diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index b4b97584..3cf08eb0 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -2,30 +2,27 @@ name: Differential ShellCheck
 
 on:
   workflow_dispatch:
-    inputs:
-      base:
-        description: Base revision for manual differential scan
-        required: true
-      head:
-        description: Head revision for manual differential scan
-        required: true
   push:
     branches:
       - main
       - 'rc/**'
     paths:
+      - 'build.sh'
       - 'install.sh'
-      - 'forkop/files/usr/bin/**'
-      - 'forkop/files/usr/lib/**'
+      - 'forkop/files/etc/init.d/**'
+      - 'luci-app-forkop/root/etc/uci-defaults/**'
+      - 'tests/**/*.sh'
       - '.github/workflows/shellcheck.yml'
   pull_request:
     branches:
       - main
       - 'rc/**'
     paths:
+      - 'build.sh'
       - 'install.sh'
-      - 'forkop/files/usr/bin/**'
-      - 'forkop/files/usr/lib/**'
+      - 'forkop/files/etc/init.d/**'
+      - 'luci-app-forkop/root/etc/uci-defaults/**'
+      - 'tests/**/*.sh'
       - '.github/workflows/shellcheck.yml'
 
 permissions:
@@ -34,28 +31,25 @@ permissions:
 jobs:
   shellcheck:
     name: Differential ShellCheck
-    if: ${{ github.event_name != 'push' || github.event.forced != true }}
     runs-on: ubuntu-24.04
     
-    permissions:
-      contents: read
-      security-events: write
-    
     steps:
       - name: Checkout code
         uses: actions/checkout@v5.0.0
-        with:
-          fetch-depth: 0
-      
-      - name: Differential ShellCheck
-        uses: redhat-plumbers-in-action/differential-shellcheck@v5.5.5
-        with:
-          triggering-event: ${{ github.event_name == 'workflow_dispatch' && 'manual' || github.event_name }}
-          base: ${{ github.event.inputs.base }}
-          head: ${{ github.event.inputs.head }}
-          severity: error
-          include-path: |
-            forkop/files/usr/bin/forkop
-            forkop/files/usr/lib/**.sh
-            install.sh
-          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install ShellCheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
+
+      - name: ShellCheck
+        shell: bash
+        run: |
+          mapfile -d '' scripts < <(
+            find . -type f \
+              \( -name '*.sh' -o -path './build.sh' -o -path './install.sh' \
+                 -o -path './forkop/files/etc/init.d/*' \
+                 -o -path './luci-app-forkop/root/etc/uci-defaults/*' \) \
+              -print0
+          )
+          shellcheck --severity=error "${scripts[@]}"
diff --git a/tests/components_updater_job.sh b/tests/components_updater_job.sh
index a51939ea..cb000ca4 100644
--- a/tests/components_updater_job.sh
+++ b/tests/components_updater_job.sh
@@ -45,15 +45,15 @@ if ucode "$UPDATER" updates-job-state-path /tmp/jobs '../bad' >/dev/null 2>&1; t
 fi
 
 assert_eq outdated \
-  "$(ucode "$UPDATER" updates-status-from-compare -1)" \
+  "$(ucode -- "$UPDATER" updates-status-from-compare -1)" \
   "outdated compare status"
 assert_eq latest \
-  "$(ucode "$UPDATER" updates-status-from-compare 0)" \
+  "$(ucode -- "$UPDATER" updates-status-from-compare 0)" \
   "latest compare status"
 assert_eq dev \
-  "$(ucode "$UPDATER" updates-status-from-compare 1)" \
+  "$(ucode -- "$UPDATER" updates-status-from-compare 1)" \
   "dev compare status"
-if ucode "$UPDATER" updates-status-from-compare invalid >/dev/null 2>&1; then
+if ucode -- "$UPDATER" updates-status-from-compare invalid >/dev/null 2>&1; then
   fail "invalid compare status should be rejected"
 fi
 
diff --git a/tests/mark_ranges.sh b/tests/mark_ranges.sh
index b0833643..b5a6fad4 100644
--- a/tests/mark_ranges.sh
+++ b/tests/mark_ranges.sh
@@ -38,7 +38,7 @@ assert_mark_range_no_overlap() {
 
   for ((index = 1; index <= range_size; index++)); do
     mark=$((base + index))
-    assert_no_overlap "$label[$index]" "$mark" "$mask" "$mask_label"
+    assert_no_overlap "${label}[$index]" "$mark" "$mask" "$mask_label"
   done
 }
 
diff --git a/tests/zapret_runtime_owner.sh b/tests/zapret_runtime_owner.sh
index 1ec2495b..8b3653f8 100644
--- a/tests/zapret_runtime_owner.sh
+++ b/tests/zapret_runtime_owner.sh
@@ -139,9 +139,9 @@ if (!Object.prototype.hasOwnProperty.call(value, 'zapret2_installed') ||
 }
 NODE
 
