diff --git a/extensions/allwinner-kernel-bump.sh b/extensions/allwinner-kernel-bump.sh
index 92c8d4afcf31..ab4d07eb6166 100644
--- a/extensions/allwinner-kernel-bump.sh
+++ b/extensions/allwinner-kernel-bump.sh
@@ -35,11 +35,11 @@ function extension_finish_config__prepare_megous_patches() {
 		patch_dir_megous="${patch_dir_base}/patches.megous"
 		patch_dir_tmp="${patch_dir_base}/patches.megi"
 
-		if [[ -d ${patch_dir_base} ]]; then
+		if [[ -d "${patch_dir_base}" ]]; then
 			display_alert "allwinner-kernel-bump" "Found existing kernel patch directory" "info"
 			if [[ "${OVERWRITE_PATCHDIR:-no}" == "yes" ]]; then
 				display_alert "allwinner-kernel-bump" "Removing as requested. Any manual changes will get overwritten" "info"
-				rm -rf ${patch_dir_base}
+				rm -rf "${patch_dir_base}"
 			else
 				display_alert "allwinner-kernel-bump" "Skipping kernel patch directory creation" "info"
 				return 0
@@ -59,38 +59,38 @@ function extension_finish_config__prepare_megous_patches() {
 		run_host_command_logged mkdir -pv "${git_bundles_dir}"
 		run_host_command_logged rm "${bundle_file}" || true
 		do_with_retries 5 axel "--output=${bundle_file}" "${bundle_url}"
-		run_host_command_logged git -C ${kernel_work_dir} fetch ${bundle_file} '+refs/heads/*:refs/remotes/megous/*'
+		run_host_command_logged git -C "${kernel_work_dir}" fetch "${bundle_file}" '+refs/heads/*:refs/remotes/megous/*'
 
 		display_alert "allwinner-kernel-bump" "Initializing kernel patch directory using previous kernel patch dir" "info"
-		run_host_command_logged cp -aR ${PREV_KERNEL_PATCH_DIR} ${patch_dir_base}
+		run_host_command_logged cp -aR "${PREV_KERNEL_PATCH_DIR}" "${patch_dir_base}"
 
 		# Removing older copy of megous patches and series.conf file
-		run_host_command_logged rm -rf ${patch_dir_base}/patches.megous/*
-		run_host_command_logged rm -f ${patch_dir_base}/series.{conf,megous}
+		run_host_command_logged rm -rf "${patch_dir_base}"/patches.megous/*
+		run_host_command_logged rm -f "${patch_dir_base}"/series.{conf,megous}
 
 		display_alert "allwinner-kernel-bump" "Extracting latest Megous patches" "info"
 		megous_trees=("a83t-suspend" "af8133j" "anx" "audio" "axp" "cam" "drm"
 			"err" "fixes" "mbus" "modem" "opi3" "pb" "pinetab" "pp" "ppkb" "samuel"
 			"speed" "tbs-a711" "ths")
 
-		run_host_command_logged mkdir -p ${patch_dir_megous} ${patch_dir_tmp}
+		run_host_command_logged mkdir -p "${patch_dir_megous}" "${patch_dir_tmp}"
 
-		for tree in ${megous_trees[@]}; do
-			run_host_command_logged "${SRC}"/tools/mk_format_patch ${kernel_work_dir} master..megous/${tree}-${KERNEL_MAJOR_MINOR} ${patch_dir_megous} sufix=megi
-			run_host_command_logged cp ${patch_dir_megous}/* ${patch_dir_tmp}
-			run_host_command_logged cat ${patch_dir_base}/series.megous ">>" ${patch_dir_base}/series.megi
+		for tree in "${megous_trees[@]}"; do
+			run_host_command_logged "${SRC}"/tools/mk_format_patch "${kernel_work_dir}" "master..megous/${tree}-${KERNEL_MAJOR_MINOR}" "${patch_dir_megous}" sufix=megi
+			run_host_command_logged cp "${patch_dir_megous}"/* "${patch_dir_tmp}"
+			run_host_command_logged cat "${patch_dir_base}/series.megous" ">>" "${patch_dir_base}/series.megi"
 		done
 
-		run_host_command_logged cp ${patch_dir_tmp}/* ${patch_dir_megous}
-		run_host_command_logged mv ${patch_dir_base}/series.megi ${patch_dir_base}/series.megous
-		run_host_command_logged rm -rf ${patch_dir_tmp} ${patch_dir_base}/series.megi
+		run_host_command_logged cp "${patch_dir_tmp}"/* "${patch_dir_megous}"
+		run_host_command_logged mv "${patch_dir_base}/series.megi" "${patch_dir_base}/series.megous"
+		run_host_command_logged rm -rf "${patch_dir_tmp}" "${patch_dir_base}/series.megi"
 
