diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ab2f51e6cf0266c3f90549e2716241a855c2d26e..74ecdd32cc06a1e18cffc90844fa13d1f2b19507 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -15,3 +15,7 @@ lint:
         configs/releng/airootfs/root/.automated_script.sh
         configs/releng/airootfs/usr/local/bin/choose-mirror
         scripts/run_archiso.sh
+        archiso/initcpio/install/*
+    - shellcheck -s dash
+        archiso/initcpio/hooks/*
+        archiso/initcpio/script/*
diff --git a/archiso/initcpio/hooks/archiso b/archiso/initcpio/hooks/archiso
index 5c5656147ee010e6ad77988ff5e1c156a9237f52..44abb88613b6b7f55e4f6cd1571e200fa4c78c3c 100644
--- a/archiso/initcpio/hooks/archiso
+++ b/archiso/initcpio/hooks/archiso
@@ -1,3 +1,5 @@
+#!/bin/ash
+
 # args: source, newroot, mountpoint
 _mnt_dmsnapshot() {
     local img="${1}"
@@ -8,19 +10,19 @@ _mnt_dmsnapshot() {
     local dm_snap_name="${dm_snap_prefix}_${img_name}"
     local ro_dev ro_dev_size rw_dev
 
-    ro_dev=$(losetup --find --show --read-only "${img}")
-    echo ${ro_dev} >> /run/archiso/used_block_devices
-    ro_dev_size=$(blockdev --getsz ${ro_dev})
+    ro_dev="$(losetup --find --show --read-only -- "${img}")"
+    echo "${ro_dev}" >> /run/archiso/used_block_devices
+    ro_dev_size="$(blockdev --getsz -- "${ro_dev}")"
 
-    if [[ "${cow_persistent}" == "P" ]]; then
-        if [[ -f "/run/archiso/cowspace/${cow_directory}/${img_name}.cow" ]]; then
+    if [ "${cow_persistent}" = "P" ]; then
+        if [ -f "/run/archiso/cowspace/${cow_directory}/${img_name}.cow" ]; then
             msg ":: Found '/run/archiso/cowspace/${cow_directory}/${img_name}.cow', using as persistent."
         else
             msg ":: Creating '/run/archiso/cowspace/${cow_directory}/${img_name}.cow' as persistent."
             truncate -s "${cow_spacesize}" "/run/archiso/cowspace/${cow_directory}/${img_name}.cow"
         fi
     else
-        if [[ -f "/run/archiso/cowspace/${cow_directory}/${img_name}.cow" ]]; then
+        if [ -f "/run/archiso/cowspace/${cow_directory}/${img_name}.cow" ]; then
             msg ":: Found '/run/archiso/cowspace/${cow_directory}/${img_name}.cow' but non-persistent requested, removing."
             rm -f "/run/archiso/cowspace/${cow_directory}/${img_name}.cow"
         fi
@@ -28,17 +30,18 @@ _mnt_dmsnapshot() {
         truncate -s "${cow_spacesize}" "/run/archiso/cowspace/${cow_directory}/${img_name}.cow"
     fi
 
-    rw_dev=$(losetup --find --show "/run/archiso/cowspace/${cow_directory}/${img_name}.cow")
-    echo ${rw_dev} >> /run/archiso/used_block_devices
+    rw_dev="$(losetup --find --show "/run/archiso/cowspace/${cow_directory}/${img_name}.cow")"
+    echo "${rw_dev}" >> /run/archiso/used_block_devices
 
-    dmsetup create ${dm_snap_name} --table "0 ${ro_dev_size} snapshot ${ro_dev} ${rw_dev} ${cow_persistent} ${cow_chunksize}"
+    dmsetup create "${dm_snap_name}" --table \
+        "0 ${ro_dev_size} snapshot ${ro_dev} ${rw_dev} ${cow_persistent} ${cow_chunksize}"
 
-    if [[ "${cow_persistent}" != "P" ]]; then
+    if [ "${cow_persistent}" != "P" ]; then
         rm -f "/run/archiso/cowspace/${cow_directory}/${img_name}.cow"
     fi
 
     _mnt_dev "/dev/mapper/${dm_snap_name}" "${newroot}${mnt}" "-w" "defaults"
-    echo $(readlink -f /dev/mapper/${dm_snap_name}) >> /run/archiso/used_block_devices
+    readlink -f "/dev/mapper/${dm_snap_name}" >> /run/archiso/used_block_devices
 }
 
 # args: source, newroot, mountpoint
@@ -46,8 +49,10 @@ _mnt_overlayfs() {
     local src="${1}"
     local newroot="${2}"
     local mnt="${3}"
-    mkdir -p /run/archiso/cowspace/${cow_directory}/upperdir /run/archiso/cowspace/${cow_directory}/workdir
-    mount -t overlay -o lowerdir=${src},upperdir=/run/archiso/cowspace/${cow_directory}/upperdir,workdir=/run/archiso/cowspace/${cow_directory}/workdir airootfs "${newroot}${mnt}"
+    mkdir -p "/run/archiso/cowspace/${cow_directory}/upperdir" "/run/archiso/cowspace/${cow_directory}/workdir"
+    mount -t overlay -o \
+    "lowerdir=${src},upperdir=/run/archiso/cowspace/${cow_directory}/upperdir,workdir=/run/archiso/cowspace/${cow_directory}/workdir" \
+    airootfs "${newroot}${mnt}"
 }
 
