diff --git a/.ci/install.sh b/.ci/install.sh
index 2282d478a..1d595824f 100755
--- a/.ci/install.sh
+++ b/.ci/install.sh
@@ -49,7 +49,7 @@ else
 fi
 
 #install our own updated shellcheck
-SHELLCHECK_VERSION="v0.7.1"
+SHELLCHECK_VERSION="v0.8.0"
 SHELLCHECK_URL="https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION?}/shellcheck-${SHELLCHECK_VERSION?}.linux.x86_64.tar.xz"
 if ! command -v shellcheck; then
     curl -sSL "${SHELLCHECK_URL}" | tar --exclude 'SHA256SUMS' --strip-components=1 -C "${HOME}/bin" -xJf -
diff --git a/platform/appimage/AppRun b/platform/appimage/AppRun
index 9f28b39dc..35a735c4c 100755
--- a/platform/appimage/AppRun
+++ b/platform/appimage/AppRun
@@ -8,7 +8,7 @@ KOREADER_DIR="${0%/*}"
 cd "${KOREADER_DIR}" || exit
 
 # export load library path
-export LD_LIBRARY_PATH=${KOREADER_DIR}/libs:${LD_LIBRARY_PATH}
+export LD_LIBRARY_PATH="${KOREADER_DIR}/libs":"${LD_LIBRARY_PATH}"
 
 RETURN_VALUE=85
 
diff --git a/platform/common/spinning_zsync b/platform/common/spinning_zsync
index f6155e2b2..0ddbe3059 100755
--- a/platform/common/spinning_zsync
+++ b/platform/common/spinning_zsync
@@ -8,7 +8,7 @@
 # NOTE: We inherit WITH_PIPEFAIL from the env via OTAManager, because of course old busybox ash versions abort on set -o failures...
 #       c.f., https://github.com/koreader/koreader/pull/5844
 if [ "${WITH_PIPEFAIL}" = "true" ]; then
-    # shellcheck disable=SC2039
+    # shellcheck disable=SC2039,SC3040
     set -o pipefail
 fi
 
diff --git a/platform/ubuntu-touch/koreader.sh b/platform/ubuntu-touch/koreader.sh
index 7669cc263..0c5ea6ca4 100755
--- a/platform/ubuntu-touch/koreader.sh
+++ b/platform/ubuntu-touch/koreader.sh
@@ -8,7 +8,7 @@ KOREADER_DIR="${0%/*}"
 cd "${KOREADER_DIR}" || exit
 
 # export load library path for some old firmware
-export LD_LIBRARY_PATH=${KOREADER_DIR}/libs:${LD_LIBRARY_PATH}
+export LD_LIBRARY_PATH="${KOREADER_DIR}/libs":"${LD_LIBRARY_PATH}"
 
 # export trained OCR data directory
 export TESSDATA_PREFIX="data"