 		# Disable previously disabled patches
-		grep '^-' ${PREV_KERNEL_PATCH_DIR}/series.megous | awk -F / '{print $NF}' | xargs -I {} sed -i "/\/{}/s/^/-/g" ${patch_dir_base}/series.megous
+		grep '^-' "${PREV_KERNEL_PATCH_DIR}/series.megous" | awk -F / '{print $NF}' | xargs -I {} sed -i "/\/{}/s/^/-/g" "${patch_dir_base}/series.megous"
 
 		display_alert "allwinner-kernel-bump" "Generating series.conf file" "info"
-		run_host_command_logged cat ${patch_dir_base}/series.megous ">>" ${patch_dir_base}/series.conf
-		run_host_command_logged cat ${patch_dir_base}/series.fixes ">>" ${patch_dir_base}/series.conf
-		run_host_command_logged cat ${patch_dir_base}/series.armbian ">>" ${patch_dir_base}/series.conf
+		run_host_command_logged cat "${patch_dir_base}/series.megous" ">>" "${patch_dir_base}/series.conf"
+		run_host_command_logged cat "${patch_dir_base}/series.fixes" ">>" "${patch_dir_base}/series.conf"
+		run_host_command_logged cat "${patch_dir_base}/series.armbian" ">>" "${patch_dir_base}/series.conf"
 	fi
 }
diff --git a/extensions/cloud-init/cloud-init.sh b/extensions/cloud-init/cloud-init.sh
index aee4b7dc640f..af3165f95e2f 100644
--- a/extensions/cloud-init/cloud-init.sh
+++ b/extensions/cloud-init/cloud-init.sh
@@ -44,13 +44,13 @@ function pre_customize_image__inject_cloud_init_config() {
 	display_alert "Extension: ${EXTENSION}: Configuring" "cloud-init" "info"
 	local config_src="${EXTENSION_DIR}/config"
 	local config_dst="${SDCARD}/etc/cloud/cloud.cfg.d"
-	run_host_command_logged cp ${config_src}/* $config_dst
+	run_host_command_logged cp "${config_src}"/* "${config_dst}"
 
 	# Provide default cloud-init files
 	display_alert "Extension: ${EXTENSION}: Defaults" "cloud-init" "info"
 	local defaults_src="${EXTENSION_DIR}/defaults"
 	local defaults_dst="${SDCARD}/boot"
-	run_host_command_logged cp ${defaults_src}/* $defaults_dst
+	run_host_command_logged cp "${defaults_src}"/* "${defaults_dst}"
 	return 0
 }
 
@@ -59,8 +59,8 @@ function pre_customize_image__disable_armbian_first_run() {
 	display_alert "Extension: ${EXTENSION}: Disabling" "armbian firstrun" "info"
 
 	# Clean up default profile and network
-	rm -f ${SDCARD}/etc/profile.d/armbian-check-first-*
-	rm -f ${SDCARD}/etc/netplan/armbian-*
+	rm -f "${SDCARD}"/etc/profile.d/armbian-check-first-*
+	rm -f "${SDCARD}"/etc/netplan/armbian-*
 
 	# remove any networkd config leftover from armbian build
 	rm -f "${SDCARD}"/etc/systemd/network/*.network || true
diff --git a/extensions/image-output-abl.sh b/extensions/image-output-abl.sh
index f6622c520794..ed0a64f3f0a0 100644
--- a/extensions/image-output-abl.sh
+++ b/extensions/image-output-abl.sh
@@ -5,47 +5,47 @@ function add_host_dependencies__abl_host_deps() {
 function post_build_image__900_convert_to_abl_img() {
 	[[ -z $version ]] && exit_with_error "version is not set"
 
-	if [ ! -z "$UEFI_GRUB_TARGET" ]; then
+	if [[ -n "$UEFI_GRUB_TARGET" ]]; then
 		display_alert "Ignore" "${EXTENSION}" "info"
 		return 0
 	fi
 
-	if [ ! -z "$BOOTFS_TYPE" ]; then
+	if [[ -n "$BOOTFS_TYPE" ]]; then
 		return 0
 	fi
 
