diff --git a/extra/buildall.sh b/extra/buildall.sh
index 3460c2e..d386dce 100755
--- a/extra/buildall.sh
+++ b/extra/buildall.sh
@@ -3,7 +3,7 @@
 set -xeu -o pipefail
 
 extra_dir="${extra_dir:-extra}"
-extra_dir="$(realpath $extra_dir)"
+extra_dir="$(realpath "$extra_dir")"
 bin_dir="$extra_dir/bin"
 compile="$bin_dir/compile.exe"
 dst="data/scripts"
@@ -14,35 +14,36 @@ mkdir -p external
 cd external
 
 if [[ -d rp ]]; then
-  cd rp
-  git pull
-  cd ..
+    cd rp
+    git pull
+    cd ..
 else
-  git-clone-dir https://github.com/BGforgeNet/Fallout2_Restoration_Project.git rp scripts_src/headers
+    git-clone-dir https://github.com/BGforgeNet/Fallout2_Restoration_Project.git rp scripts_src/headers
 fi
 
 if [[ -d fo2tweaks ]]; then
-  cd fo2tweaks
-  git pull
-  cd ..
+    cd fo2tweaks
+    git pull
+    cd ..
 else
-  git-clone-dir https://github.com/BGforgeNet/FO2tweaks.git fo2tweaks source/headers
+    git-clone-dir https://github.com/BGforgeNet/FO2tweaks.git fo2tweaks source/headers
 fi
 
 if [[ -d sfall ]]; then
-  cd sfall
-  git pull
-  cd ..
+    cd sfall
+    git pull
+    cd ..
 else
-  git-clone-dir https://github.com/sfall-team/sfall.git sfall artifacts/scripting/headers
+    git-clone-dir https://github.com/sfall-team/sfall.git sfall artifacts/scripting/headers
 fi
 
 cd ..
 
-files=$(cat $extra_dir/build.list)
-mkdir -p $dst
+files=$(cat "$extra_dir"/build.list)
+mkdir -p "$dst"
 cd source
 for f in $files; do
-  int_name="$(echo $f | sed 's|\.ssl$|.int|')"
-  wine $compile -l -O2 -p -s -q -n "$f" -o "$dst/$int_name"
+    # shellcheck disable=SC2001  # sed is more readable
+    int_name="$(echo "$f" | sed 's|\.ssl$|.int|')"
+    wine "$compile" -l -O2 -p -s -q -n "$f" -o "$dst/$int_name"
 done
diff --git a/extra/env.sh b/extra/env.sh
index 230d1f1..a505086 100755
--- a/extra/env.sh
+++ b/extra/env.sh
@@ -2,7 +2,8 @@
 
 set -xeu -o pipefail
 
-export extra_dir="$(realpath extra)"
+extra_dir="$(realpath extra)"
+export extra_dir
 export bin_dir="$extra_dir/bin"
 export mods_dir="mods"
 export mpack_version=${mpack_version:-4.3}
diff --git a/extra/package.sh b/extra/package.sh
index 034d345..76183de 100755
--- a/extra/package.sh
+++ b/extra/package.sh
@@ -3,6 +3,7 @@
 set -xeu -o pipefail
 
 export comp_dir="components"
+# shellcheck disable=SC2154  # from env.sh
 export dat2="wine $bin_dir/dat2.exe"
 export dat2a="wine $bin_dir/dat2.exe a -1"
 export file_list="file.list"
@@ -12,26 +13,30 @@ short_sha="$(git rev-parse --short HEAD)"
 export version="git$short_sha"
 
 # tagged build
-if [[ ! -z "${GITHUB_REF-}" ]]; then # github build
-  if echo "$GITHUB_REF" | grep "refs/tags"; then # tagged
-    version="$(echo $GITHUB_REF | sed 's|refs\/tags\/||')"
-    export version
-  fi
+if [[ -n "${GITHUB_REF-}" ]]; then                 # github build
+    if echo "$GITHUB_REF" | grep "refs/tags"; then # tagged
+        # shellcheck disable=SC2001  # sed is more readable
+        version="$(echo "$GITHUB_REF" | sed 's|refs\/tags\/||')"
+        export version
+    fi
 fi
 
 # data
+# shellcheck disable=SC2154  # from env.sh
 dat="$mod_name.dat"
+# shellcheck disable=SC2154  # from env.sh
 mkdir -p "$mods_dir"
 
 cd data
 rm -rf text/po # gettext translations
 # I don't know how to pack recursively
-find . -type f | sed -e 's|^\.\/||' -e 's|\/|\\|g' | sort > ../file.list # replace slashes with backslashes
-wine "$bin_dir/dat2.exe" a $dat @../file.list
+find . -type f | sed -e 's|^\.\/||' -e 's|\/|\\|g' | sort >../file.list # replace slashes with backslashes
+wine "$bin_dir/dat2.exe" a "$dat" @../file.list
 cd ..
 mv "data/$dat" "$mods_dir/"
 
 # sfall
+# shellcheck disable=SC2154  # from workflow yml
 sfall_url="https://sourceforge.net/projects/sfall/files/sfall/sfall_${sfall_version}.7z/download"
 wget -q "$sfall_url" -O sfall.7z
 7zr e sfall.7z ddraw.dll