diff --git a/build-images.sh b/build-images.sh
index f19cacd..a89999e 100755
--- a/build-images.sh
+++ b/build-images.sh
@@ -1,29 +1,26 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -p nix -p coreutils -p bash -p gh -i bash
+# shellcheck shell=bash
 set -xeuo pipefail
 
 build_netboot_image() {
-  tag=$1
-  arch=$2
-  tmp=$3
+  declare -r tag=$1 arch=$2 tmp=$3
   img=$(nix-build --no-out-link -I "nixpkgs=https://github.com/NixOS/nixpkgs/archive/${tag}.tar.gz" '<nixpkgs/nixos/release.nix>' -A "netboot.$arch")
-  cp "$(readlink $img/bzImage)" "$tmp/bzImage-$arch"
+  cp "$(readlink "$img/bzImage")" "$tmp/bzImage-$arch"
   echo "$tmp/bzImage-$arch"
-  cp "$(readlink $img/initrd)" "$tmp/initrd-$arch"
+  cp "$(readlink "$img/initrd")" "$tmp/initrd-$arch"
   echo "$tmp/initrd-$arch"
 }
 
 main() {
-  tag=${1:-nixos-unstable}
-  arch=${2:-x86_64-linux}
-  sha256s=()
+  declare -r tag=${1:-nixos-unstable} arch=${2:-x86_64-linux}
   tmp="$(mktemp -d)"
   trap 'rm -rf -- "$tmp"' EXIT
-  assets=($(build_netboot_image "$tag" "$arch" "$tmp"))
+  readarray -t assets < <(build_netboot_image "$tag" "$arch" "$tmp")
 
   for asset in "${assets[@]}"; do
-    pushd "$(dirname $asset)"
-    sha256sum "$(basename $asset)" >> "$TMP/sha256sums"
+    pushd "$(dirname "$asset")"
+    sha256sum "$(basename "$asset")" >> "$TMP/sha256sums"
     popd
   done
   assets+=("$TMP/sha256sums")