 	display_alert "Converting image $version to rootfs" "${EXTENSION}" "info"
 	declare -g ROOTFS_IMAGE_FILE="${DESTIMG}/${version}.rootfs.img"
-	rootfs_start_sector=$(gdisk -l ${DESTIMG}/${version}.img | grep rootfs | awk '{print $2}')
-	rootfs_end_sector=$(gdisk -l ${DESTIMG}/${version}.img | grep rootfs | awk '{print $3}')
+	rootfs_start_sector=$(gdisk -l "${DESTIMG}/${version}.img" | grep rootfs | awk '{print $2}')
+	rootfs_end_sector=$(gdisk -l "${DESTIMG}/${version}.img" | grep rootfs | awk '{print $3}')
 	old_rootfs_image_mount_dir=${DESTIMG}/rootfs-old
 	new_rootfs_image_mount_dir=${DESTIMG}/rootfs-new
-	mkdir -p ${old_rootfs_image_mount_dir} ${new_rootfs_image_mount_dir}
-	truncate --size=9728M ${ROOTFS_IMAGE_FILE}
-	mkfs.ext4 -F ${ROOTFS_IMAGE_FILE}
-	new_rootfs_image_uuid=$(blkid -s UUID -o value ${ROOTFS_IMAGE_FILE})
-	old_image_loop_device=$(losetup -f -P --show ${DESTIMG}/${version}.img)
-	old_rootfs_image_uuid=$(blkid -s UUID -o value ${old_image_loop_device}p1)
-	mount ${old_image_loop_device}p1 ${old_rootfs_image_mount_dir}
-	mount ${ROOTFS_IMAGE_FILE} ${new_rootfs_image_mount_dir}
-	cp -rfp ${old_rootfs_image_mount_dir}/* ${new_rootfs_image_mount_dir}/
-	umount ${old_rootfs_image_mount_dir}
-	losetup -d ${old_image_loop_device}
-	rm ${DESTIMG}/${version}.img
+	mkdir -p "${old_rootfs_image_mount_dir}" "${new_rootfs_image_mount_dir}"
+	truncate --size=9728M "${ROOTFS_IMAGE_FILE}"
+	mkfs.ext4 -F "${ROOTFS_IMAGE_FILE}"
+	new_rootfs_image_uuid=$(blkid -s UUID -o value "${ROOTFS_IMAGE_FILE}")
+	old_image_loop_device=$(losetup -f -P --show "${DESTIMG}/${version}.img")
+	old_rootfs_image_uuid=$(blkid -s UUID -o value "${old_image_loop_device}p1")
+	mount "${old_image_loop_device}p1" "${old_rootfs_image_mount_dir}"
+	mount "${ROOTFS_IMAGE_FILE}" "${new_rootfs_image_mount_dir}"
+	cp -rfp "${old_rootfs_image_mount_dir}"/* "${new_rootfs_image_mount_dir}"/
+	umount "${old_rootfs_image_mount_dir}"
+	losetup -d "${old_image_loop_device}"
+	rm "${DESTIMG}/${version}.img"
 	display_alert "Replace root partition uuid from ${old_rootfs_image_uuid} to ${new_rootfs_image_uuid} in /etc/fstab" "${EXTENSION}" "info"
-	sed -i "s|${old_rootfs_image_uuid}|${new_rootfs_image_uuid}|g" ${new_rootfs_image_mount_dir}/etc/fstab
-	source ${new_rootfs_image_mount_dir}/boot/armbianEnv.txt
+	sed -i "s|${old_rootfs_image_uuid}|${new_rootfs_image_uuid}|g" "${new_rootfs_image_mount_dir}/etc/fstab"
+	source "${new_rootfs_image_mount_dir}/boot/armbianEnv.txt"
 	declare -g bootimg_cmdline="${BOOTIMG_CMDLINE_EXTRA} root=UUID=${new_rootfs_image_uuid} slot_suffix=${abl_boot_partition_label#boot} ${extraargs}"
 
-	if [ ${#ABL_DTB_LIST[@]} -ne 0 ]; then
+	if [[ ${#ABL_DTB_LIST[@]} -ne 0 ]]; then
 		display_alert "Going to create abl kernel boot image" "${EXTENSION}" "info"
-		gzip -c ${new_rootfs_image_mount_dir}/boot/vmlinuz-*-* > ${DESTIMG}/Image.gz
+		gzip -c "${new_rootfs_image_mount_dir}"/boot/vmlinuz-*-* > "${DESTIMG}/Image.gz"
 		for dtb_name in "${ABL_DTB_LIST[@]}"; do
 			display_alert "Creatng abl kernel boot image with dtb ${dtb_name} and cmdline ${bootimg_cmdline} " "${EXTENSION}" "info"
-			cat ${DESTIMG}/Image.gz ${new_rootfs_image_mount_dir}/usr/lib/linux-image-*/qcom/${dtb_name}.dtb > ${DESTIMG}/Image.gz-${dtb_name}
+			cat "${DESTIMG}/Image.gz" "${new_rootfs_image_mount_dir}"/usr/lib/linux-image-*/qcom/"${dtb_name}.dtb" > "${DESTIMG}/Image.gz-${dtb_name}"
 			/usr/bin/mkbootimg \
-				--kernel ${DESTIMG}/Image.gz-${dtb_name} \
-				--ramdisk ${new_rootfs_image_mount_dir}/boot/initrd.img-*-* \
+				--kernel "${DESTIMG}/Image.gz-${dtb_name}" \
+				--ramdisk "${new_rootfs_image_mount_dir}"/boot/initrd.img-*-* \
 				--base 0x0 \
 				--second_offset 0x00f00000 \
 				--cmdline "${bootimg_cmdline}" \
@@ -53,25 +53,24 @@ function post_build_image__900_convert_to_abl_img() {
 				--ramdisk_offset 0x1000000 \
 				--tags_offset 0x100 \
 				--pagesize 4096 \
-				-o ${DESTIMG}/${version}.boot_${dtb_name}.img
+				-o "${DESTIMG}/${version}.boot_${dtb_name}.img"
 		done
 		display_alert "Creatng abl kernel boot recovery image with dtb ${ABL_DTB_LIST[0]}" "${EXTENSION}" "info"
-		cat ${DESTIMG}/Image.gz ${new_rootfs_image_mount_dir}/usr/lib/linux-image-*/qcom/${dtb_name}.dtb > ${DESTIMG}/Image.gz-${dtb_name}
 		/usr/bin/mkbootimg \
-			--kernel ${DESTIMG}/Image.gz-${ABL_DTB_LIST[0]} \
-			--ramdisk ${new_rootfs_image_mount_dir}/boot/initrd.img-*-* \
+			--kernel "${DESTIMG}/Image.gz-${ABL_DTB_LIST[0]}" \
+			--ramdisk "${new_rootfs_image_mount_dir}"/boot/initrd.img-*-* \
 			--base 0x0 \
 			--second_offset 0x00f00000 \
 			--kernel_offset 0x8000 \
 			--ramdisk_offset 0x1000000 \
 			--tags_offset 0x100 \
 			--pagesize 4096 \
-			-o ${DESTIMG}/${version}.boot_recovery.img
+			-o "${DESTIMG}/${version}.boot_recovery.img"
 	fi
 