 
@@ -58,17 +63,18 @@ _mnt_sfs() {
     local img_fullname="${img##*/}"
     local sfs_dev
 
-    if [[ "${copytoram}" == "y" ]]; then
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ "${copytoram}" = "y" ]; then
         msg -n ":: Copying squashfs image to RAM..."
-        if ! cp "${img}" "/run/archiso/copytoram/${img_fullname}" ; then
+        if ! cp -- "${img}" "/run/archiso/copytoram/${img_fullname}" ; then
             echo "ERROR: while copy '${img}' to '/run/archiso/copytoram/${img_fullname}'"
             launch_interactive_shell
         fi
         img="/run/archiso/copytoram/${img_fullname}"
         msg "done."
     fi
-    sfs_dev=$(losetup --find --show --read-only "${img}")
-    echo ${sfs_dev} >> /run/archiso/used_block_devices
+    sfs_dev="$(losetup --find --show --read-only -- "${img}")"
+    echo "${sfs_dev}" >> /run/archiso/used_block_devices
     _mnt_dev "${sfs_dev}" "${mnt}" "-r" "defaults"
 }
 
@@ -102,45 +108,46 @@ _mnt_dev() {
 
 _verify_checksum() {
     local _status
-    cd "/run/archiso/bootmnt/${archisobasedir}/${arch}"
+    cd "/run/archiso/bootmnt/${archisobasedir}/${arch}" || exit 1
     sha512sum -c airootfs.sha512 > /tmp/checksum.log 2>&1
     _status=$?
-    cd "${OLDPWD}"
-    return ${_status}
+    cd -- "${OLDPWD}" || exit 1
+    return "${_status}"
 }
 
 _verify_signature() {
     local _status
-    cd "/run/archiso/bootmnt/${archisobasedir}/${arch}"
+    cd "/run/archiso/bootmnt/${archisobasedir}/${arch}" || exit 1
     gpg --homedir /gpg --status-fd 1 --verify airootfs.sfs.sig 2>/dev/null | grep -qE '^\[GNUPG:\] GOODSIG'
     _status=$?
-    cd "${OLDPWD}"
+    cd -- "${OLDPWD}" || exit 1
     return ${_status}
 }
 
 run_hook() {
-    [[ -z "${arch}" ]] && arch="$(uname -m)"
-    [[ -z "${copytoram_size}" ]] && copytoram_size="75%"
-    [[ -z "${archisobasedir}" ]] && archisobasedir="arch"
-    [[ -z "${dm_snap_prefix}" ]] && dm_snap_prefix="arch"
-    [[ -z "${archisodevice}" ]] && archisodevice="/dev/disk/by-label/${archisolabel}"
-    [[ -z "${cow_spacesize}" ]] && cow_spacesize="256M"
-
-    if [[ -n "${cow_label}" ]]; then
+    [ -z "${arch}" ] && arch="$(uname -m)"
+    [ -z "${copytoram_size}" ] && copytoram_size="75%"
+    [ -z "${archisobasedir}" ] && archisobasedir="arch"
+    [ -z "${dm_snap_prefix}" ] && dm_snap_prefix="arch"
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    [ -z "${archisodevice}" ] && archisodevice="/dev/disk/by-label/${archisolabel}"
+    [ -z "${cow_spacesize}" ] && cow_spacesize="256M"
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ -n "${cow_label}" ]; then
         cow_device="/dev/disk/by-label/${cow_label}"
-        [[ -z "${cow_persistent}" ]] && cow_persistent="P"
-    elif [[ -n "${cow_device}" ]]; then
-        [[ -z "${cow_persistent}" ]] && cow_persistent="P"
+        [ -z "${cow_persistent}" ] && cow_persistent="P"
+    elif [ -n "${cow_device}" ]; then
+        [ -z "${cow_persistent}" ] && cow_persistent="P"
     else
         cow_persistent="N"
     fi
 
-    [[ -z "${cow_flags}" ]] && cow_flags="defaults"
-    [[ -z "${cow_directory}" ]] && cow_directory="persistent_${archisolabel}/${arch}"
-    [[ -z "${cow_chunksize}" ]] && cow_chunksize="8"
+    [ -z "${cow_flags}" ] && cow_flags="defaults"
+    [ -z "${cow_directory}" ] && cow_directory="persistent_${archisolabel}/${arch}"
+    [ -z "${cow_chunksize}" ] && cow_chunksize="8"
 
     # set mount handler for archiso
-    mount_handler="archiso_mount_handler"
+    export mount_handler="archiso_mount_handler"
 }
 
