diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 00000000..f2d1cbeb
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,3 @@
+external-sources=true
+# Used for jdg-tap integration.
+source-path=source
diff --git a/helper/restore-permissions b/helper/restore-permissions
index 0fa0ee21..0d31ac6c 100755
--- a/helper/restore-permissions
+++ b/helper/restore-permissions
@@ -26,6 +26,7 @@ else
     printf "Error: %s/main could not be read. Exiting.\n" "${FUNCTIONS}" >&2
     exit 1
   fi
+  # shellcheck source=./functions/main
   . "${FUNCTIONS}/main"
 fi
 
@@ -51,6 +52,7 @@ cd "$target_directory"
 if ! [ -e "$target_directory"/.ngcpcfg_perms ]; then
   log_warn "Permission file ${target_directory}/.ngcpcfg_perms doesn't exist."
 else
+  # shellcheck disable=SC1091
   . "${target_directory}"/.ngcpcfg_perms
 fi
 
diff --git a/sbin/ngcpcfg b/sbin/ngcpcfg
index 2eecec5e..81798d35 100755
--- a/sbin/ngcpcfg
+++ b/sbin/ngcpcfg
@@ -141,7 +141,7 @@ if [[ "${1:-}" == "decrypt" ]] ; then
     fi
   }
 else
-  # shellcheck disable=SC1090
+  # shellcheck source=./functions/main
   . "${FUNCTIONS}"/main
 fi
 
diff --git a/scripts/apply b/scripts/apply
index 102b0287..3894d94f 100755
--- a/scripts/apply
+++ b/scripts/apply
@@ -16,7 +16,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 # based on check_local_state() from scripts/status
diff --git a/scripts/build b/scripts/build
index f89fa0eb..b93025e4 100755
--- a/scripts/build
+++ b/scripts/build
@@ -16,7 +16,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 MODIFIED_ONLY=false
diff --git a/scripts/cat b/scripts/cat
index 992e74a0..87596a7a 100755
--- a/scripts/cat
+++ b/scripts/cat
@@ -32,7 +32,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 CONFIG_TYPES=(config maintenance sites network constants)
diff --git a/scripts/check b/scripts/check
index 248aa0b6..4ba95355 100755
--- a/scripts/check
+++ b/scripts/check
@@ -16,7 +16,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 usage() {
diff --git a/scripts/clean b/scripts/clean
index 6131aa4c..7aaddf01 100755
--- a/scripts/clean
+++ b/scripts/clean
@@ -15,7 +15,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 cd "${NGCPCTL_MAIN}"
diff --git a/scripts/commit b/scripts/commit
index fba06247..b757d4b8 100755
--- a/scripts/commit
+++ b/scripts/commit
@@ -19,7 +19,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
 fi
 
 timestamp_replacementchars=''
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 # main script
@@ -95,9 +95,11 @@ if [ -z "${NO_DB_SYNC:-}" ] ; then
     ngcp-sync-db-grants | sed "s/^/$timestamp_replacementchars/"
     ngcp-sync-db-creds | sed "s/^/$timestamp_replacementchars/"
     if [ -z "${NGCP_TYPE:-}" ] ; then # SPCE
+        # shellcheck disable=SC1091
         . /etc/default/ngcp-roles
     fi
     if [ "${NGCP_TYPE}" == "carrier" ] && [ "${NGCP_IS_PROXY}" == "yes" ] ; then
+        # shellcheck disable=SC1091
         . /etc/default/ngcp-db
         log_info "Synchronizing MariaDB grants/credentials for ${LOCAL_DBHOST}:${LOCAL_DBPORT}"
         ngcp-sync-db-grants --db-host "${LOCAL_DBHOST}" --db-port "${LOCAL_DBPORT}" --no-warnings | sed "s/^/$timestamp_replacementchars/"
diff --git a/scripts/decrypt b/scripts/decrypt
index 99fd358b..e6793fa6 100755
--- a/scripts/decrypt
+++ b/scripts/decrypt
@@ -24,8 +24,9 @@ fi
 # source the ${FUNCTIONS}/logs file instead.
 
