diff --git a/legacy/helpers.sh b/legacy/helpers.sh
index fd98d4c..e428d44 100644
--- a/legacy/helpers.sh
+++ b/legacy/helpers.sh
@@ -1,8 +1,8 @@
-#!/bin/sh
+#!/usr/bin/env bash
 
 ask_if_sure(){
 	while true; do
-		read -p "reinstall & ERASE ALL DATA? [y/n] " yn
+		read -r -p "reinstall & ERASE ALL DATA? [y/n] " yn
 		case $yn in
 			[Yy]* ) break;;
 			[Nn]* ) exit 1;;
@@ -36,7 +36,7 @@ blk_info_uuid(){
 #
 # If you want to get asked for every password, just remove this function
 cryptsetup(){
-	command cryptsetup $* --key-file /tmp/passwd -q
+	command cryptsetup "$@" --key-file /tmp/passwd -q
 }
 
 install_os(){
@@ -47,7 +47,7 @@ install_os(){
 luks_close(){
 	local drive="${1?}"
 
-	if cryptsetup status "${drive}" &>/dev/null; then
+	if cryptsetup status "${drive}" > /dev/null 2>&1; then
 		cryptsetup close "${drive}"
 	fi
 }
diff --git a/legacy/install-desktop.sh b/legacy/install-desktop.sh
index d4954ad..4e73888 100644
--- a/legacy/install-desktop.sh
+++ b/legacy/install-desktop.sh
@@ -3,6 +3,7 @@
 set -eux -o pipefail
 
 BASE="$(dirname "$(readlink -f "$0")")"
+# shellcheck source=legacy/helpers.sh
 . "${BASE}/helpers.sh"
 
 export HOST=thinkman
diff --git a/legacy/install-server.sh b/legacy/install-server.sh
index f098407..3a7369f 100644
--- a/legacy/install-server.sh
+++ b/legacy/install-server.sh
@@ -3,10 +3,11 @@
 set -eux -o pipefail
 
 BASE="$(dirname "$(readlink -f "$0")")"
+# shellcheck source=legacy/helpers.sh
 . "${BASE}/helpers.sh"
 
 export HOST=serverle
-export DRIVE_ROOT=/dev/disk/by-id/usb-Seagate_Expansion_2HC015KJ-0\:0
+export DRIVE_ROOT="/dev/disk/by-id/usb-Seagate_Expansion_2HC015KJ-0:0"
 
 export NIXOS_FILES="${NIXOS_FILES:-$PWD}"
 export CHROOT_BASE="/mnt/newroot-${HOST}"