diff --git a/hook-functions b/hook-functions
index 95bd584..addc566 100644
--- a/hook-functions
+++ b/hook-functions
@@ -885,7 +885,7 @@ call_scripts()
 		if [ "$ec" -ne 0 ]; then
 			echo "E: ${initdir}/${cs_x} failed with return $ec." >&2
 			# only errexit on mkinitramfs
-			[ -n "${version}" ] && exit $ec
+			[ -n "${version}" ] && exit "$ec"
 		fi
 		# allow boot scripts to modify exported boot parameters
 		if [ -e /conf/param.conf ]; then
diff --git a/hooks/fsck b/hooks/fsck
index 000ce4e..9e84a5b 100755
--- a/hooks/fsck
+++ b/hooks/fsck
@@ -52,6 +52,7 @@ get_fsck_type_fstab () {
 		# therefore never used at boot time
 		if [ "${MNT_DIR}" = "/" ] || [ "${MNT_TYPE}" = "auto" ]; then
 			MNT_FSNAME="$(resolve_device "${MNT_FSNAME}")"
+			# shellcheck disable=SC2317
 			fstype() { "/usr/lib/klibc/bin/fstype" "$@"; }
 			if ! get_fstype "${MNT_FSNAME}"; then
 				echo "W: Couldn't identify type of $2 file system for fsck hook" >&2
diff --git a/init b/init
index 43eb349..a8789d0 100755
--- a/init
+++ b/init
@@ -209,7 +209,7 @@ mount -t tmpfs -o "nodev,noexec,nosuid,size=${RUNSIZE:-10%},mode=0755" tmpfs /ru
 mkdir -m 0700 /run/initramfs
 
 if [ -n "$log_output" ]; then
-	exec >$log_output 2>&1
+	exec >"$log_output" 2>&1
 	unset log_output
 fi
 
@@ -243,7 +243,7 @@ log_begin_msg "Mounting root file system"
 # /usr, irrespective of the boot script used to mount the rootfs).
 . /scripts/local
 . /scripts/nfs
-. /scripts/${BOOT}
+. "/scripts/${BOOT}"
 parse_numeric "${ROOT}"
 maybe_break mountroot
 mount_top
diff --git a/lsinitramfs b/lsinitramfs
index 5b3315f..8d2a967 100755
--- a/lsinitramfs
+++ b/lsinitramfs
@@ -53,5 +53,6 @@ if [ "$#" -eq 0 ] ; then
 fi
 
 for initramfs in "$@" ; do
+	# shellcheck disable=SC2086
 	unmkinitramfs $umi_opts -- "$initramfs"
 done
diff --git a/mkinitramfs b/mkinitramfs
index df1b940..4b6c278 100755
--- a/mkinitramfs
+++ b/mkinitramfs
@@ -261,6 +261,7 @@ DESTDIR=
 __TMPCPIOGZ=
 __TMPMAINCPIO=
 __TMPEARLYCPIO=
+# shellcheck disable=SC2317
 clean_on_exit() {
 	if [ "${keep}" = "y" ]; then
 		echo "Working files in ${DESTDIR:-<not yet created>}," \
diff --git a/scripts/functions b/scripts/functions
index ae11b96..8bd8005 100644
--- a/scripts/functions
+++ b/scripts/functions
@@ -524,7 +524,7 @@ _checkfs_once()
 		log_warning_msg "File system check failed but did not detect errors"
 		sleep 5
 	else
-		true > $FSCK_STAMPFILE
+		true >"$FSCK_STAMPFILE"
 	fi
 	return 0
 }
diff --git a/unmkinitramfs b/unmkinitramfs
index d1226c3..b40eb82 100755
--- a/unmkinitramfs
+++ b/unmkinitramfs
@@ -95,7 +95,7 @@ splitinitramfs()
 			test "$magic" = 070701 || test "$magic" = 070702 || break
 			namesize=0x$(readhex "$initramfs" $((end + 94)) 8)
 			filesize=0x$(readhex "$initramfs" $((end + 54)) 8)
-			end=$(((end + 110)))
+			end=$((end + 110))
 			end=$(((end + namesize + 3) & ~3))
 			end=$(((end + filesize + 3) & ~3))
 		done
@@ -121,11 +121,11 @@ splitinitramfs()
 		start=$end
 	done
 
-	if [ $end -gt 0 ]; then
+	if [ "$end" -gt 0 ]; then
 		# Extract to main subdirectory
 		subarchive=$(mktemp "${TMPDIR:-/var/tmp}/unmkinitramfs_XXXXXX")
 		trap 'rm -f "$subarchive"' EXIT
-		dd < "$initramfs" skip=$end iflag=skip_bytes 2> /dev/null \
+		dd < "$initramfs" skip="$end" iflag=skip_bytes 2> /dev/null \
 			> "$subarchive"
 		xcpio "$subarchive" "${dir:+$dir/main}" -i "$@"
 	else
diff --git a/update-initramfs b/update-initramfs
index 746a6c1..b36f9dd 100755
--- a/update-initramfs
+++ b/update-initramfs
@@ -102,7 +102,7 @@ backup_booted_initramfs()
 
 	# no backup yet
 	if [ ! -r "${initramfs}.bak" ]; then
-		mv -f ${initramfs_bak} "${initramfs}.bak"
+		mv -f "${initramfs_bak}" "${initramfs}.bak"
 		verbose "Backup ${initramfs}.bak"
 		return 0
 	fi
@@ -119,7 +119,7 @@ backup_booted_initramfs()
 		return 0
 	fi
 	verbose "Removing current backup ${initramfs_bak}"
-	rm -f ${initramfs_bak}
+	rm -f "${initramfs_bak}"
 }
 
 # nuke generated copy