diff --git a/.gitlab-ci/container/baremetal_build.sh b/.gitlab-ci/container/baremetal_build.sh
index b617dfc07a0..aae16884853 100644
--- a/.gitlab-ci/container/baremetal_build.sh
+++ b/.gitlab-ci/container/baremetal_build.sh
@@ -6,24 +6,25 @@ set -o xtrace
 # Fetch the arm-built rootfs image and unpack it in our x86 container (saves
 # network transfer, disk usage, and runtime on test jobs)
 
+# shellcheck disable=SC2154 # arch is assigned in previous scripts
 if wget -q --method=HEAD "${ARTIFACTS_PREFIX}/${FDO_UPSTREAM_REPO}/${ARTIFACTS_SUFFIX}/${arch}/done"; then
   ARTIFACTS_URL="${ARTIFACTS_PREFIX}/${FDO_UPSTREAM_REPO}/${ARTIFACTS_SUFFIX}/${arch}"
 else
   ARTIFACTS_URL="${ARTIFACTS_PREFIX}/${CI_PROJECT_PATH}/${ARTIFACTS_SUFFIX}/${arch}"
 fi
 
-wget ${ARTIFACTS_URL}/lava-rootfs.tar.zst -O rootfs.tar.zst
-mkdir -p /rootfs-$arch
-tar -C /rootfs-$arch '--exclude=./dev/*' --zstd -xf rootfs.tar.zst
+wget "${ARTIFACTS_URL}"/lava-rootfs.tar.zst -O rootfs.tar.zst
+mkdir -p /rootfs-"$arch"
+tar -C /rootfs-"$arch" '--exclude=./dev/*' --zstd -xf rootfs.tar.zst
 rm rootfs.tar.zst
 
 if [[ $arch == "arm64" ]]; then
     mkdir -p /baremetal-files
     pushd /baremetal-files
 
-    wget ${ARTIFACTS_URL}/Image
-    wget ${ARTIFACTS_URL}/Image.gz
-    wget ${ARTIFACTS_URL}/cheza-kernel
+    wget "${ARTIFACTS_URL}"/Image
+    wget "${ARTIFACTS_URL}"/Image.gz
+    wget "${ARTIFACTS_URL}"/cheza-kernel
 
     DEVICE_TREES=""
     DEVICE_TREES="$DEVICE_TREES apq8016-sbc.dtb"
@@ -31,7 +32,7 @@ if [[ $arch == "arm64" ]]; then
     DEVICE_TREES="$DEVICE_TREES tegra210-p3450-0000.dtb"
 
     for DTB in $DEVICE_TREES; do
-        wget ${ARTIFACTS_URL}/$DTB
+        wget "${ARTIFACTS_URL}/$DTB"
     done
 
     popd
@@ -39,12 +40,12 @@ elif [[ $arch == "armhf" ]]; then
     mkdir -p /baremetal-files
     pushd /baremetal-files
 
-    wget ${ARTIFACTS_URL}/zImage
+    wget "${ARTIFACTS_URL}"/zImage
 
     DEVICE_TREES="imx6q-cubox-i.dtb"
 
     for DTB in $DEVICE_TREES; do
-        wget ${ARTIFACTS_URL}/$DTB
+        wget "${ARTIFACTS_URL}/$DTB"
     done
 
     popd
diff --git a/.gitlab-ci/container/build-apitrace.sh b/.gitlab-ci/container/build-apitrace.sh
index f0f025175e3..9ca0c3b6e1f 100644
--- a/.gitlab-ci/container/build-apitrace.sh
+++ b/.gitlab-ci/container/build-apitrace.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -ex
 
diff --git a/.gitlab-ci/container/build-crosvm.sh b/.gitlab-ci/container/build-crosvm.sh
index e69f137ba6b..4555e9c7ccb 100644
--- a/.gitlab-ci/container/build-crosvm.sh
+++ b/.gitlab-ci/container/build-crosvm.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -ex
 
diff --git a/.gitlab-ci/container/build-deqp-runner.sh b/.gitlab-ci/container/build-deqp-runner.sh
index d84e8261739..ac0ac0a0cc2 100644
--- a/.gitlab-ci/container/build-deqp-runner.sh
+++ b/.gitlab-ci/container/build-deqp-runner.sh
@@ -1,4 +1,5 @@
 #!/bin/sh
+# shellcheck disable=SC2086 # we want word splitting
 
 set -ex
 
diff --git a/.gitlab-ci/container/build-deqp.sh b/.gitlab-ci/container/build-deqp.sh
index fda9a971f1b..c9f4df71f56 100644
--- a/.gitlab-ci/container/build-deqp.sh
+++ b/.gitlab-ci/container/build-deqp.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -ex
 