-	umount ${new_rootfs_image_mount_dir}
-	rm -rf ${new_rootfs_image_mount_dir}
-	e2fsck -p -f ${ROOTFS_IMAGE_FILE}
-	resize2fs -M ${ROOTFS_IMAGE_FILE}
+	umount "${new_rootfs_image_mount_dir}"
+	rm -rf "${new_rootfs_image_mount_dir}"
+	e2fsck -p -f "${ROOTFS_IMAGE_FILE}"
+	resize2fs -M "${ROOTFS_IMAGE_FILE}"
 	return 0
 }
diff --git a/extensions/lvm.sh b/extensions/lvm.sh
index 9e1b1774e6ce..f001ec6f7944 100644
--- a/extensions/lvm.sh
+++ b/extensions/lvm.sh
@@ -33,9 +33,9 @@ function extension_prepare_config__prepare_lvm() {
 
 function post_create_partitions__setup_lvm() {
 	# Setup LVM on the partition, ROOTFS
-	parted -s ${SDCARD}.raw -- set ${rootpart} lvm on
+	parted -s "${SDCARD}.raw" -- set "${rootpart}" lvm on
 	display_alert "LVM Partition table created" "${EXTENSION}" "info"
-	parted -s ${SDCARD}.raw -- print >> "${DEST}"/${LOG_SUBPATH}/lvm.log 2>&1
+	parted -s "${SDCARD}.raw" -- print >> "${DEST}/${LOG_SUBPATH}/lvm.log" 2>&1
 }
 
 function prepare_root_device__create_volume_group() {
@@ -52,25 +52,25 @@ function prepare_root_device__create_volume_group() {
 
 	# Create the PV VG and VOL
 	display_alert "LVM Creating VG" "${rootdevice}" "info"
-	check_loop_device ${rootdevice}
-	pvcreate ${rootdevice}
+	check_loop_device "${rootdevice}"
+	pvcreate "${rootdevice}"
 	wait_for_disk_sync "wait for pvcreate to sync"
-	vgcreate ${LVM_VG_NAME} ${rootdevice}
+	vgcreate "${LVM_VG_NAME}" "${rootdevice}"
 	add_cleanup_handler cleanup_lvm
 	wait_for_disk_sync "wait for vgcreate to sync"
 	# Note that devices wont come up automatically inside docker
-	lvcreate -Zn --name root --size ${volsize}M ${LVM_VG_NAME}
+	lvcreate -Zn --name root --size "${volsize}M" "${LVM_VG_NAME}"
 	vgmknodes
-	lvs >> "${DEST}"/${LOG_SUBPATH}/lvm.log 2>&1
-	
-	rootdevice=/dev/mapper/${LVM_VG_NAME}-root
+	lvs >> "${DEST}/${LOG_SUBPATH}/lvm.log" 2>&1
+
+	rootdevice="/dev/mapper/${LVM_VG_NAME}-root"
 	display_alert "LVM created volume group - root device ${rootdevice}" "${EXTENSION}" "info"
 }
 
 function format_partitions__format_lvm() {
 	# Label the root volume
-	e2label /dev/mapper/${LVM_VG_NAME}-root armbi_root
-	blkid | grep ${LVM_VG_NAME} >> "${DEST}"/${LOG_SUBPATH}/lvm.log 2>&1
+	e2label "/dev/mapper/${LVM_VG_NAME}-root" armbi_root
+	blkid | grep "${LVM_VG_NAME}" >> "${DEST}/${LOG_SUBPATH}/lvm.log" 2>&1
 	display_alert "LVM labeled partitions" "${EXTENSION}" "info"
 }
 