 timestamp_replacementchars='' # unset by default
-# shellcheck disable=SC1090
+# shellcheck source=./functions/logs
 . "${FUNCTIONS}"/logs
+# shellcheck source=./functions/openpgp
 . "${FUNCTIONS}"/openpgp
 
 setup_shared_config() {
diff --git a/scripts/del b/scripts/del
index 0e759aa3..76d01d7c 100755
--- a/scripts/del
+++ b/scripts/del
@@ -15,7 +15,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 ## functions {{{
diff --git a/scripts/diff b/scripts/diff
index 1ca0f6b7..46b7d067 100755
--- a/scripts/diff
+++ b/scripts/diff
@@ -17,7 +17,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
 fi
 
 timestamp_replacementchars=''
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 # main script
diff --git a/scripts/edit b/scripts/edit
index 44ac2a2b..cd2b27af 100755
--- a/scripts/edit
+++ b/scripts/edit
@@ -14,7 +14,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 if [ -z "${EDITOR:-}" ] ; then
diff --git a/scripts/encrypt b/scripts/encrypt
index d8afbb5b..dfb75af2 100755
--- a/scripts/encrypt
+++ b/scripts/encrypt
@@ -18,8 +18,9 @@ if ! [ -r "${FUNCTIONS}"/openpgp ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
+# shellcheck source=./functions/openpgp
 . "${FUNCTIONS}"/openpgp
 
 get_config_file_list() {
diff --git a/scripts/etckeeper b/scripts/etckeeper
index fef47e99..622c7752 100755
--- a/scripts/etckeeper
+++ b/scripts/etckeeper
@@ -15,7 +15,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
 fi
 
 timestamp_replacementchars=''
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 # main script
diff --git a/scripts/get b/scripts/get
index d2af37b6..05eba410 100755
--- a/scripts/get
+++ b/scripts/get
@@ -41,7 +41,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 # Get the list of configs in proper order to load.
diff --git a/scripts/initialise b/scripts/initialise
index 605d5f06..bf198b6e 100755
--- a/scripts/initialise
+++ b/scripts/initialise
@@ -14,7 +14,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 # main script
diff --git a/scripts/log b/scripts/log
index 59780611..0737a272 100755
--- a/scripts/log
+++ b/scripts/log
@@ -14,7 +14,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 cd "$NGCPCTL_MAIN"
diff --git a/scripts/patch b/scripts/patch
index 880db727..72d93a81 100755
--- a/scripts/patch
+++ b/scripts/patch
@@ -15,7 +15,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 cd "${NGCPCTL_MAIN}"
diff --git a/scripts/services b/scripts/services
index 6673d1af..fe7f6922 100755
--- a/scripts/services
+++ b/scripts/services
@@ -22,7 +22,7 @@ if [[ ! -r "${FUNCTIONS}"/main ]]; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 # functions
@@ -146,8 +146,8 @@ systemd_daemon_reload_preset() {
     systemctl daemon-reload 2>&1 || true
 
     log_debug "Removing any broken systemd service symlink"
-    find -L /etc/systemd/system -type l \
-      | xargs -r rm
+    find -L /etc/systemd/system -type l -print0 \
+      | xargs -0 -r rm
 
     log_debug "systemd needs preset-all to enable/disable services (to start them on boot)"
     log_debug "Running: rm -rf /etc/systemd/system/*.wants/ || true"
diff --git a/scripts/set b/scripts/set
index 4546564c..496ac42e 100755
--- a/scripts/set
+++ b/scripts/set
@@ -15,7 +15,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 ## functions {{{
diff --git a/scripts/show b/scripts/show
index 5f50aa1c..b0dab37c 100755
--- a/scripts/show
+++ b/scripts/show
@@ -14,7 +14,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 if [ "$*" = "" ] ; then
diff --git a/scripts/status b/scripts/status
index b223ff65..7a759cbc 100755
--- a/scripts/status
+++ b/scripts/status
@@ -15,7 +15,7 @@ if ! [ -r "${FUNCTIONS}"/main ] ; then
 fi
 
 timestamp_replacementchars=''
-# shellcheck disable=SC1090
+# shellcheck source=./functions/main
 . "${FUNCTIONS}"/main
 
 # main script
diff --git a/t/fixtures/read_cfg.sh b/t/fixtures/read_cfg.sh
index b42fa4bb..27baefc6 100755
--- a/t/fixtures/read_cfg.sh
+++ b/t/fixtures/read_cfg.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 [[ $# -ne 1 ]] && exit 1
-# shellcheck source=ngcpcfg.cfg
+# shellcheck source=./t/fixtures/ngcpcfg.cfg
 source "${1}"
 echo "[ngcpcfg]"
 # directory name where ngcpcfg is managed through git
diff --git a/testsuite/ngcp-network b/testsuite/ngcp-network
index a72a66f5..90088a2b 100644
--- a/testsuite/ngcp-network
+++ b/testsuite/ngcp-network
@@ -22,7 +22,7 @@ bailout() {
   rm -f "$OUTPUT"
 }
 
-trap bailout 1 2 3 3 6 9 14 15
+trap bailout 1 2 3 3 6 14 15
 
 OK() {
     printf "ok %s           %s\n" "$1" "$2"