 # This function is called normally from init script, but it can be called
@@ -151,13 +158,14 @@ archiso_mount_handler() {
 
     if ! mountpoint -q "/run/archiso/bootmnt"; then
         _mnt_dev "${archisodevice}" "/run/archiso/bootmnt" "-r" "defaults"
-        if [[ "${copytoram}" != "y" ]]; then
-            echo $(readlink -f ${archisodevice}) >> /run/archiso/used_block_devices
+        if [ "${copytoram}" != "y" ]; then
+            readlink -f "${archisodevice}" >> /run/archiso/used_block_devices
         fi
     fi
 
-    if [[ "${checksum}" == "y" ]]; then
-        if [[ -f "/run/archiso/bootmnt/${archisobasedir}/${arch}/airootfs.sha512" ]]; then
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ "${checksum}" = "y" ]; then
+        if [ -f "/run/archiso/bootmnt/${archisobasedir}/${arch}/airootfs.sha512" ]; then
             msg -n ":: Self-test requested, please wait..."
             if _verify_checksum; then
                 msg "done. Checksum is OK, continue booting."
@@ -172,8 +180,9 @@ archiso_mount_handler() {
         fi
     fi
 
-    if [[ "${verify}" == "y" ]]; then
-        if [[ -f "/run/archiso/bootmnt/${archisobasedir}/${arch}/airootfs.sfs.sig" ]]; then
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ "${verify}" = "y" ]; then
+        if [ -f "/run/archiso/bootmnt/${archisobasedir}/${arch}/airootfs.sfs.sig" ]; then
             msg -n ":: Signature verification requested, please wait..."
             if _verify_signature; then
                 msg "done. Signature is OK, continue booting."
@@ -187,33 +196,34 @@ archiso_mount_handler() {
         fi
     fi
 
-    if [[ "${copytoram}" == "y" ]]; then
+    if [ "${copytoram}" = "y" ]; then
         msg ":: Mounting /run/archiso/copytoram (tmpfs) filesystem, size=${copytoram_size}"
         mkdir -p /run/archiso/copytoram
         mount -t tmpfs -o "size=${copytoram_size}",mode=0755 copytoram /run/archiso/copytoram
     fi
 
-    if [[ -n "${cow_device}" ]]; then
+    if [ -n "${cow_device}" ]; then
         _mnt_dev "${cow_device}" "/run/archiso/cowspace" "-r" "${cow_flags}"
-        echo $(readlink -f ${cow_device}) >> /run/archiso/used_block_devices
+        readlink -f "${cow_device}" >> /run/archiso/used_block_devices
         mount -o remount,rw "/run/archiso/cowspace"
     else
         msg ":: Mounting /run/archiso/cowspace (tmpfs) filesystem, size=${cow_spacesize}..."
         mkdir -p /run/archiso/cowspace
         mount -t tmpfs -o "size=${cow_spacesize}",mode=0755 cowspace /run/archiso/cowspace
     fi
-    mkdir -p -m 0700 "/run/archiso/cowspace/${cow_directory}"
+    mkdir -p "/run/archiso/cowspace/${cow_directory}"
+    chmod 0700 "/run/archiso/cowspace/${cow_directory}"
 
     _mnt_sfs "/run/archiso/bootmnt/${archisobasedir}/${arch}/airootfs.sfs" "/run/archiso/sfs/airootfs"
-    if [[ -f "/run/archiso/sfs/airootfs/airootfs.img" ]]; then
+    if [ -f "/run/archiso/sfs/airootfs/airootfs.img" ]; then
         _mnt_dmsnapshot "/run/archiso/sfs/airootfs/airootfs.img" "${newroot}" "/"
     else
         _mnt_overlayfs "/run/archiso/sfs/airootfs" "${newroot}" "/"
     fi
 
-    if [[ "${copytoram}" == "y" ]]; then
+    if [ "${copytoram}" = "y" ]; then
         umount -d /run/archiso/bootmnt
     fi
 }
 
-# vim:ft=sh:ts=4:sw=4:et:
+# vim: set ft=sh:
diff --git a/archiso/initcpio/hooks/archiso_loop_mnt b/archiso/initcpio/hooks/archiso_loop_mnt
index 2e9940471f650480883827497fb032afb44e1430..c32a544fb3b034ec29f750758ee56a226a2174fd 100644
--- a/archiso/initcpio/hooks/archiso_loop_mnt
+++ b/archiso/initcpio/hooks/archiso_loop_mnt
@@ -1,10 +1,12 @@
-# vim: set ft=sh:
+#!/bin/ash
 
 run_hook () {
-    [[ -n "${img_label}" ]] && img_dev="/dev/disk/by-label/${img_label}"
-    [[ -z "${img_flags}" ]] && img_flags="defaults"
-    if [[ -n "${img_dev}" && -n "${img_loop}" ]]; then
-        mount_handler="archiso_loop_mount_handler"
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    [ -n "${img_label}" ] && img_dev="/dev/disk/by-label/${img_label}"
+    [ -z "${img_flags}" ] && img_flags="defaults"
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ -n "${img_dev}" ] && [ -n "${img_loop}" ]; then
+        export mount_handler="archiso_loop_mount_handler"
     fi
 }
 
