diff --git a/pkgs/action-ensure-tea-login/script.sh b/pkgs/action-ensure-tea-login/script.sh
index 4185f5d..10fb3d7 100644
--- a/pkgs/action-ensure-tea-login/script.sh
+++ b/pkgs/action-ensure-tea-login/script.sh
@@ -8,5 +8,5 @@ fi
 GITEA_TOKEN="${GITEA_TOKEN:-"$(cat "$GITEA_TOKEN_FILE")"}"
 
 tea login add \
-  --token $GITEA_TOKEN \
-  --url $GITEA_URL
+  --token "$GITEA_TOKEN" \
+  --url "$GITEA_URL"
diff --git a/pkgs/action-flake-update-pr-clan/script.sh b/pkgs/action-flake-update-pr-clan/script.sh
index 0797663..17cb806 100644
--- a/pkgs/action-flake-update-pr-clan/script.sh
+++ b/pkgs/action-flake-update-pr-clan/script.sh
@@ -5,8 +5,10 @@ set -euo pipefail
 export KEEP_VARS="GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL GIT_COMMITTER_NAME GIT_COMMITTER_EMAIL GITEA_URL GITEA_USER PR_TITLE REMOTE_BRANCH REPO_DIR${KEEP_VARS:+ $KEEP_VARS}"
 
 # configure variables for actions
-export PR_TITLE="Automatic flake update - $(date --iso-8601=minutes)"
-export REMOTE_BRANCH="flake-update-$(date --iso-8601)"
+PR_TITLE="Automatic flake update - $(date --iso-8601=minutes)"
+export PR_TITLE 
+REMOTE_BRANCH="flake-update-$(date --iso-8601)"
+export REMOTE_BRANCH
 export REPO_DIR=$TMPDIR/repo
 export GIT_AUTHOR_NAME="Clan Merge Bot"
 export GIT_AUTHOR_EMAIL="clan-bot@git.clan.lol"
diff --git a/targets/web01/decrypt.sh b/targets/web01/decrypt.sh
index 3f625d8..d712ff2 100755
--- a/targets/web01/decrypt.sh
+++ b/targets/web01/decrypt.sh
@@ -1,6 +1,8 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p coreutils sops openssh
 
+# shellcheck disable=SC1008,SC1128
+
 set -euox pipefail
 
 HOST="clan.lol"
diff --git a/targets/web01/deploy.sh b/targets/web01/deploy.sh
index c6aa588..1895473 100755
--- a/targets/web01/deploy.sh
+++ b/targets/web01/deploy.sh
@@ -1,6 +1,8 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p nix jq bash rsync
 
+# shellcheck disable=SC1008,SC1128
+
 set -euo pipefail
 
 clan machines update web01
diff --git a/terraform/web01/install.sh b/terraform/web01/install.sh
index 3b3f603..63d5cf2 100644
--- a/terraform/web01/install.sh
+++ b/terraform/web01/install.sh
@@ -1,5 +1,7 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p coreutils sops openssh nix
+
+# shellcheck disable=SC1008,SC1128
 set -euox pipefail
 
 if [[ -z "${HOST:-}" ]]; then
diff --git a/terraform/web01/nixosify.sh b/terraform/web01/nixosify.sh
index ea2e3f3..bea7cf4 100644
--- a/terraform/web01/nixosify.sh
+++ b/terraform/web01/nixosify.sh
@@ -1,5 +1,7 @@
 #!/bin/sh
 
+# shellcheck disable=SC1091
+
 set -eu
 
 installNix() {