@@ -80,10 +81,11 @@ rm -rf /deqp/external/openglcts/modules/cts-runner
 rm -rf /deqp/modules/internal
 rm -rf /deqp/execserver
 rm -rf /deqp/framework
+# shellcheck disable=SC2038,SC2185 # TODO: rewrite find
 find -iname '*cmake*' -o -name '*ninja*' -o -name '*.o' -o -name '*.a' | xargs rm -rf
 ${STRIP_CMD:-strip} external/vulkancts/modules/vulkan/deqp-vk
 ${STRIP_CMD:-strip} external/openglcts/modules/glcts
 ${STRIP_CMD:-strip} modules/*/deqp-*
-du -sh *
+du -sh ./*
 rm -rf /VK-GL-CTS
 popd
diff --git a/.gitlab-ci/container/build-kernel.sh b/.gitlab-ci/container/build-kernel.sh
index 426ecb780d6..a2bbb1a5d11 100644
--- a/.gitlab-ci/container/build-kernel.sh
+++ b/.gitlab-ci/container/build-kernel.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -ex
 
@@ -11,12 +12,15 @@ pushd kernel
 # debian (they'll get blown away by the rm of the kernel dir at the end).
 mkdir -p ld-links
 for i in /usr/bin/*-ld /usr/bin/ld; do
-    i=`basename $i`
+    i=$(basename $i)
     ln -sf /usr/bin/$i.bfd ld-links/$i
 done
-export PATH=`pwd`/ld-links:$PATH
 
-export LOCALVERSION="`basename $KERNEL_URL`"
+NEWPATH=$(pwd)/ld-links
+export PATH=$NEWPATH:$PATH
+
+KERNEL_FILENAME=$(basename $KERNEL_URL)
+export LOCALVERSION="$KERNEL_FILENAME"
 ./scripts/kconfig/merge_config.sh ${DEFCONFIG} ../.gitlab-ci/container/${KERNEL_ARCH}.config
 make ${KERNEL_IMAGE_NAME}
 for image in ${KERNEL_IMAGE_NAME}; do
diff --git a/.gitlab-ci/container/build-libclc.sh b/.gitlab-ci/container/build-libclc.sh
index ecf7f21c9ea..a16f5019c23 100644
--- a/.gitlab-ci/container/build-libclc.sh
+++ b/.gitlab-ci/container/build-libclc.sh
@@ -26,5 +26,5 @@ mkdir -p /usr/lib/clc
 ln -s /usr/share/clc/spirv64-mesa3d-.spv /usr/lib/clc/
 ln -s /usr/share/clc/spirv-mesa3d-.spv /usr/lib/clc/
 
-du -sh *
+du -sh ./*
 rm -rf /libclc /llvm-project
diff --git a/.gitlab-ci/container/build-libdrm.sh b/.gitlab-ci/container/build-libdrm.sh
index 65bd7768ad9..8d668bf7878 100644
--- a/.gitlab-ci/container/build-libdrm.sh
+++ b/.gitlab-ci/container/build-libdrm.sh
@@ -1,14 +1,14 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -ex
 
 export LIBDRM_VERSION=libdrm-2.4.110
 
-wget https://dri.freedesktop.org/libdrm/$LIBDRM_VERSION.tar.xz
-tar -xvf $LIBDRM_VERSION.tar.xz && rm $LIBDRM_VERSION.tar.xz
-cd $LIBDRM_VERSION
+wget https://dri.freedesktop.org/libdrm/"$LIBDRM_VERSION".tar.xz
+tar -xvf "$LIBDRM_VERSION".tar.xz && rm "$LIBDRM_VERSION".tar.xz
+cd "$LIBDRM_VERSION"
 meson build -D vc4=false -D freedreno=false -D etnaviv=false $EXTRA_MESON_ARGS
 ninja -C build install
 cd ..
-rm -rf $LIBDRM_VERSION
-
+rm -rf "$LIBDRM_VERSION"
diff --git a/.gitlab-ci/container/build-piglit.sh b/.gitlab-ci/container/build-piglit.sh
index 7d8af6277da..a84f2e74d4f 100644
--- a/.gitlab-ci/container/build-piglit.sh
+++ b/.gitlab-ci/container/build-piglit.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -ex
 