@@ -15,21 +17,24 @@ archiso_loop_mount_handler () {
 
     msg ":: Setup a loop device from ${img_loop} located at device ${img_dev}"
     _mnt_dev "${img_dev}" "/run/archiso/img_dev" "-r" "${img_flags}"
-    if [[ "${copytoram}" != "y" ]]; then
-        echo $(readlink -f ${img_dev}) >> /run/archiso/used_block_devices
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ "${copytoram}" != "y" ]; then
+        readlink -f "${img_dev}" >> /run/archiso/used_block_devices
     fi
 
     if _dev_loop=$(losetup --find --show --read-only "/run/archiso/img_dev/${img_loop}"); then
-        archisodevice="${_dev_loop}"
+        export archisodevice="${_dev_loop}"
     else
         echo "ERROR: Setting loopback device for file '/run/archiso/img_dev/${img_loop}'"
         launch_interactive_shell
     fi
 
-    archiso_mount_handler ${newroot}
+    archiso_mount_handler "${newroot}"
 
-    if [[ "${copytoram}" == "y" ]]; then
-        losetup -d ${_dev_loop} 2>/dev/null
+    if [ "${copytoram}" = "y" ]; then
+        losetup -d "${_dev_loop}" 2>/dev/null
         umount /run/archiso/img_dev
     fi
 }
+
+# vim: set ft=sh:
diff --git a/archiso/initcpio/hooks/archiso_pxe_common b/archiso/initcpio/hooks/archiso_pxe_common
index 2380ca3fb2acdbd94df752bf880737f9f70ac448..e31903e95c8be076e340bb6ffccc5d5e6571f367 100644
--- a/archiso/initcpio/hooks/archiso_pxe_common
+++ b/archiso/initcpio/hooks/archiso_pxe_common
@@ -1,55 +1,55 @@
-# vim: set ft=sh:
+#!/bin/ash
 
 run_hook () {
     # Do *not* declare 'bootif_dev' local! We need it in run_latehook().
     local i net_mac bootif_mac
+    local DNSDOMAIN HOSTNAME IPV4DNS0 IPV4DNS1 ROOTSERVER
     # These variables will be parsed from /tmp/net-*.conf generated by ipconfig
-    local DEVICE
-    local IPV4ADDR IPV4BROADCAST IPV4NETMASK IPV4GATEWAY IPV4DNS0 IPV4DNS1
-    local HOSTNAME DNSDOMAIN NISDOMAIN ROOTSERVER ROOTPATH
-    local filename
-    # /tmp/net-*.conf
+    # shellcheck disable=SC2034
+    local DEVICE IPV4ADDR IPV4BROADCAST IPV4NETMASK IPV4GATEWAY NISDOMAIN ROOTPATH filename
 
-    if [[ -n "${ip}" ]]; then
-        if [[ -n "${BOOTIF}" ]]; then
-            bootif_mac=${BOOTIF#01-}
-            bootif_mac=${bootif_mac//-/:}
+    if [ -n "${ip}" ]; then
+        if [ -n "${BOOTIF}" ]; then
+            bootif_mac="${BOOTIF#01-}"
+            # shellcheck disable=SC2169 # ash supports bash-like string replacment
+            bootif_mac="${bootif_mac//-/:}"
             for i in /sys/class/net/*/address; do
-                read net_mac < ${i}
-                if [[ "${bootif_mac}" == "${net_mac}" ]]; then
+                read -r net_mac < "${i}"
+                if [ "${bootif_mac}" = "${net_mac}" ]; then
                     bootif_dev=${i#/sys/class/net/}
                     bootif_dev=${bootif_dev%/address}
                     break
                 fi
             done
-	    if [[ "${ip}" == "dhcp" ]]; then
+            if [ "${ip}" = "dhcp" ]; then
                 ip=":::::${bootif_dev}:dhcp"
-	    else
+            else
                 ip="${ip}::${bootif_dev}"
             fi
         fi
 
         # setup network and save some values
         if ! ipconfig -t 20 "ip=${ip}"; then
-                echo "ERROR; Failed to configure network"
-                echo "   Falling back to interactive prompt"
-                echo "   You can try to fix the problem manually, log out when you are finished"
-                launch_interactive_shell
+            echo "ERROR; Failed to configure network"
+            echo "   Falling back to interactive prompt"
+            echo "   You can try to fix the problem manually, log out when you are finished"
+            launch_interactive_shell
         fi
 
+        # shellcheck disable=SC1090 # ipconfig generates these files
         . /tmp/net-*.conf
 
-        pxeserver=${ROOTSERVER}
+        export pxeserver="${ROOTSERVER}"
 