@@ -79,6 +79,6 @@ function post_umount_final_image__cleanup_lvm(){
 }
 
 function cleanup_lvm() {
-	vgchange -a n ${LVM_VG_NAME} >> "${DEST}"/${LOG_SUBPATH}/lvm.log 2>&1 || true
+	vgchange -a n "${LVM_VG_NAME}" >> "${DEST}/${LOG_SUBPATH}/lvm.log" 2>&1 || true
 	display_alert "LVM deactivated volume group" "${EXTENSION}" "info"
 }
\ No newline at end of file
diff --git a/extensions/uwe5622-allwinner.sh b/extensions/uwe5622-allwinner.sh
index 219b385f534a..0517609909b2 100644
--- a/extensions/uwe5622-allwinner.sh
+++ b/extensions/uwe5622-allwinner.sh
@@ -11,13 +11,13 @@ function post_family_config__add_uwe5622_modules() {
 
 function post_family_tweaks__enable_uwe5622_services() {
 	# install and enable Bluetooth
-	chroot $SDCARD /bin/bash -c "systemctl --no-reload enable aw859a-bluetooth.service >/dev/null 2>&1"
-	chroot $SDCARD /bin/bash -c "systemctl --no-reload enable aw859a-wifi.service >/dev/null 2>&1"
+	chroot "${SDCARD}" /bin/bash -c "systemctl --no-reload enable aw859a-bluetooth.service >/dev/null 2>&1"
+	chroot "${SDCARD}" /bin/bash -c "systemctl --no-reload enable aw859a-wifi.service >/dev/null 2>&1"
 }
 
 function post_family_tweaks_bsp__add_uwe5622_services() {
-	run_host_command_logged mkdir -p $destination/lib/systemd/system/
-	run_host_command_logged cp $SRC/packages/bsp/sunxi/aw859a-bluetooth.service $destination/lib/systemd/system/
-	run_host_command_logged cp $SRC/packages/bsp/sunxi/aw859a-wifi.service $destination/lib/systemd/system/
-	run_host_command_logged install -m 755 $SRC/packages/blobs/bt/hciattach/hciattach_opi_${ARCH} $destination/usr/bin/hciattach_opi
+	run_host_command_logged mkdir -p "${destination}/lib/systemd/system/"
+	run_host_command_logged cp "${SRC}/packages/bsp/sunxi/aw859a-bluetooth.service" "${destination}/lib/systemd/system/"
+	run_host_command_logged cp "${SRC}/packages/bsp/sunxi/aw859a-wifi.service" "${destination}/lib/systemd/system/"
+	run_host_command_logged install -m 755 "${SRC}/packages/blobs/bt/hciattach/hciattach_opi_${ARCH}" "${destination}/usr/bin/hciattach_opi"
 }
diff --git a/lib/functions/image/partitioning.sh b/lib/functions/image/partitioning.sh
index 6262fe197ab5..e19b8002e83a 100644
--- a/lib/functions/image/partitioning.sh
+++ b/lib/functions/image/partitioning.sh
@@ -284,7 +284,7 @@ function prepare_partitions() {
 	check_loop_device "${LOOP}" # check again, now it has to have a size! otherwise wait.
 
 	# stage: create fs, mount partitions, create fstab
-	rm -f $SDCARD/etc/fstab
+	rm -f "${SDCARD}/etc/fstab"
 
 	declare root_part_uuid="uninitialized"
 
@@ -316,11 +316,12 @@ function prepare_partitions() {
 		wait_for_disk_sync "after mkfs" # force writes to be really flushed
 
 		# store in readonly global for usage in later hooks
-		root_part_uuid="$(blkid -s UUID -o value ${LOOP}p${rootpart})"
+		root_part_uuid="$(blkid -s UUID -o value "${LOOP}p${rootpart}")"
 		declare -g -r ROOT_PART_UUID="${root_part_uuid}"
 
 		display_alert "Mounting rootfs" "$rootdevice (UUID=${ROOT_PART_UUID})"
-		run_host_command_logged mount ${fscreateopt} $rootdevice $MOUNT/
+		# shellcheck disable=SC2086 # fscreateopt must word-split ("-o" and "compress-force=..." as two args) or be empty
+		run_host_command_logged mount ${fscreateopt} "$rootdevice" "$MOUNT"/
 
 		# create fstab (and crypttab) entry
 		if [[ $CRYPTROOT_ENABLE == yes ]]; then
@@ -328,26 +329,26 @@ function prepare_partitions() {
 			if [[ $CRYPTROOT_AUTOUNLOCK == yes ]]; then
 				luks_key_file="/etc/rootfs.key"
 				display_alert "Saving rootfs.key and configuration for autounlock" "(location=${luks_key_file})"
-				mv ${cryptroot_autounlock_key_file:?} ${SDCARD}${luks_key_file}
-				mkdir -p $SDCARD/etc/initramfs-tools/conf.d/
-				echo "UMASK=0077" > $SDCARD/etc/initramfs-tools/conf.d/key-umask.conf
-				echo "" >> $SDCARD/etc/cryptsetup-initramfs/conf-hook
-				echo "KEYFILE_PATTERN=${luks_key_file}" >> $SDCARD/etc/cryptsetup-initramfs/conf-hook
+				mv "${cryptroot_autounlock_key_file:?}" "${SDCARD}${luks_key_file}"
+				mkdir -p "${SDCARD}/etc/initramfs-tools/conf.d/"
+				echo "UMASK=0077" > "${SDCARD}/etc/initramfs-tools/conf.d/key-umask.conf"
+				echo "" >> "${SDCARD}/etc/cryptsetup-initramfs/conf-hook"
+				echo "KEYFILE_PATTERN=${luks_key_file}" >> "${SDCARD}/etc/cryptsetup-initramfs/conf-hook"
 			fi
 			# map the LUKS container partition via its UUID to be the 'cryptroot' device
-			physical_root_part_uuid="$(blkid -s UUID -o value $physical_rootdevice)"
-			echo "$CRYPTROOT_MAPPER UUID=${physical_root_part_uuid} ${luks_key_file} luks" >> $SDCARD/etc/crypttab
-			run_host_command_logged cat $SDCARD/etc/crypttab
+			physical_root_part_uuid="$(blkid -s UUID -o value "$physical_rootdevice")"
+			echo "$CRYPTROOT_MAPPER UUID=${physical_root_part_uuid} ${luks_key_file} luks" >> "${SDCARD}/etc/crypttab"
+			run_host_command_logged cat "${SDCARD}/etc/crypttab"
 		fi
 
