OUTPUT"/
     fi
 
     FORCE_ISO_REBUILD=true
@@ -1455,7 +1459,7 @@ if [ -n "$CHROOT_INSTALL" ] ; then
   fi
 fi
 
-if [ -f "$BUILD_OUTPUT"/live/${GRML_NAME}.squashfs -a -z "$UPDATE" -a -z "$BUILD_ONLY" -a -z "$BUILD_DIRTY" ] ; then
+if [ -f "$BUILD_OUTPUT"/live/"${GRML_NAME}".squashfs -a -z "$UPDATE" -a -z "$BUILD_ONLY" -a -z "$BUILD_DIRTY" ] ; then
    log   "Skipping stage 'squashfs' as $BUILD_OUTPUT/live exists already."
    ewarn "Skipping stage 'squashfs' as $BUILD_OUTPUT/live exists already." ; eend 0
 elif [ -n "$SKIP_MKSQUASHFS" ] ; then
@@ -1507,15 +1511,15 @@ else
    einfo "Squashfs build information: running binary $SQUASHFS_BINARY $SQUASHFS_INFO_MSG"
 
    log "$SQUASHFS_BINARY $CHROOT_OUTPUT/ $BUILD_OUTPUT/live/${GRML_NAME}/${GRML_NAME}.squashfs -noappend $SQUASHFS_OPTIONS"
-
-   if $SQUASHFS_BINARY $CHROOT_OUTPUT/ $BUILD_OUTPUT/live/"${GRML_NAME}"/"${GRML_NAME}".squashfs \
+   # shellcheck disable=SC2086 # $SQUASHFS_OPTIONS needs splitting
+   if "$SQUASHFS_BINARY" "$CHROOT_OUTPUT/" "$BUILD_OUTPUT"/live/"${GRML_NAME}"/"${GRML_NAME}".squashfs \
       -noappend $SQUASHFS_OPTIONS 2>"${SQUASHFS_STDERR}" ; then
-      echo "${GRML_NAME}.squashfs" > $BUILD_OUTPUT/live/"${GRML_NAME}"/filesystem.module
+      echo "${GRML_NAME}.squashfs" > "$BUILD_OUTPUT"/live/"${GRML_NAME}"/filesystem.module
       log "Finished execution of stage 'squashfs' [$(date)]"
       einfo "Finished execution of stage 'squashfs'" ; eend 0
    else
       log    "Error: there was a critical error executing stage 'squashfs' [$(date)]:"
-      log    "$(cat $SQUASHFS_STDERR)"
+      log    "$(cat "$SQUASHFS_STDERR")"
       eerror "Error: there was a critical error executing stage 'squashfs':"
       cat    "${SQUASHFS_STDERR}"
       eend 1
@@ -1527,7 +1531,7 @@ fi
 
 # create md5sum file:
 if [ -z "$BOOTSTRAP_ONLY" ] ; then
-  ( cd $BUILD_OUTPUT/GRML/"${GRML_NAME}" &&
+  ( cd "$BUILD_OUTPUT"/GRML/"${GRML_NAME}" &&
   find ../.. -type f -not -name md5sums -not -name isolinux.bin -exec md5sum {} \; > md5sums )
 fi
 # }}}
@@ -1608,7 +1612,7 @@ elif [ -n "$SKIP_MKISOFS" ] ; then
 else
    mkdir -p "$ISO_OUTPUT" || bailout 6 "Problem with creating $ISO_OUTPUT for stage 'iso build'"
 
-   if $FORCE_ISO_REBUILD && ! [ -f "${ISO_OUTPUT}/${ISO_NAME}" ] ; then
+   if "$FORCE_ISO_REBUILD" && ! [ -f "${ISO_OUTPUT}/${ISO_NAME}" ] ; then
       log   "Forcing rebuild of ISO because files on ISO have been modified."
       einfo "Forcing rebuild of ISO because files on ISO have been modified."
    fi
@@ -1651,6 +1655,7 @@ else
 
       log "$MKISOFS -V '${GRML_NAME} ${VERSION}' -publisher 'grml-live | grml.org' -l -r -J $BOOT_ARGS $EFI_ARGS -no-pad -o ${ISO_OUTPUT}/${ISO_NAME} ."
       einfo "Generating ISO file..."
+      # shellcheck disable=SC2086 # BOOT_ARGS and EFI_ARGS need splitting
       $MKISOFS -V "${GRML_NAME} ${VERSION}" -publisher 'grml-live | grml.org' \
               -l -r -J $BOOT_ARGS $EFI_ARGS -no-pad \
               -o "${ISO_OUTPUT}/${ISO_NAME}" . ; RC=$?
@@ -1660,7 +1665,7 @@ else
       if [ "$RC" != 0 ] ; then
         log    "Error: critical error while generating ISO [exit code ${RC}]. Exiting."
         eerror "Error: critical error while generating ISO [exit code ${RC}]. Exiting." ; eend 1
-        bailout $RC
+        bailout "$RC"
       fi
 
       # pad the output ISO to multiples of 256 KiB for partition table support
@@ -1674,9 +1679,9 @@ else
       case $CLASSES in *RELEASE*)
          [ "$RC" = 0 ] && \
          (
-           if cd $ISO_OUTPUT ; then
-             sha256sum ${ISO_NAME} > ${ISO_NAME}.sha256 && \
-             touch -r ${ISO_NAME} ${ISO_NAME}.sha256
+           if cd "$ISO_OUTPUT" ; then
+             sha256sum "${ISO_NAME}" > "${ISO_NAME}.sha256" && \
+             touch -r "${ISO_NAME}" "${ISO_NAME}.sha256"
            fi
          )
          ;;
@@ -1691,7 +1696,7 @@ else
    else
       log    "Error: there was a critical error ($RC) executing stage 'iso build' [$(date)]"
       eerror "Error: there was a critical error executing stage 'iso build'" ; eend 1
-      bailout $RC
+      bailout "$RC"
    fi
 fi
 # }}}
@@ -1802,8 +1807,8 @@ create_netbootpackage() {
 
   if tar -C "$OUTPUTDIR" -cf "${OUTPUT_FILE}" "grml_netboot_package_${GRML_NAME}_${VERSION}" ; then
     (
-      cd $(dirname "${OUTPUT_FILE}")
-      sha256sum $(basename "${OUTPUT_FILE}") > "${OUTPUT_FILE}.sha256"
+      cd "$(dirname "${OUTPUT_FILE}")"
+      sha256sum "$(basename "${OUTPUT_FILE}")" > "${OUTPUT_FILE}.sha256"
     )
     einfo "Generated netboot package ${OUTPUT_FILE}" ; eend 0
     rm -rf "${OUTPUTDIR}"