         # setup DNS resolver
-        if [[ "${IPV4DNS0}" != "0.0.0.0" ]]; then
+        if [ "${IPV4DNS0}" != "0.0.0.0" ]; then
             echo "# added by archiso_pxe_common hook" > /etc/resolv.conf
             echo "nameserver ${IPV4DNS0}" >> /etc/resolv.conf
         fi
-        if [[ "${IPV4DNS1}" != "0.0.0.0" ]]; then
+        if [ "${IPV4DNS1}" != "0.0.0.0" ]; then
             echo "nameserver ${IPV4DNS1}" >> /etc/resolv.conf
         fi
-        if [[ -n "${DNSDOMAIN}" ]]; then
+        if [ -n "${DNSDOMAIN}" ]; then
             echo "search ${DNSDOMAIN}" >> /etc/resolv.conf
             echo "domain ${DNSDOMAIN}" >> /etc/resolv.conf
         fi
@@ -57,16 +57,19 @@ run_hook () {
 }
 
 run_latehook () {
-    if [[ -n "${ip}" ]]; then
-        [[ -z "${copy_resolvconf}" ]] && copy_resolvconf="y"
+    if [ -n "${ip}" ]; then
+        [ -z "${copy_resolvconf}" ] && copy_resolvconf="y"
 
-        if [[ "${copytoram}" == "y" ]]; then
-            if [[ -n "${bootif_dev}" ]]; then
+        # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+        if [ "${copytoram}" = "y" ]; then
+            if [ -n "${bootif_dev}" ]; then
                 ip addr flush dev "${bootif_dev}"
                 ip link set "${bootif_dev}" down
             fi
-        elif [[ "${copy_resolvconf}" != "n" && -f /etc/resolv.conf ]]; then
+        elif [ "${copy_resolvconf}" != "n" ] && [ -f /etc/resolv.conf ]; then
             cp /etc/resolv.conf /new_root/etc/resolv.conf
         fi
     fi
 }
+
+# vim: set ft=sh:
diff --git a/archiso/initcpio/hooks/archiso_pxe_http b/archiso/initcpio/hooks/archiso_pxe_http
index a7c03a8f8f91fe822bba075746bcde9c96e4eb5e..5e55356d33c37c5f846ac17948588cbe28d64a22 100644
--- a/archiso/initcpio/hooks/archiso_pxe_http
+++ b/archiso/initcpio/hooks/archiso_pxe_http
@@ -1,16 +1,17 @@
-# vim: set ft=sh:
+#!/bin/ash
 
 run_hook() {
-    if [[ -n "${ip}" && -n "${archiso_http_srv}" ]]; then
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ -n "${ip}" ] && [ -n "${archiso_http_srv}" ]; then
 
         # booting with http is always copy-to-ram, so set here to make sure
         # addresses are flushed and interface is set down
-        copytoram="y"
+        export copytoram="y"
 
-        archiso_http_srv=$(eval echo ${archiso_http_srv})
-        [[ -z "${archiso_http_spc}" ]] && archiso_http_spc="75%"
+        archiso_http_srv=$(eval echo "${archiso_http_srv}")
+        [ -z "${archiso_http_spc}" ] && archiso_http_spc="75%"
 
-        mount_handler="archiso_pxe_http_mount_handler"
+        export mount_handler="archiso_pxe_http_mount_handler"
     fi
 }
 
@@ -23,6 +24,7 @@ _curl_get() {
     local _dst="${2}"
 
     msg ":: Downloading '${_url}'"
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
     if ! curl -L -f -o "/run/archiso/httpspace/${archisobasedir}${_dst}/${_url##*/}" --create-dirs "${_url}"; then
         echo "ERROR: Downloading '${_url}'"
         echo "   Falling back to interactive prompt"
@@ -38,17 +40,22 @@ archiso_pxe_http_mount_handler () {
     mkdir -p "/run/archiso/httpspace"
     mount -t tmpfs -o size="${archiso_http_spc}",mode=0755 httpspace "/run/archiso/httpspace"
 
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
     _curl_get "${archiso_http_srv}${archisobasedir}/${arch}/airootfs.sfs" "/${arch}"
 
-    if [[ "${checksum}" == "y" ]]; then
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ "${checksum}" = "y" ]; then
         _curl_get "${archiso_http_srv}${archisobasedir}/${arch}/airootfs.sha512" "/${arch}"
     fi
-    if [[ "${verify}" == "y" ]]; then
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ "${verify}" = "y" ]; then
         _curl_get "${archiso_http_srv}${archisobasedir}/${arch}/airootfs.sfs.sig" "/${arch}"
     fi
 
     mkdir -p "/run/archiso/bootmnt"
     mount -o bind /run/archiso/httpspace /run/archiso/bootmnt
 
-    archiso_mount_handler ${newroot}
+    archiso_mount_handler "${newroot}"
 }
+
+# vim: set ft=sh:
diff --git a/archiso/initcpio/hooks/archiso_pxe_nbd b/archiso/initcpio/hooks/archiso_pxe_nbd
index 4fb7fa5e630789cc98d2661cbfd4d7b112945de7..ce93080c78b98459398a6921e7b14260aa972d87 100644
--- a/archiso/initcpio/hooks/archiso_pxe_nbd
+++ b/archiso/initcpio/hooks/archiso_pxe_nbd
@@ -1,19 +1,20 @@
-# vim: set ft=sh:
+#!/bin/ash
 
 run_earlyhook() {
-    if [[ -n "${ip}" && -n "${archiso_nbd_srv}" ]]; then
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ -n "${ip}" ] && [ -n "${archiso_nbd_srv}" ]; then
         # Module autoloading like with loop devices does not work, doing manually...
         modprobe nbd 2> /dev/null
     fi
 }
 
 run_hook() {
-    if [[ -n "${ip}" && -n "${archiso_nbd_srv}" ]]; then
+    if [ -n "${ip}" ] && [ -n "${archiso_nbd_srv}" ]; then
 
