diff --git a/debian/qubes-core-agent-thunar.postinst b/debian/qubes-core-agent-thunar.postinst
index 2751d1a..b4e829d 100755
--- a/debian/qubes-core-agent-thunar.postinst
+++ b/debian/qubes-core-agent-thunar.postinst
@@ -27,11 +27,13 @@ case "${1}" in
         # to be placed after all already defined actions and before </actions>
         # the end of file.
         if [ -f /etc/xdg/Thunar/uca.xml ] ; then
-          cp -p /etc/xdg/Thunar/uca.xml{,.bak}
+          cp -p /etc/xdg/Thunar/uca.xml /etc/xdg/Thunar/uca.xml.bak
+          #shellcheck disable=SC2016
           sed -i '$e cat /usr/lib/qubes/uca_qubes.xml' /etc/xdg/Thunar/uca.xml
         fi
         if [ -f /home/user/.config/Thunar/uca.xml ] ; then
-          cp -p /home/user/.config/Thunar/uca.xml{,.bak}
+          cp -p /home/user/.config/Thunar/uca.xml /home/user/.config/Thunar/uca.xml.bak
+          #shellcheck disable=SC2016
           sed -i '$e cat /usr/lib/qubes/uca_qubes.xml' /home/user/.config/Thunar/uca.xml
         fi
         ;;
diff --git a/debian/qubes-core-agent-thunar.postrm b/debian/qubes-core-agent-thunar.postrm
index d19a93a..afcd82c 100755
--- a/debian/qubes-core-agent-thunar.postrm
+++ b/debian/qubes-core-agent-thunar.postrm
@@ -38,12 +38,12 @@ set -e
 
 if [ "${1}" = "remove" ] ; then
   if [ -f /etc/xdg/Thunar/uca.xml ] ; then
-    mv /etc/xdg/Thunar/uca.xml{,.uninstall}
-    mv /etc/xdg/Thunar/uca.xml{.bak,}
+    mv /etc/xdg/Thunar/uca.xml /etc/xdg/Thunar/uca.xml.uninstall
+    mv /etc/xdg/Thunar/uca.xml.bak /etc/xdg/Thunar/uca.xml
   fi
   if [ -f /home/user/.config/Thunar/uca.xml ] ; then
-    mv /home/user/.config/Thunar/uca.xml{,.uninstall}
-    mv /home/user/.config/Thunar/uca.xml{.bak,}
+    mv /home/user/.config/Thunar/uca.xml /home/user/.config/Thunar/uca.xml.uninstall
+    mv /home/user/.config/Thunar/uca.xml.bak /home/user/.config/Thunar/uca.xml
   fi
 fi
 
diff --git a/qubes-rpc/qvm-actions.sh b/qubes-rpc/qvm-actions.sh
index 789dd12..7d76231 100755
--- a/qubes-rpc/qvm-actions.sh
+++ b/qubes-rpc/qvm-actions.sh
@@ -15,33 +15,36 @@ files=${*:2}
 # copy and move handle a list of files where other actions don't
 case $1 in
     copy)
-        qvm-copy-to-vm '$default' $files | zenity --notification --text="Copying files..." --timeout 3
+        #shellcheck disable=SC2016
+        qvm-copy-to-vm '$default' "$files" | zenity --notification --text="Copying files..." --timeout 3
         ;;
     move)
-        qvm-move-to-vm '$default' $files | zenity --notification --text="Moving files..." --timeout 3
+        #shellcheck disable=SC2016
+        qvm-move-to-vm '$default' "$files" | zenity --notification --text="Moving files..." --timeout 3
         ;;
     img)
         for file in $files
         do
-            /usr/lib/qubes/qvm-convert-img.gnome $file
+            /usr/lib/qubes/qvm-convert-img.gnome "$file"
         done
         ;;
     pdf)
         for file in $files
         do
-            /usr/lib/qubes/qvm-convert-pdf.gnome $file
+            /usr/lib/qubes/qvm-convert-pdf.gnome "$file"
         done
         ;;
     openvm)
         for file in $files
         do
-            qvm-open-in-vm '$default' $file | zenity --notification --text "Opening $file in VM..." --timeout 3 &
+            #shellcheck disable=SC2016
+            qvm-open-in-vm '$default' "$file" | zenity --notification --text "Opening $file in VM..." --timeout 3 &
         done
         ;;
     opendvm)
         for file in $files
         do
-            qvm-open-in-dvm $files | zenity --notification --text "Opening $file in DisposableVM..." --timeout 3 &
+            qvm-open-in-dvm "$files" | zenity --notification --text "Opening $file in DisposableVM..." --timeout 3 &
         done
         ;;
     *)