diff --git a/bin/heads b/bin/heads
index 5cac63f..37a4041 100755
--- a/bin/heads
+++ b/bin/heads
@@ -1,3 +1,3 @@
 #!/bin/sh
 # Head as much as fits on screen
-exec head -n $(echo "$(tput lines) - 5" | bc) "$@"
+exec head -n "$(echo "$(tput lines) - 5" | bc)" "$@"
diff --git a/bin/lock b/bin/lock
index 7b5f62e..91d759e 100755
--- a/bin/lock
+++ b/bin/lock
@@ -9,6 +9,7 @@ error() {
 [ -n "$1" ] || error "input file missing"
 [ -r "$1" ] || error "can't read input file"
 
+# shellcheck disable=SC2016 # I don't want $(tty) to be expanded
 printf '#!/bin/sh
 GPG_TTY=$(tty)
 export GPG_TTY
diff --git a/bin/noautomount b/bin/noautomount
index 7b25d6b..63aa865 100755
--- a/bin/noautomount
+++ b/bin/noautomount
@@ -2,7 +2,7 @@
 usage() {
   echo "Usage:
 
-  $(basename $0) [-h] <volume> -- generate /etc/fstab entry to prevent automount on macOS
+  $(basename "$0") [-h] <volume> -- generate /etc/fstab entry to prevent automount on macOS
 
   where:
     -h      print this help
diff --git a/bin/tails b/bin/tails
index a706117..2b9e92a 100755
--- a/bin/tails
+++ b/bin/tails
@@ -1,3 +1,3 @@
 #!/bin/sh
 # Tail as much as fits on screen
-exec tail -n $(echo "$(tput lines) - 5" | bc) "$@"
+exec tail -n "$(echo "$(tput lines) - 5" | bc)" "$@"
diff --git a/bin/vboxmount b/bin/vboxmount
index 65381c8..5332544 100755
--- a/bin/vboxmount
+++ b/bin/vboxmount
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-scriptname=`basename "$0"`
+scriptname=$(basename "$0")
 
 usage() {
     echo "Usage: $scriptname SHARE [...]"
@@ -15,7 +15,7 @@ mount_share() {
     share="$1"
     sudo mkdir "/mnt/$share"
     sudo chmod 777 "/mnt/$share"
-    sudo mount -t vboxsf -o uid=$UID,gid=$(id -g) "$share" "/mnt/$share"
+    sudo mount -t vboxsf -o uid=$UID,gid="$(id -g)" "$share" "/mnt/$share"
 }
 
 main() {
diff --git a/install.sh b/install.sh
index db2fc9b..38d2703 100755
--- a/install.sh
+++ b/install.sh
@@ -150,7 +150,7 @@ main() {
   while getopts 'hny' opt; do
     case "$opt" in
     n)  # dry run
-      cmd='echo'
+      CMD='echo'
       echo "${yellow}Performing dry run (no changes will be made).${sgr0}"
       echo
       ;;
diff --git a/utils/config.def.sh b/utils/config.def.sh
index fb6f7a0..afbf27a 100644
--- a/utils/config.def.sh
+++ b/utils/config.def.sh
@@ -1,3 +1,7 @@
+# shellcheck shell=sh
+# shellcheck disable=SC2034 # Variables defined here are meant to be used in the
+#                             script that sources this file.
+
 # Where to install the dotfiles, usually $HOME.
 DESTDIR="$HOME"
 
diff --git a/utils/debian.sh b/utils/debian.sh
index 85ba65b..7cc4cc7 100755
--- a/utils/debian.sh
+++ b/utils/debian.sh
@@ -39,7 +39,6 @@ setup_commands() {
   GIT="${dry}git"
   GZIP="${dry}gzip"
   HELP2MAN="${dry}help2man"
-  LN="${dry}ln"
   MKDIR="${dry}mkdir"
   MV="${dry}mv"
   PANDOC="${dry}pandoc"