-        archiso_nbd_srv=$(eval echo ${archiso_nbd_srv})
-        [[ -z "${archiso_nbd_name}" ]] && archiso_nbd_name="archiso"
+        archiso_nbd_srv=$(eval echo "${archiso_nbd_srv}")
+        [ -z "${archiso_nbd_name}" ] && archiso_nbd_name="archiso"
 
-        mount_handler="archiso_pxe_nbd_mount_handler"
+        export mount_handler="archiso_pxe_nbd_mount_handler"
     fi
 }
 
@@ -29,19 +30,21 @@ archiso_pxe_nbd_mount_handler () {
     done
 
     msg ":: Setup NBD from ${archiso_nbd_srv} at /dev/nbd0"
-    if [[ "${copytoram}" != "n" ]]; then
-        nbd-client ${archiso_nbd_srv} -N ${archiso_nbd_name} /dev/nbd0
+    if [ "${copytoram}" != "n" ]; then
+        nbd-client "${archiso_nbd_srv}" -N "${archiso_nbd_name}" /dev/nbd0
         copytoram="y"
     else
-        nbd-client ${archiso_nbd_srv} -N ${archiso_nbd_name} -systemd-mark -persist /dev/nbd0
+        nbd-client "${archiso_nbd_srv}" -N "${archiso_nbd_name}" -systemd-mark -persist /dev/nbd0
     fi
 
-    archisodevice=/dev/nbd0
+    export archisodevice=/dev/nbd0
 
-    archiso_mount_handler ${newroot}
+    archiso_mount_handler "${newroot}"
 
-    if [[ "${copytoram}" == "y" ]]; then
+    if [ "${copytoram}" = "y" ]; then
         msg ":: Disconnect NBD from ${archiso_nbd_srv} at /dev/nbd0"
         nbd-client -d /dev/nbd0
     fi
 }
+
+# vim: set ft=sh:
diff --git a/archiso/initcpio/hooks/archiso_pxe_nfs b/archiso/initcpio/hooks/archiso_pxe_nfs
index 67874ecb6a1ac8be04d313c36d552cd6a0386407..406541b3dd5b76876d8ad5639bca6d1e97955bcb 100644
--- a/archiso/initcpio/hooks/archiso_pxe_nfs
+++ b/archiso/initcpio/hooks/archiso_pxe_nfs
@@ -1,30 +1,40 @@
-# vim: set ft=sh:
+#!/bin/ash
 
 run_hook() {
-    if [[ -n "${ip}" && -n "${archiso_nfs_srv}" ]]; then
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ -n "${ip}" ] && [ -n "${archiso_nfs_srv}" ]; then
 
-        archiso_nfs_srv=$(eval echo ${archiso_nfs_srv})
-        [[ -n "${archiso_nfs_opt}" ]] && archiso_nfs_opt="-o ${archiso_nfs_opt}"
+        archiso_nfs_srv=$(eval echo "${archiso_nfs_srv}")
 
-        mount_handler="archiso_nfs_mount_handler"
+        export mount_handler="archiso_nfs_mount_handler"
     fi
 }
 
 archiso_nfs_mount_handler() {
+    local mount_status
     newroot="${1}"
     mkdir -p "/run/archiso/bootmnt"
     msg ":: Mounting '${archiso_nfs_srv}'"
-    # Do not put "${archiso_nfs_opt}" nfsmount fails!
-    if ! nfsmount ${archiso_nfs_opt} "${archiso_nfs_srv}" "/run/archiso/bootmnt"; then
+    # shellcheck disable=SC2154 # defined via initcpio's parse_cmdline()
+    if [ -n "${archiso_nfs_opt}" ]; then
+        nfsmount -o "${archiso_nfs_opt}" "${archiso_nfs_srv}" "/run/archiso/bootmnt"
+        mount_status=$?
+    else
+        nfsmount "${archiso_nfs_srv}" "/run/archiso/bootmnt"
+        mount_status=$?
+    fi
+    if [ $mount_status -gt 0 ]; then
         echo "ERROR: Mounting '${archiso_nfs_srv}'"
         echo "   Falling back to interactive prompt"
         echo "   You can try to fix the problem manually, log out when you are finished"
         launch_interactive_shell
     fi
 
-    if [[ "${copytoram}" != "n" ]]; then
+    if [ "${copytoram}" != "n" ]; then
         copytoram="y"
     fi
 
