diff --git a/scripts/test-qemu b/scripts/test-qemu
index 30b775d..affb2c0 100755
--- a/scripts/test-qemu
+++ b/scripts/test-qemu
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 set -eu
 set -x
@@ -24,17 +24,18 @@
 TACOMA_INITRD=$(mktemp --suffix .initrd)
 
 cleanup() {
-    rm -f $PALMETTO_MTD
-    rm -f $WITHERSPOON_MTD
-    rm -f $TACOMA_WIC_XZ $TACOMA_MMC
-    rm -f $TACOMA_FITIMAGE
-    rm -f $TACOMA_KERNEL $TACOMA_DTB $TACOMA_INITRD
+    rm -f "$PALMETTO_MTD"
+    rm -f "$WITHERSPOON_MTD"
+    rm -f "$TACOMA_WIC_XZ" "$TACOMA_MMC"
+    rm -f "$TACOMA_FITIMAGE"
+    rm -f "$TACOMA_KERNEL" "$TACOMA_DTB $TACOMA_INITRD"
 }
 
 trap cleanup EXIT 2
 
 # AST2400
 wget "$PALMETTO_MTD_URL"
+# shellcheck disable=SC2016 # 'expect' strings
 expect \
     -c "spawn qemu-system-arm \
             -M palmetto-bmc \
@@ -44,16 +45,17 @@
             -net user,hostfwd=:127.0.0.1:2222-:22,hostfwd=:127.0.0.1:2443-:443,hostname=qemu" \
     -c 'set timeout 120' \
     -c 'expect timeout { exit 1 } "login:"' \
-    -c 'spawn sshpass -p 0penBmc \
-            ssh -o UserKnownHostsFile=/dev/null \
-                -o StrictHostKeyChecking=no \
-                -p2222 \
-                root@localhost \
+    -c 'spawn sshpass -p 0penBmc
+            ssh -o UserKnownHostsFile=/dev/null
+                -o StrictHostKeyChecking=no
+                -p2222
+                root@localhost
                 journalctl -b' \
     -c 'expect -i $spawn_id eof'
 
 # AST2500
 wget "$WITHERSPOON_MTD_URL"
+# shellcheck disable=SC2016 # 'expect' strings
 expect \
     -c "spawn qemu-system-arm \
             -M witherspoon-bmc \
@@ -63,24 +65,25 @@
             -net user,hostfwd=:127.0.0.1:2222-:22,hostfwd=:127.0.0.1:2443-:443,hostname=qemu" \
     -c 'set timeout 120' \
     -c 'expect timeout { exit 1 } "login:"' \
-    -c 'spawn sshpass -p 0penBmc \
-            ssh -o UserKnownHostsFile=/dev/null \
-                -o StrictHostKeyChecking=no \
-                -p2222 \
-                root@localhost \
+    -c 'spawn sshpass -p 0penBmc
+            ssh -o UserKnownHostsFile=/dev/null
+                -o StrictHostKeyChecking=no
+                -p2222
+                root@localhost
                 journalctl -b' \
     -c 'expect -i $spawn_id eof'
 
 # AST2600
 wget "$TACOMA_WIC_XZ_URL"
-unxz $TACOMA_WIC_XZ
-truncate -s 16G $TACOMA_MMC
+unxz "$TACOMA_WIC_XZ"
+truncate -s 16G "$TACOMA_MMC"
 
-wget $TACOMA_FITIMAGE_URL
-dumpimage -T flat_dt -p 0 -o $TACOMA_KERNEL $TACOMA_FITIMAGE
-dumpimage -T flat_dt -p 1 -o $TACOMA_DTB $TACOMA_FITIMAGE
-dumpimage -T flat_dt -p 2 -o $TACOMA_INITRD $TACOMA_FITIMAGE
+wget "$TACOMA_FITIMAGE_URL"
+dumpimage -T flat_dt -p 0 -o "$TACOMA_KERNEL" "$TACOMA_FITIMAGE"
+dumpimage -T flat_dt -p 1 -o "$TACOMA_DTB" "$TACOMA_FITIMAGE"
+dumpimage -T flat_dt -p 2 -o "$TACOMA_INITRD" "$TACOMA_FITIMAGE"
 
+# shellcheck disable=SC2016 # 'expect' strings
 expect \
     -c "spawn qemu-system-arm -M tacoma-bmc \
             -kernel $TACOMA_KERNEL \
@@ -93,10 +96,10 @@
             -append \"console=ttyS4,115200n8 rootwait root=PARTLABEL=rofs-a\"" \
     -c 'set timeout 120' \
     -c 'expect timeout { exit 1 } "login:"' \
-    -c 'spawn sshpass -p 0penBmc \
-            ssh -o UserKnownHostsFile=/dev/null \
-                -o StrictHostKeyChecking=no \
-                -p2222 \
-                root@localhost \
+    -c 'spawn sshpass -p 0penBmc
+            ssh -o UserKnownHostsFile=/dev/null
+                -o StrictHostKeyChecking=no
+                -p2222
+                root@localhost
                 journalctl -b' \
     -c 'expect -i $spawn_id eof'