@@ -8,9 +9,11 @@ git checkout b2c9d8f56b45d79f804f4cb5ac62520f0edd8988
 patch -p1 <$OLDPWD/.gitlab-ci/piglit/disable-vs_in.diff
 cmake -S . -B . -G Ninja -DCMAKE_BUILD_TYPE=Release $PIGLIT_OPTS $EXTRA_CMAKE_ARGS
 ninja $PIGLIT_BUILD_TARGETS
+# shellcheck disable=SC2038,SC2185 # TODO: rewrite find
 find -name .git -o -name '*ninja*' -o -iname '*cmake*' -o -name '*.[chao]' | xargs rm -rf
 rm -rf target_api
-if [ "x$PIGLIT_BUILD_TARGETS" = "xpiglit_replayer" ]; then
+if [ "$PIGLIT_BUILD_TARGETS" = "piglit_replayer" ]; then
+    # shellcheck disable=SC2038,SC2185 # TODO: rewrite find
     find ! -regex "^\.$" \
          ! -regex "^\.\/piglit.*" \
          ! -regex "^\.\/framework.*" \
diff --git a/.gitlab-ci/container/build-rust.sh b/.gitlab-ci/container/build-rust.sh
index 57f1e7e5d5d..2fdfb22115e 100644
--- a/.gitlab-ci/container/build-rust.sh
+++ b/.gitlab-ci/container/build-rust.sh
@@ -8,8 +8,8 @@ set -ex
 # cargo (and rustup) wants to store stuff in $HOME/.cargo, and binaries in
 # $HOME/.cargo/bin.  Make bin a link to a public bin directory so the commands
 # are just available to all build jobs.
-mkdir -p $HOME/.cargo
-ln -s /usr/local/bin $HOME/.cargo/bin
+mkdir -p "$HOME"/.cargo
+ln -s /usr/local/bin "$HOME"/.cargo/bin
 
 # For rust in Mesa, we use rustup to install.  This lets us pick an arbitrary
 # version of the compiler, rather than whatever the container's Debian comes
diff --git a/.gitlab-ci/container/build-va-tools.sh b/.gitlab-ci/container/build-va-tools.sh
index 150575033c9..72098516da4 100644
--- a/.gitlab-ci/container/build-va-tools.sh
+++ b/.gitlab-ci/container/build-va-tools.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -ex
 
diff --git a/.gitlab-ci/container/container_pre_build.sh b/.gitlab-ci/container/container_pre_build.sh
index 468d81fa778..6f5c8e263d0 100755
--- a/.gitlab-ci/container/container_pre_build.sh
+++ b/.gitlab-ci/container/container_pre_build.sh
@@ -28,8 +28,11 @@ find /usr/bin -name \*-ld -o -name ld | \
 ccache --show-stats
 
 # Make a wrapper script for ninja to always include the -j flags
-echo '#!/bin/sh -x' > /usr/local/bin/ninja
-echo '/usr/bin/ninja -j${FDO_CI_CONCURRENT:-4} "$@"' >> /usr/local/bin/ninja
+{
+    echo '#!/bin/sh -x'
+    # shellcheck disable=SC2016
+    echo '/usr/bin/ninja -j${FDO_CI_CONCURRENT:-4} "$@"'
+} > /usr/local/bin/ninja
 chmod +x /usr/local/bin/ninja
 
 # Set MAKEFLAGS so that all make invocations in container builds include the
diff --git a/.gitlab-ci/container/create-android-cross-file.sh b/.gitlab-ci/container/create-android-cross-file.sh
index ac07ca11f98..656fc3c5693 100644
--- a/.gitlab-ci/container/create-android-cross-file.sh
+++ b/.gitlab-ci/container/create-android-cross-file.sh
@@ -13,7 +13,7 @@ arch2=${5:-$2}
 # and allowing it in code generation means we get unwind symbols that break
 # the libEGL and driver symbol tests.
 
-cat >$cross_file <<EOF
+cat > "$cross_file" <<EOF
 [binaries]
 ar = '$ndk/toolchains/llvm/prebuilt/linux-x86_64/bin/$arch-ar'
 c = ['ccache', '$ndk/toolchains/llvm/prebuilt/linux-x86_64/bin/${arch2}29-clang', '-fno-exceptions', '-fno-unwind-tables', '-fno-asynchronous-unwind-tables']
diff --git a/.gitlab-ci/container/create-android-ndk-pc.sh b/.gitlab-ci/container/create-android-ndk-pc.sh
index 1380cc240be..91987b50a2c 100644
--- a/.gitlab-ci/container/create-android-ndk-pc.sh
+++ b/.gitlab-ci/container/create-android-ndk-pc.sh
@@ -1,4 +1,5 @@
 #!/bin/sh
+# shellcheck disable=SC2086 # we want word splitting
 
 # Makes a .pc file in the Android NDK for meson to find its libraries.
 
diff --git a/.gitlab-ci/container/create-cross-file.sh b/.gitlab-ci/container/create-cross-file.sh
index 0330d7b4818..dddb9a2ef31 100755
--- a/.gitlab-ci/container/create-cross-file.sh
+++ b/.gitlab-ci/container/create-cross-file.sh
@@ -2,7 +2,7 @@
 
 arch=$1
 cross_file="/cross_file-$arch.txt"
-/usr/share/meson/debcrossgen --arch $arch -o "$cross_file"
+/usr/share/meson/debcrossgen --arch "$arch" -o "$cross_file"
 # Explicitly set ccache path for cross compilers
 sed -i "s|/usr/bin/\([^-]*\)-linux-gnu\([^-]*\)-g|/usr/lib/ccache/\\1-linux-gnu\\2-g|g" "$cross_file"
 if [ "$arch" = "i386" ]; then
@@ -10,10 +10,11 @@ if [ "$arch" = "i386" ]; then
     sed -i "s|cpu_family = 'i686'|cpu_family = 'x86'|g" "$cross_file"
 fi
 # Rely on qemu-user being configured in binfmt_misc on the host
+# shellcheck disable=SC1003 # how this sed doesn't seems to work for me locally
 sed -i -e '/\[properties\]/a\' -e "needs_exe_wrapper = False" "$cross_file"
 
 # Add a line for rustc, which debcrossgen is missing.
-cc=`sed -n 's|c = .\(.*\).|\1|p' < $cross_file`
+cc=$(sed -n 's|c = .\(.*\).|\1|p' < "$cross_file")
 if [[ "$arch" = "arm64" ]]; then
     rust_target=aarch64-unknown-linux-gnu
 elif [[ "$arch" = "armhf" ]]; then
@@ -27,6 +28,7 @@ elif [[ "$arch" = "s390x" ]]; then
 else
     echo "Needs rustc target mapping"
 fi
+# shellcheck disable=SC1003 # how this sed doesn't seems to work for me locally
 sed -i -e '/\[binaries\]/a\' -e "rust = ['rustc', '--target=$rust_target', '-C', 'linker=$cc']" "$cross_file"
 
 # Set up cmake cross compile toolchain file for dEQP builds
@@ -34,18 +36,18 @@ toolchain_file="/toolchain-$arch.cmake"
 if [[ "$arch" = "arm64" ]]; then
     GCC_ARCH="aarch64-linux-gnu"
     DE_CPU="DE_CPU_ARM_64"
-    CMAKE_ARCH=arm
 elif [[ "$arch" = "armhf" ]]; then
     GCC_ARCH="arm-linux-gnueabihf"
     DE_CPU="DE_CPU_ARM"
-    CMAKE_ARCH=arm
 fi
 
 if [[ -n "$GCC_ARCH" ]]; then
-    echo "set(CMAKE_SYSTEM_NAME Linux)" > "$toolchain_file"
-    echo "set(CMAKE_SYSTEM_PROCESSOR arm)" >> "$toolchain_file"
-    echo "set(CMAKE_C_COMPILER /usr/lib/ccache/$GCC_ARCH-gcc)" >> "$toolchain_file"
-    echo "set(CMAKE_CXX_COMPILER /usr/lib/ccache/$GCC_ARCH-g++)" >> "$toolchain_file"
-    echo "set(ENV{PKG_CONFIG} \"/usr/bin/$GCC_ARCH-pkg-config\")" >> "$toolchain_file"
-    echo "set(DE_CPU $DE_CPU)" >> "$toolchain_file"
+    {
+        echo "set(CMAKE_SYSTEM_NAME Linux)";
+        echo "set(CMAKE_SYSTEM_PROCESSOR arm)";
+        echo "set(CMAKE_C_COMPILER /usr/lib/ccache/$GCC_ARCH-gcc)";
+        echo "set(CMAKE_CXX_COMPILER /usr/lib/ccache/$GCC_ARCH-g++)";
+        echo "set(ENV{PKG_CONFIG} \"/usr/bin/$GCC_ARCH-pkg-config\")";
+        echo "set(DE_CPU $DE_CPU)";
+    } > "$toolchain_file"
 fi
diff --git a/.gitlab-ci/container/create-rootfs.sh b/.gitlab-ci/container/create-rootfs.sh
index 53f7b7c085e..9715e6f857e 100644
--- a/.gitlab-ci/container/create-rootfs.sh
+++ b/.gitlab-ci/container/create-rootfs.sh
@@ -1,4 +1,7 @@
 #!/bin/bash
+# shellcheck disable=SC2140  # ugly array, remove later
+# shellcheck disable=SC2288  # ugly array, remove later
+# shellcheck disable=SC2086 # we want word splitting
 
 set -ex
 
diff --git a/.gitlab-ci/container/cross_build.sh b/.gitlab-ci/container/cross_build.sh
index 29706fb737a..024696be6e6 100644
--- a/.gitlab-ci/container/cross_build.sh
+++ b/.gitlab-ci/container/cross_build.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -e
 set -o xtrace
diff --git a/.gitlab-ci/container/debian/android_build.sh b/.gitlab-ci/container/debian/android_build.sh
index 121976f1b73..c6ed95940c8 100644
--- a/.gitlab-ci/container/debian/android_build.sh
+++ b/.gitlab-ci/container/debian/android_build.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -ex
 
@@ -19,7 +20,7 @@ rm $ndk.zip
 # duplicate files.  Turn them into hardlinks to save on container space.
 rdfind -makehardlinks true -makeresultsfile false /android-ndk-r21d/
 # Drop some large tools we won't use in this build.
-find /android-ndk-r21d/ -type f | egrep -i "clang-check|clang-tidy|lldb" | xargs rm -f
+find /android-ndk-r21d/ -type f | grep -E -i "clang-check|clang-tidy|lldb" | xargs rm -f
 
 sh .gitlab-ci/container/create-android-ndk-pc.sh /$ndk zlib.pc "" "-lz" "1.2.3"
 
diff --git a/.gitlab-ci/container/debian/arm_build.sh b/.gitlab-ci/container/debian/arm_build.sh
index 45608a0a453..391530f967e 100644
--- a/.gitlab-ci/container/debian/arm_build.sh
+++ b/.gitlab-ci/container/debian/arm_build.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -e
 set -o xtrace
diff --git a/.gitlab-ci/container/debian/x86_build-base.sh b/.gitlab-ci/container/debian/x86_build-base.sh
index dff57fa0867..a3459d1b7cc 100644
--- a/.gitlab-ci/container/debian/x86_build-base.sh
+++ b/.gitlab-ci/container/debian/x86_build-base.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -e
 set -o xtrace
diff --git a/.gitlab-ci/container/debian/x86_build-mingw-patch.sh b/.gitlab-ci/container/debian/x86_build-mingw-patch.sh
index bd83a81312a..e29d2f1aa53 100644
--- a/.gitlab-ci/container/debian/x86_build-mingw-patch.sh
+++ b/.gitlab-ci/container/debian/x86_build-mingw-patch.sh
@@ -1,4 +1,7 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
+
+set -e
 
 # Pull packages from msys2 repository that can be directly used.
 # We can use https://packages.msys2.org/ to retrieve the newest package
diff --git a/.gitlab-ci/container/debian/x86_build-mingw-source-deps.sh b/.gitlab-ci/container/debian/x86_build-mingw-source-deps.sh
index 2b3f903b91b..0dc5833c68d 100644
--- a/.gitlab-ci/container/debian/x86_build-mingw-source-deps.sh
+++ b/.gitlab-ci/container/debian/x86_build-mingw-source-deps.sh
@@ -1,4 +1,8 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
+
+set -e
+
 wd=$PWD
 CMAKE_TOOLCHAIN_MINGW_PATH=$wd/.gitlab-ci/container/debian/x86_mingw-toolchain.cmake
 mkdir -p ~/tmp
diff --git a/.gitlab-ci/container/debian/x86_build.sh b/.gitlab-ci/container/debian/x86_build.sh
index 8037e275752..479f5d136bc 100644
--- a/.gitlab-ci/container/debian/x86_build.sh
+++ b/.gitlab-ci/container/debian/x86_build.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -e
 set -o xtrace
diff --git a/.gitlab-ci/container/debian/x86_test-base.sh b/.gitlab-ci/container/debian/x86_test-base.sh
index eb4d7876f0c..68521a66501 100644
--- a/.gitlab-ci/container/debian/x86_test-base.sh
+++ b/.gitlab-ci/container/debian/x86_test-base.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -e
 set -o xtrace
diff --git a/.gitlab-ci/container/debian/x86_test-gl.sh b/.gitlab-ci/container/debian/x86_test-gl.sh
index d4fc8b32460..b56d2e4ea3f 100644
--- a/.gitlab-ci/container/debian/x86_test-gl.sh
+++ b/.gitlab-ci/container/debian/x86_test-gl.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -e
 set -o xtrace
diff --git a/.gitlab-ci/container/debian/x86_test-vk.sh b/.gitlab-ci/container/debian/x86_test-vk.sh
index 6efacfa2af1..3922bcc76b8 100644
--- a/.gitlab-ci/container/debian/x86_test-vk.sh
+++ b/.gitlab-ci/container/debian/x86_test-vk.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # The relative paths in this file only become valid at runtime.
 # shellcheck disable=SC1091
+# shellcheck disable=SC2086 # we want word splitting
 
 set -e
 set -o xtrace
diff --git a/.gitlab-ci/container/fedora/x86_build.sh b/.gitlab-ci/container/fedora/x86_build.sh
index 5f5f25496f5..3b101f0d5b4 100644
--- a/.gitlab-ci/container/fedora/x86_build.sh
+++ b/.gitlab-ci/container/fedora/x86_build.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2086 # we want word splitting
 
 set -e
 set -o xtrace
diff --git a/.gitlab-ci/container/lava_build.sh b/.gitlab-ci/container/lava_build.sh
index fb5ce87dae9..fdb6ccaf2ed 100755
--- a/.gitlab-ci/container/lava_build.sh
+++ b/.gitlab-ci/container/lava_build.sh
@@ -1,4 +1,7 @@
 #!/bin/bash
+# shellcheck disable=SC1091 # The relative paths in this file only become valid at runtime.
+# shellcheck disable=SC2034 # Variables are used in scripts called from here
+# shellcheck disable=SC2086 # we want word splitting
 
 set -e
 set -o xtrace
@@ -225,7 +228,8 @@ rm /lava-files/rootfs-${DEBIAN_ARCH}/create-rootfs.sh
 # Dependencies pulled during the creation of the rootfs may overwrite
 # the built libdrm. Hence, we add it after the rootfs has been already
 # created.
-find /libdrm/ -name lib\*\.so\* | xargs cp -t /lava-files/rootfs-${DEBIAN_ARCH}/usr/lib/$GCC_ARCH/.
+find /libdrm/ -name lib\*\.so\* \
+  -exec cp -t /lava-files/rootfs-${DEBIAN_ARCH}/usr/lib/$GCC_ARCH/. {} \;
 mkdir -p /lava-files/rootfs-${DEBIAN_ARCH}/libdrm/
 cp -Rp /libdrm/share /lava-files/rootfs-${DEBIAN_ARCH}/libdrm/share
 rm -rf /libdrm