-    archiso_mount_handler ${newroot}
+    archiso_mount_handler "${newroot}"
 }
+
+# vim: set ft=sh:
diff --git a/archiso/initcpio/hooks/archiso_shutdown b/archiso/initcpio/hooks/archiso_shutdown
index e50dedb8b3464727b32eabb0a390eace3244569b..db8fb336117c149e85a96cfad8b3e8a892d514dc 100644
--- a/archiso/initcpio/hooks/archiso_shutdown
+++ b/archiso/initcpio/hooks/archiso_shutdown
@@ -1,6 +1,8 @@
+#!/bin/ash
+
 run_cleanuphook() {
     rm -rf /usr/lib/modules
     cp -ax / /run/initramfs
 }
 
-# vim: set ft=sh ts=4 sw=4 et:
+# vim: set ft=sh:
diff --git a/archiso/initcpio/install/archiso b/archiso/initcpio/install/archiso
index 30728efdf8a673f43f9a97cf191a5ce707dde54d..a12104ebc5e409d57ed8dd2f97796670e6eedfd7 100644
--- a/archiso/initcpio/install/archiso
+++ b/archiso/initcpio/install/archiso
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 build() {
     add_module "cdrom"
@@ -22,9 +22,7 @@ build() {
     add_file /usr/lib/udev/rules.d/95-dm-notify.rules
     add_file /usr/lib/initcpio/udev/11-dm-initramfs.rules /usr/lib/udev/rules.d/11-dm-initramfs.rules
     if [[ $ARCHISO_GNUPG_FD ]]; then
-        mkdir -p "$BUILDROOT$dest"/gpg
-        gpg --homedir "$BUILDROOT$dest"/gpg --import <&$ARCHISO_GNUPG_FD
+        mkdir -p "$BUILDROOT/gpg"
+        gpg --homedir "$BUILDROOT/gpg" --import <& "$ARCHISO_GNUPG_FD"
     fi
 }
-
-# vim: set ft=sh ts=4 sw=4 et:
diff --git a/archiso/initcpio/install/archiso_kms b/archiso/initcpio/install/archiso_kms
index bfb2d483290ece90fb6666b869eff969dd9540f4..48832ff7276ffd86cbed541816d97e99695d6003 100644
--- a/archiso/initcpio/install/archiso_kms
+++ b/archiso/initcpio/install/archiso_kms
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 build() {
     add_module "amdgpu"
diff --git a/archiso/initcpio/install/archiso_loop_mnt b/archiso/initcpio/install/archiso_loop_mnt
index 59f1d946821c6d4d017fc5178ab9e5ce9c1acebe..4a5824dbb043b3228f68a6ef455f31a592d08188 100644
--- a/archiso/initcpio/install/archiso_loop_mnt
+++ b/archiso/initcpio/install/archiso_loop_mnt
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 build() {
     add_runscript
@@ -9,5 +9,3 @@ cat<<HELPEOF
   This hook loads the necessary modules for boot via loop device.
 HELPEOF
 }
-
-# vim: set ft=sh ts=4 sw=4 et:
diff --git a/archiso/initcpio/install/archiso_pxe_common b/archiso/initcpio/install/archiso_pxe_common
index eec9a7e3942399f56d41fe4842bfd4371c201b0a..da5f6b698584c24b8fd4c0354d48d96aafd32aae 100644
--- a/archiso/initcpio/install/archiso_pxe_common
+++ b/archiso/initcpio/install/archiso_pxe_common
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 build() {
     add_checked_modules -f "(irda|phy|wimax|wireless|ppp_|plip|pppoe)" "/drivers/net/"
@@ -8,13 +8,13 @@ build() {
     add_binary /usr/lib/initcpio/ipconfig /bin/ipconfig
 
     # Add hosts support files+dns
-    add_symlink /usr/lib/libnss_files.so.2 $(readlink /usr/lib/libnss_files.so.2)
-    add_binary $(readlink -f /usr/lib/libnss_files.so.2)
-    add_symlink /usr/lib/libnss_dns.so.2 $(readlink /usr/lib/libnss_dns.so.2)
-    add_binary $(readlink -f /usr/lib/libnss_dns.so.2)
+    add_symlink /usr/lib/libnss_files.so.2 "$(readlink /usr/lib/libnss_files.so.2)"
+    add_binary "$(readlink -f /usr/lib/libnss_files.so.2)"
+    add_symlink /usr/lib/libnss_dns.so.2 "$(readlink /usr/lib/libnss_dns.so.2)"
+    add_binary "$(readlink -f /usr/lib/libnss_dns.so.2)"
 
     add_dir /etc
-    echo "hosts: files dns" > $BUILDROOT/etc/nsswitch.conf
+    echo "hosts: files dns" > "$BUILDROOT/etc/nsswitch.conf"
 }
 
 help() {
@@ -22,5 +22,3 @@ cat<<HELPEOF
   This hook loads the necessary modules for boot via PXE.
 HELPEOF
 }
-
-# vim: set ft=sh ts=4 sw=4 et:
diff --git a/archiso/initcpio/install/archiso_pxe_http b/archiso/initcpio/install/archiso_pxe_http
index 9ce9726096b8bc24c5c7a3101b57f4b2a3fc2889..3353eb7fedb5b37bd6f8edf035a2e32f4afb10ce 100644
--- a/archiso/initcpio/install/archiso_pxe_http
+++ b/archiso/initcpio/install/archiso_pxe_http
@@ -1,11 +1,11 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 build() {
     add_runscript
 