-ucode -L "$FORKOP_LIB" "$ZAPRET2_VALIDATOR" validate-json nfqws2 '--name forkop --intercept=1' >/dev/null ||
+ucode -L "$FORKOP_LIB" -- "$ZAPRET2_VALIDATOR" validate-json nfqws2 '--name forkop --intercept=1' >/dev/null ||
   fail "providers/zapret2/validator.uc must validate nfqws2 strategies"
-if ucode -L "$FORKOP_LIB" "$ZAPRET2_VALIDATOR" validate-json nfqws '--dpi-desync=fake' >/dev/null 2>&1; then
+if ucode -L "$FORKOP_LIB" -- "$ZAPRET2_VALIDATOR" validate-json nfqws '--dpi-desync=fake' >/dev/null 2>&1; then
   fail "providers/zapret2/validator.uc must not validate nfqws strategies"
 fi
 
diff --git a/tests/zapret_validator.sh b/tests/zapret_validator.sh
index 5de5197b..8c3e48cc 100644
--- a/tests/zapret_validator.sh
+++ b/tests/zapret_validator.sh
@@ -43,42 +43,42 @@ assert_json_field() {
   [ "$actual" = "$expected" ] || fail "expected $field=$expected, got $actual"
 }
 
-valid_nfqws="$(ucode -L "$FORKOP_LIB" "$VALIDATOR" validate-json nfqws '--dpi-desync=fake --dpi-desync-repeats 2')"
+valid_nfqws="$(ucode -L "$FORKOP_LIB" -- "$VALIDATOR" validate-json nfqws '--dpi-desync=fake --dpi-desync-repeats 2')"
 assert_json_field "$valid_nfqws" valid true
 
-configured="$(ucode -L "$FORKOP_LIB" "$VALIDATOR" strategy-or-default "$(printf -- '--dpi-desync=fake\t--dpi-desync-repeats 2')" '--default')"
+configured="$(ucode -L "$FORKOP_LIB" -- "$VALIDATOR" strategy-or-default "$(printf -- '--dpi-desync=fake\t--dpi-desync-repeats 2')" '--default')"
 [ "$configured" = "--dpi-desync=fake --dpi-desync-repeats 2" ] ||
   fail "configured zapret strategy should be normalized, got '$configured'"
 
-defaulted="$(ucode -L "$FORKOP_LIB" "$VALIDATOR" strategy-or-default "" "$(printf -- '--default\t1')")"
+defaulted="$(ucode -L "$FORKOP_LIB" -- "$VALIDATOR" strategy-or-default "" "$(printf -- '--default\t1')")"
 [ "$defaulted" = "--default 1" ] ||
   fail "empty zapret strategy should use normalized default, got '$defaulted'"
 
-if invalid_nfqws="$(ucode -L "$FORKOP_LIB" "$VALIDATOR" validate-json nfqws '--hostlist domains.txt' 2>/dev/null)"; then
+if invalid_nfqws="$(ucode -L "$FORKOP_LIB" -- "$VALIDATOR" validate-json nfqws '--hostlist domains.txt' 2>/dev/null)"; then
   fail "hostlist selection should be rejected for nfqws"
 fi
 assert_json_field "$invalid_nfqws" valid false
 assert_json_field "$invalid_nfqws" needle --hostlist
 
-if ucode -L "$FORKOP_LIB" "$VALIDATOR" validate nfqws '--qnum=200' >/tmp/zapret-validator.out 2>/dev/null; then
+if ucode -L "$FORKOP_LIB" -- "$VALIDATOR" validate nfqws '--qnum=200' >/tmp/zapret-validator.out 2>/dev/null; then
   fail "qnum override should be rejected for nfqws"
 fi
 grep -q 'NFQUEUE number is assigned by Forkop' /tmp/zapret-validator.out ||
   fail "qnum rejection should explain ownership"
 
-valid_nfqws2="$(ucode -L "$FORKOP_LIB" "$ZAPRET2_VALIDATOR" validate-json nfqws2 '--name forkop --intercept=1')"
+valid_nfqws2="$(ucode -L "$FORKOP_LIB" -- "$ZAPRET2_VALIDATOR" validate-json nfqws2 '--name forkop --intercept=1')"
 assert_json_field "$valid_nfqws2" valid true
 
-if invalid_nfqws2="$(ucode -L "$FORKOP_LIB" "$ZAPRET2_VALIDATOR" validate-json nfqws2 '--intercept=0' 2>/dev/null)"; then
+if invalid_nfqws2="$(ucode -L "$FORKOP_LIB" -- "$ZAPRET2_VALIDATOR" validate-json nfqws2 '--intercept=0' 2>/dev/null)"; then
   fail "disabled nfqws2 intercept should be rejected"
 fi
 assert_json_field "$invalid_nfqws2" valid false
 assert_json_field "$invalid_nfqws2" needle --intercept
 
-if ucode -L "$FORKOP_LIB" "$VALIDATOR" validate-json nfqws2 '--name forkop --intercept=1' >/dev/null 2>&1; then
+if ucode -L "$FORKOP_LIB" -- "$VALIDATOR" validate-json nfqws2 '--name forkop --intercept=1' >/dev/null 2>&1; then
   fail "zapret validator must not own nfqws2 validation"
 fi
-if ucode -L "$FORKOP_LIB" "$ZAPRET2_VALIDATOR" validate-json nfqws '--dpi-desync=fake' >/dev/null 2>&1; then
+if ucode -L "$FORKOP_LIB" -- "$ZAPRET2_VALIDATOR" validate-json nfqws '--dpi-desync=fake' >/dev/null 2>&1; then
   fail "zapret2 validator must not own nfqws validation"
 fi