 		if [[ $ROOTFS_TYPE == btrfs ]]; then
 			btrfs_root_subvolume="${BTRFS_ROOT_SUBVOLUME:-@}"
 			mountopts[$ROOTFS_TYPE]='commit=120'
-			run_host_command_logged btrfs subvolume create $MOUNT/$btrfs_root_subvolume
+			run_host_command_logged btrfs subvolume create "$MOUNT/$btrfs_root_subvolume"
 			# getting the subvolume id of the newly created volume @ to install it
 			# as the default volume for mounting without explicit reference
 
-			run_host_command_logged "btrfs subvolume set-default $MOUNT/$btrfs_root_subvolume"
+			run_host_command_logged btrfs subvolume set-default "$MOUNT/$btrfs_root_subvolume"
 
 			call_extension_method "btrfs_root_add_subvolumes" <<- 'BTRFS_ROOT_ADD_SUBVOLUMES'
 				# *custom post btrfs rootfs creation hook*
@@ -361,12 +362,13 @@ function prepare_partitions() {
 				run_host_command_logged btrfs subvolume create $MOUNT/@srv
 			BTRFS_ROOT_ADD_SUBVOLUMES
 
-			run_host_command_logged umount $rootdevice
+			run_host_command_logged umount "$rootdevice"
 			display_alert "Remounting rootfs" "$rootdevice (UUID=${ROOT_PART_UUID})"
-			run_host_command_logged mount -odefaults,${mountopts[$ROOTFS_TYPE]} ${fscreateopt} $rootdevice $MOUNT/
+			# shellcheck disable=SC2086 # fscreateopt must word-split ("-o" and "compress-force=..." as two args) or be empty
+			run_host_command_logged mount -odefaults,${mountopts[$ROOTFS_TYPE]} ${fscreateopt} "$rootdevice" "$MOUNT"/
 		fi
-		rootfs="UUID=$(blkid -s UUID -o value $rootdevice)"
-		echo "$rootfs / ${mkfs[$ROOTFS_TYPE]} defaults,${mountopts[$ROOTFS_TYPE]} 0 1" >> $SDCARD/etc/fstab
+		rootfs="UUID=$(blkid -s UUID -o value "$rootdevice")"
+		echo "$rootfs / ${mkfs[$ROOTFS_TYPE]} defaults,${mountopts[$ROOTFS_TYPE]} 0 1" >> "${SDCARD}/etc/fstab"
 		if [[ $ROOTFS_TYPE == btrfs ]]; then
 			call_extension_method "btrfs_root_add_subvolumes_fstab" <<- 'BTRFS_ROOT_ADD_SUBVOLUMES_FSTAB'
 				run_host_command_logged mkdir -p $MOUNT/home
@@ -387,12 +389,12 @@ function prepare_partitions() {
 			BTRFS_ROOT_ADD_SUBVOLUMES_FSTAB
 		fi
 
-		run_host_command_logged cat $SDCARD/etc/fstab
+		run_host_command_logged cat "${SDCARD}/etc/fstab"
 
 	else
 		# update_initramfs will fail if /lib/modules/ doesn't exist
-		mount --bind --make-private $SDCARD $MOUNT/
-		echo "/dev/nfs / nfs defaults 0 0" >> $SDCARD/etc/fstab
+		mount --bind --make-private "$SDCARD" "$MOUNT"/
+		echo "/dev/nfs / nfs defaults 0 0" >> "${SDCARD}/etc/fstab"
 	fi
 
 	##
@@ -401,10 +403,11 @@ function prepare_partitions() {
 	if [[ -n $bootpart ]]; then
 		display_alert "Creating /boot" "$bootfs on ${LOOP}p${bootpart}"
 		check_loop_device "${LOOP}p${bootpart}"
-		run_host_command_logged mkfs.${mkfs[$bootfs]} ${mkopts[$bootfs]} ${mkopts_label[$bootfs]:+${mkopts_label[$bootfs]}"$BOOT_FS_LABEL"} ${LOOP}p${bootpart}
-		mkdir -p $MOUNT/boot/
-		run_host_command_logged mount ${LOOP}p${bootpart} $MOUNT/boot/
-		echo "UUID=$(blkid -s UUID -o value ${LOOP}p${bootpart}) /boot ${mkfs[$bootfs]} defaults${mountopts[$bootfs]} 0 2" >> $SDCARD/etc/fstab
+		# shellcheck disable=SC2086 # mkopts must word-split into separate arguments (e.g. "-q -m 2" → two args)
+		run_host_command_logged "mkfs.${mkfs[$bootfs]}" ${mkopts[$bootfs]} ${mkopts_label[$bootfs]:+${mkopts_label[$bootfs]}"$BOOT_FS_LABEL"} "${LOOP}p${bootpart}"
+		mkdir -p "$MOUNT/boot/"
+		run_host_command_logged mount "${LOOP}p${bootpart}" "$MOUNT/boot/"
+		echo "UUID=$(blkid -s UUID -o value "${LOOP}p${bootpart}") /boot ${mkfs[$bootfs]} defaults${mountopts[$bootfs]} 0 2" >> "${SDCARD}/etc/fstab"
 	fi
 
 	##
@@ -413,17 +416,17 @@ function prepare_partitions() {
 	if [[ -n $uefipart ]]; then
 		display_alert "Creating EFI partition" "FAT32 ${UEFI_MOUNT_POINT} on ${LOOP}p${uefipart} label ${UEFI_FS_LABEL}"
 		check_loop_device "${LOOP}p${uefipart}"
-		run_host_command_logged mkfs.fat -F32 -n "${UEFI_FS_LABEL^^}" ${LOOP}p${uefipart} 2>&1 # "^^" makes variable UPPERCASE, required for FAT32.
+		run_host_command_logged mkfs.fat -F32 -n "${UEFI_FS_LABEL^^}" "${LOOP}p${uefipart}" 2>&1 # "^^" makes variable UPPERCASE, required for FAT32.
 		mkdir -p "${MOUNT}${UEFI_MOUNT_POINT}"
-		run_host_command_logged mount ${LOOP}p${uefipart} "${MOUNT}${UEFI_MOUNT_POINT}"
+		run_host_command_logged mount "${LOOP}p${uefipart}" "${MOUNT}${UEFI_MOUNT_POINT}"
 
 		# Allow skipping the fstab entry for the EFI partition if UEFI_MOUNT_POINT_SKIP_FSTAB=yes; add comments instead if so
 		if [[ "${UEFI_MOUNT_POINT_SKIP_FSTAB:-"no"}" == "yes" ]]; then
 			display_alert "Skipping EFI partition in fstab" "UEFI_MOUNT_POINT_SKIP_FSTAB=${UEFI_MOUNT_POINT_SKIP_FSTAB}" "debug"
 			echo "# /boot/efi fstab commented out due to UEFI_MOUNT_POINT_SKIP_FSTAB=${UEFI_MOUNT_POINT_SKIP_FSTAB}"
-			echo "# UUID=$(blkid -s UUID -o value ${LOOP}p${uefipart}) ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> $SDCARD/etc/fstab
+			echo "# UUID=$(blkid -s UUID -o value "${LOOP}p${uefipart}") ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> "${SDCARD}/etc/fstab"
 		else
-			echo "UUID=$(blkid -s UUID -o value ${LOOP}p${uefipart}) ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> $SDCARD/etc/fstab
+			echo "UUID=$(blkid -s UUID -o value "${LOOP}p${uefipart}") ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> "${SDCARD}/etc/fstab"
 		fi
 	fi
 	##
@@ -431,7 +434,7 @@ function prepare_partitions() {
 	##
 
 	display_alert "Writing /tmp as tmpfs in chroot fstab" "$SDCARD/etc/fstab" "debug"
-	echo "tmpfs /tmp tmpfs defaults,nosuid 0 0" >> $SDCARD/etc/fstab
+	echo "tmpfs /tmp tmpfs defaults,nosuid 0 0" >> "${SDCARD}/etc/fstab"
 
 	call_extension_method "format_partitions" <<- 'FORMAT_PARTITIONS'
 		*if you created your own partitions, this would be a good time to format them*
@@ -446,43 +449,43 @@ function prepare_partitions() {
 		else
 			echo "rootdev=$rootfs" >> "${SDCARD}/boot/armbianEnv.txt"
 		fi
-		echo "rootfstype=$ROOTFS_TYPE" >> $SDCARD/boot/armbianEnv.txt
+		echo "rootfstype=$ROOTFS_TYPE" >> "${SDCARD}/boot/armbianEnv.txt"
 	elif [[ $rootpart != 1 ]] && [[ $SRC_EXTLINUX != yes ]]; then
 		echo "rootfstype=$ROOTFS_TYPE" >> "${SDCARD}/boot/armbianEnv.txt"
 	elif [[ $rootpart != 1 && $SRC_EXTLINUX != yes && -f "${SDCARD}/boot/${bootscript_dst}" ]]; then
 		local bootscript_dst=${BOOTSCRIPT##*:}
-		sed -i 's/mmcblk0p1/mmcblk0p2/' $SDCARD/boot/$bootscript_dst
+		sed -i 's/mmcblk0p1/mmcblk0p2/' "${SDCARD}/boot/${bootscript_dst}"
 		sed -i -e "s/rootfstype=ext4/rootfstype=$ROOTFS_TYPE/" \
-			-e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" $SDCARD/boot/$bootscript_dst
+			-e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" "${SDCARD}/boot/${bootscript_dst}"
 	fi
 
 	# if we have boot.ini = remove armbianEnv.txt and add UUID there if enabled
 	if [[ -f $SDCARD/boot/boot.ini ]]; then
 		display_alert "Found boot.ini" "${SDCARD}/boot/boot.ini" "debug"
-		sed -i -e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" $SDCARD/boot/boot.ini
+		sed -i -e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" "${SDCARD}/boot/boot.ini"
 		if [[ $CRYPTROOT_ENABLE == yes ]]; then
 			rootpart="UUID=${physical_root_part_uuid}"
-			sed -i 's/^setenv rootdev .*/setenv rootdev "\/dev\/mapper\/'$CRYPTROOT_MAPPER' cryptdevice='$rootpart':'$CRYPTROOT_MAPPER'"/' $SDCARD/boot/boot.ini
+			sed -i 's#^setenv rootdev .*#setenv rootdev "/dev/mapper/'$CRYPTROOT_MAPPER' cryptdevice='$rootpart':'$CRYPTROOT_MAPPER'"#' "${SDCARD}/boot/boot.ini"
 		else
-			sed -i 's/^setenv rootdev .*/setenv rootdev "'$rootfs'"/' $SDCARD/boot/boot.ini
+			sed -i 's/^setenv rootdev .*/setenv rootdev "'$rootfs'"/' "${SDCARD}/boot/boot.ini"
 		fi
 		if [[ $LINUXFAMILY != meson64 ]]; then # @TODO: why only for meson64?
-			[[ -f $SDCARD/boot/armbianEnv.txt ]] && rm $SDCARD/boot/armbianEnv.txt
+			[[ -f "${SDCARD}/boot/armbianEnv.txt" ]] && rm "${SDCARD}/boot/armbianEnv.txt"
 		fi
 	fi
 
 	# if we have a headless device, set console to DEFAULT_CONSOLE
-	if [[ -n $DEFAULT_CONSOLE && -f $SDCARD/boot/armbianEnv.txt ]]; then
-		if grep -lq "^console=" $SDCARD/boot/armbianEnv.txt; then
-			sed -i "s/^console=.*/console=$DEFAULT_CONSOLE/" $SDCARD/boot/armbianEnv.txt
+	if [[ -n $DEFAULT_CONSOLE && -f "${SDCARD}/boot/armbianEnv.txt" ]]; then
+		if grep -lq "^console=" "${SDCARD}/boot/armbianEnv.txt"; then
+			sed -i "s/^console=.*/console=$DEFAULT_CONSOLE/" "${SDCARD}/boot/armbianEnv.txt"
 		else
-			echo "console=$DEFAULT_CONSOLE" >> $SDCARD/boot/armbianEnv.txt
+			echo "console=$DEFAULT_CONSOLE" >> "${SDCARD}/boot/armbianEnv.txt"
 		fi
 	fi
 
 	# recompile .cmd to .scr if boot.cmd exists
 	if [[ -f "${SDCARD}/boot/boot.cmd" ]]; then
-		if [ -z ${BOOTSCRIPT_OUTPUT} ]; then
+		if [[ -z "${BOOTSCRIPT_OUTPUT}" ]]; then
 			BOOTSCRIPT_OUTPUT=boot.scr
 		fi
 		case ${LINUXFAMILY} in
@@ -500,10 +503,10 @@ function prepare_partitions() {
 	fi
 
 	# complement extlinux config if it exists; remove armbianEnv in this case.
-	if [[ -f $SDCARD/boot/extlinux/extlinux.conf ]]; then
-		echo "  append root=$rootfs $SRC_CMDLINE $MAIN_CMDLINE" >> $SDCARD/boot/extlinux/extlinux.conf
+	if [[ -f "${SDCARD}/boot/extlinux/extlinux.conf" ]]; then
+		echo "  append root=$rootfs $SRC_CMDLINE $MAIN_CMDLINE" >> "${SDCARD}/boot/extlinux/extlinux.conf"
 		display_alert "extlinux.conf exists" "removing armbianEnv.txt" "info"
-		[[ -f $SDCARD/boot/armbianEnv.txt ]] && run_host_command_logged rm -v $SDCARD/boot/armbianEnv.txt
+		[[ -f "${SDCARD}/boot/armbianEnv.txt" ]] && run_host_command_logged rm -v "${SDCARD}/boot/armbianEnv.txt"
 	fi
 
 	if [[ $SRC_EXTLINUX != yes && -f $SDCARD/boot/armbianEnv.txt ]]; then