diff --git a/misc/qubes-download-dom0-updates.sh b/misc/qubes-download-dom0-updates.sh
index cd527a4..f871f7e 100755
--- a/misc/qubes-download-dom0-updates.sh
+++ b/misc/qubes-download-dom0-updates.sh
@@ -73,17 +73,19 @@ rm -f $DOM0_UPDATES_DIR/var/lib/rpm/__*
 rpm --root=$DOM0_UPDATES_DIR --rebuilddb
 
 if [ "$CLEAN" = "1" ]; then
+    # shellcheck disable=SC2086
     $YUM $OPTS clean all
-    rm -f $DOM0_UPDATES_DIR/packages/*
-    rm -rf $DOM0_UPDATES_DIR/var/cache/yum/*
+    rm -f "$DOM0_UPDATES_DIR"/packages/*
+    rm -rf "$DOM0_UPDATES_DIR"/var/cache/yum/*
 fi
 
 # just check for updates, but don't download any package
-if [ "x$PKGLIST" = "x" -a "$CHECK_ONLY" = "1" ]; then
+if [ "x$PKGLIST" = "x" ] && [ "$CHECK_ONLY" = "1" ]; then
     echo "Checking for dom0 updates..." >&2
-    UPDATES_FULL=`$YUM $OPTS check-update`
+    # shellcheck disable=SC2086
+    UPDATES_FULL=$($YUM $OPTS check-update)
     check_update_retcode=$?
-    if [ $check_update_retcode -eq 1 ]; then
+    if [ "$check_update_retcode" -eq 1 ]; then
         # Exit here if yum have reported an error. Exit code 100 isn't an
         # error, it's "updates available" info, so check specifically for exit code 1
         exit 1
@@ -106,8 +108,8 @@ YUM_COMMAND="fakeroot $YUM $YUM_ACTION -y --downloadonly"
 # check for --downloadonly option - if not supported (Debian), fallback to
 # yumdownloader
 if ! $YUM --help | grep -q downloadonly; then
-    if [ "$YUM_ACTION" != "install" -a "$YUM_ACTION" != "upgrade" ]; then
-        echo "ERROR: yum version installed in VM `hostname` does not suppport --downloadonly option" >&2
+    if [ "$YUM_ACTION" != "install" ] && [ "$YUM_ACTION" != "upgrade" ]; then
+        echo "ERROR: yum version installed in VM $(hostname) does not suppport --downloadonly option" >&2
         echo "ERROR: only 'install' and 'upgrade' actions supported ($YUM_ACTION not)" >&2
         if [ "$GUI" = 1 ]; then
             zenity --error --text="yum version too old for '$YUM_ACTION' action, see console for details"
@@ -115,11 +117,12 @@ if ! $YUM --help | grep -q downloadonly; then
         exit 1
     fi
     if [ "$YUM_ACTION" = "upgrade" ]; then
-        UPDATES_FULL=`$YUM $OPTS check-update $PKGLIST`
+        # shellcheck disable=SC2086
+        UPDATES_FULL=$($YUM $OPTS check-update $PKGLIST)
         check_update_retcode=$?
-        UPDATES_FULL=`echo "$UPDATES_FULL" | grep -v "^Loaded plugins:\|^Last metadata\|^$"`
-        UPDATES=`echo "$UPDATES_FULL" | grep -v "^Obsoleting\|Could not" | cut -f 1 -d ' '`
-        if [ $check_update_retcode -eq 0 ]; then
+        UPDATES_FULL=$(echo "$UPDATES_FULL" | grep -v "^Loaded plugins:\|^Last metadata\|^$")
+        UPDATES=$(echo "$UPDATES_FULL" | grep -v "^Obsoleting\|Could not" | cut -f 1 -d ' ')
+        if [ "$check_update_retcode" -eq 0 ]; then
             # exit code 0 means no updates available - regardless of stdout messages
             echo "No new updates available"
             exit 0
@@ -135,23 +138,25 @@ set -e
 
 if [ "$GUI" = 1 ]; then
     ( echo "1"
+    # shellcheck disable=SC2086
     $YUM_COMMAND $OPTS $PKGLIST
     echo 100 ) | zenity --progress --pulsate --auto-close --auto-kill \
          --text="Downloading updates for Dom0, please wait..." --title="Qubes Dom0 updates"
 else
+    # shellcheck disable=SC2086
     $YUM_COMMAND $OPTS $PKGLIST
 fi
 
-find $DOM0_UPDATES_DIR/var/cache/yum -name '*.rpm' -print0 |\
-    xargs -0 -r ln -f -t $DOM0_UPDATES_DIR/packages/
+find "$DOM0_UPDATES_DIR/var/cache/yum" -name '*.rpm' -print0 |\
+    xargs -0 -r ln -f -t "$DOM0_UPDATES_DIR/packages/"
 
-if ls $DOM0_UPDATES_DIR/packages/*.rpm > /dev/null 2>&1; then
+if ls "$DOM0_UPDATES_DIR"/packages/*.rpm > /dev/null 2>&1; then
     cmd="/usr/lib/qubes/qrexec-client-vm dom0 qubes.ReceiveUpdates /usr/lib/qubes/qfile-agent"
     qrexec_exit_code=0
-    $cmd $DOM0_UPDATES_DIR/packages/*.rpm || { qrexec_exit_code=$? ; true; };
+    $cmd "$DOM0_UPDATES_DIR"/packages/*.rpm || { qrexec_exit_code=$? ; true; };
     if [ ! "$qrexec_exit_code" = "0" ]; then
         echo "'$cmd $DOM0_UPDATES_DIR/packages/*.rpm' failed with exit code ${qrexec_exit_code}!" >&2
-        exit $qrexec_exit_code
+        exit "$qrexec_exit_code"
     fi
 else
     echo "No packages downloaded"