     add_binary curl
 
-    add_file $(readlink -f /etc/ssl/certs/ca-certificates.crt) /etc/ssl/certs/ca-certificates.crt
+    add_file "$(readlink -f /etc/ssl/certs/ca-certificates.crt)" /etc/ssl/certs/ca-certificates.crt
 }
 
 help() {
@@ -13,5 +13,3 @@ cat<<HELPEOF
   This hook loads the necessary modules for boot via PXE and HTTP.
 HELPEOF
 }
-
-# vim: set ft=sh ts=4 sw=4 et:
diff --git a/archiso/initcpio/install/archiso_pxe_nbd b/archiso/initcpio/install/archiso_pxe_nbd
index 47d98ce1284a09925778acf26d3dffa868098a8a..9fe3fdd07fd6d412343ee3a8d79fe286dccca493 100644
--- a/archiso/initcpio/install/archiso_pxe_nbd
+++ b/archiso/initcpio/install/archiso_pxe_nbd
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 build() {
     add_module "nbd"
@@ -13,5 +13,3 @@ cat<<HELPEOF
   This hook loads the necessary modules for boot via PXE and NBD.
 HELPEOF
 }
-
-# vim: set ft=sh ts=4 sw=4 et:
diff --git a/archiso/initcpio/install/archiso_pxe_nfs b/archiso/initcpio/install/archiso_pxe_nfs
index f8226e5c7a35b686e5c2b0d8307b8cc9bfafb2f2..fa4e548e153426fb96da1d16b3b490a264f3d94e 100644
--- a/archiso/initcpio/install/archiso_pxe_nfs
+++ b/archiso/initcpio/install/archiso_pxe_nfs
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 build() {
     add_module "nfs"
@@ -13,5 +13,3 @@ help() {
   This hook loads the necessary modules for boot via PXE and NFS.
 HELPEOF
 }
-
-# vim: set ft=sh ts=4 sw=4 et:
diff --git a/archiso/initcpio/install/archiso_shutdown b/archiso/initcpio/install/archiso_shutdown
index 5ae976abc1c60f782a15fda55ad7071a379c74c6..1051d1b4236b1a63f3b79d808428c33ed5210b71 100644
--- a/archiso/initcpio/install/archiso_shutdown
+++ b/archiso/initcpio/install/archiso_shutdown
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 build() {
     add_binary cp
@@ -12,9 +12,7 @@ help() {
     cat <<HELPEOF
 This hook will create a shutdown initramfs in /run/initramfs
 that we can pivot to on shutdown in order to unmount / and
-and others mount points, dm-snapshot devices and loopback devices.
-Mostly usefull for dm-snapshot persistent.
+and other mount points, dm-snapshot and loopback devices.
+Mostly useful for persistent dm-snapshot.
 HELPEOF
 }
-
-# vim: set ft=sh ts=4 sw=4 et:
diff --git a/archiso/initcpio/script/archiso_shutdown b/archiso/initcpio/script/archiso_shutdown
index 41b3945b47c1d785679ca1b3c089fd17c6ee3bf7..4a0c7dcf90ea73bbcd572620d43ff9580d51c6d8 100644
--- a/archiso/initcpio/script/archiso_shutdown
+++ b/archiso/initcpio/script/archiso_shutdown
@@ -5,15 +5,15 @@ mkdir /oldrun
 mount -n --move /oldroot/run /oldrun
 
 # Unmount all mounts now.
-umount $(mount | awk '$3 ~/^\/oldroot/ {print $3}' | sort -r)
+umount "$(mount | awk '$3 ~/^\/oldroot/ {print $3}' | sort -r)"
 
 # Remove all dm-snapshot devices.
 dmsetup remove_all
 
 # Remove all loopback devices.
 for _lup in $(grep ^/dev/loop /oldrun/archiso/used_block_devices | tac); do
-    if ! losetup -d ${_lup} 2> /dev/null; then
-        umount -d ${_lup}
+    if ! losetup -d -- "${_lup}" 2> /dev/null; then
+        umount -d -- "${_lup}"
     fi
 done
 
@@ -21,8 +21,8 @@ done
 umount /oldrun/archiso/cowspace
 
 # Unmount boot device if needed (no copytoram=y used)
-if [[ ! -d /oldrun/archiso/copytoram ]]; then
-    if [[ -d /oldrun/archiso/img_dev ]]; then
+if [ ! -d /oldrun/archiso/copytoram ]; then
+    if [ -d /oldrun/archiso/img_dev ]; then
         umount /oldrun/archiso/img_dev
     else
         umount /oldrun/archiso/bootmnt
@@ -35,3 +35,5 @@ case "$1" in
   reboot|poweroff|halt) "$1" -f ;;
   *) halt -f;;
 esac
+
+# vim: set ft=sh: