diff --git a/contrib/ci/arch.sh b/contrib/ci/arch.sh
index cca46fe6b..d479f81d6 100755
--- a/contrib/ci/arch.sh
+++ b/contrib/ci/arch.sh
@@ -25,7 +25,7 @@ pacman -Syu --noconfirm python-flask
 # install and run TPM simulator necessary for plugins/uefi-capsule/uefi-self-test
 pacman -Syu --noconfirm swtpm tpm2-tools
 swtpm socket --tpm2 --server port=2321 --ctrl type=tcp,port=2322 --flags not-need-init --tpmstate "dir=$PWD" &
-trap "kill $!" EXIT
+trap 'kill $!' EXIT
 # extend a PCR0 value for test suite
 sleep 2
 tpm2_startup -c
diff --git a/contrib/ci/debian.sh b/contrib/ci/debian.sh
index 2fe56a9dd..d8615def2 100755
--- a/contrib/ci/debian.sh
+++ b/contrib/ci/debian.sh
@@ -76,7 +76,7 @@ if [ ! -f /.dockerenv ]; then
 fi
 
 #test the packages install
-PACKAGES=$(ls ../*.deb | grep -v 'fwupd-tests\|dbgsym')
+PACKAGES=$(find .. -type f -name "*.deb" | grep -v 'fwupd-tests\|dbgsym')
 dpkg -i $PACKAGES
 
 # run the installed tests
diff --git a/contrib/ci/debian_s390x.sh b/contrib/ci/debian_s390x.sh
index 64ddc11aa..f2a3cf49f 100755
--- a/contrib/ci/debian_s390x.sh
+++ b/contrib/ci/debian_s390x.sh
@@ -7,7 +7,8 @@ export LC_ALL=C.UTF-8
 #evaluate using Debian's build flags
 eval "$(dpkg-buildflags --export=sh)"
 #filter out -Bsymbolic-functions
-export LDFLAGS=$(dpkg-buildflags --get LDFLAGS | sed "s/-Wl,-Bsymbolic-functions\s//")
+LDFLAGS=$(dpkg-buildflags --get LDFLAGS | sed "s/-Wl,-Bsymbolic-functions\s//")
+export LDFLAGS
 
 rm -rf build
 mkdir -p build
diff --git a/contrib/ci/snap.sh b/contrib/ci/snap.sh
index 70e5b300a..997660e22 100755
--- a/contrib/ci/snap.sh
+++ b/contrib/ci/snap.sh
@@ -1,4 +1,6 @@
 #!/bin/sh
+set -e
 
+mkdir -p /build
 cd /build
 snapcraft
diff --git a/contrib/ci/ubuntu.sh b/contrib/ci/ubuntu.sh
index 7326fccea..4155a934d 100755
--- a/contrib/ci/ubuntu.sh
+++ b/contrib/ci/ubuntu.sh
@@ -14,10 +14,12 @@ set -x
 export DEB_BUILD_MAINT_OPTIONS="optimize=-lto"
 eval "$(dpkg-buildflags --export=sh)"
 #filter out -Bsymbolic-functions
-export LDFLAGS=$(dpkg-buildflags --get LDFLAGS | sed "s/-Wl,-Bsymbolic-functions\s//")
+LDFLAGS=$(dpkg-buildflags --get LDFLAGS | sed "s/-Wl,-Bsymbolic-functions\s//")
+export LDFLAGS
 
-rm -rf build
-meson build -Dman=false -Ddocs=docgen -Dgusb:tests=false -Dplugin_platform_integrity=true --prefix=$(pwd)/dist
+root=$(pwd)
+rm -rf ${root}/build
+meson build -Dman=false -Ddocs=docgen -Dgusb:tests=false -Dplugin_platform_integrity=true --prefix=${root}/dist
 #build with clang
 ninja -C build test -v
 
diff --git a/contrib/snap/fwupd-command b/contrib/snap/fwupd-command
index ed6b74cd2..d02f13922 100755
--- a/contrib/snap/fwupd-command
+++ b/contrib/snap/fwupd-command
@@ -23,6 +23,7 @@ fi
 # re-generate gio modules in local cache
 needs_update=true
 if [ -f $SNAP_USER_DATA/.last_revision ]; then
+  # shellcheck source=/dev/null
   . $SNAP_USER_DATA/.last_revision 2>/dev/null
 fi
 if [ "$SNAP_DESKTOP_LAST_REVISION" = "$SNAP_REVISION" ]; then
diff --git a/contrib/vscode/launcher.sh b/contrib/vscode/launcher.sh
index 6cbae1f95..8cea6bdce 100755
--- a/contrib/vscode/launcher.sh
+++ b/contrib/vscode/launcher.sh
@@ -1,8 +1,9 @@
 #!/bin/sh
+gcc=$(gcc -dumpmachine)
 export ROOT=#ROOT#
 export FWUPD_LOCALSTATEDIR=${ROOT}/dist
 export FWUPD_SYSCONFDIR=${ROOT}/dist/etc
-export LD_LIBRARY_PATH=${ROOT}/dist/lib/$(gcc -dumpmachine)
+export LD_LIBRARY_PATH=${ROOT}/dist/lib/${gcc}
 if [ -n "${DEBUG}" ]; then
         DEBUG="gdbserver localhost:9091"
 fi
diff --git a/plugins/uefi-capsule/fwupd.grub.conf.in b/plugins/uefi-capsule/fwupd.grub.conf.in
index 7816b2e57..48ab49a77 100755
--- a/plugins/uefi-capsule/fwupd.grub.conf.in
+++ b/plugins/uefi-capsule/fwupd.grub.conf.in
@@ -2,17 +2,20 @@
 # SPDX-License-Identifier: LGPL-2.1+
 set -e
 
+${pkgdatadir:?}
+# shellcheck source=/dev/null
 . "$pkgdatadir/grub-mkconfig_lib"
 
 if [ -f @localstatedir@/lib/fwupd/uefi_capsule.conf ] &&
-   ls /sys/firmware/efi/efivars/fwupd-*-0abba7dc-e516-4167-bbf5-4d9d1c739416 2>&1 1>/dev/null; then
+   ls /sys/firmware/efi/efivars/fwupd-*-0abba7dc-e516-4167-bbf5-4d9d1c739416 1>/dev/null 2>&1; then
       source @localstatedir@/lib/fwupd/uefi_capsule.conf
       if [ "${EFI_PATH}" != "" ] && [ "${ESP}" != "" ]; then
       echo "Adding Linux Firmware Updater entry" >&2
 cat << EOF
 menuentry 'Linux Firmware Updater' \$menuentry_id_option 'fwupd' {
 EOF
-      prepare_grub_to_access_device `${grub_probe} --target=device \${ESP}` | sed -e "s/^/\t/"
+      ${grub_probe:?}
+      prepare_grub_to_access_device '`${grub_probe} --target=device \${ESP}` | sed -e "s/^/\t/"'
 cat << EOF
 	chainloader ${EFI_PATH}
 }