diff --git a/listupgrade/files/old-kernel-autoremoval.sh b/listupgrade/files/old-kernel-autoremoval.sh
index 2d5df786..7e33324c 100644
--- a/listupgrade/files/old-kernel-autoremoval.sh
+++ b/listupgrade/files/old-kernel-autoremoval.sh
@@ -4,48 +4,53 @@
 
 set -e
 
+# shellcheck disable=SC2046
 eval $(apt-config shell DPKG Dir::bin::dpkg/f)
-test -n "$DPKG" || DPKG="/usr/bin/dpkg"
+DPKG="${DPKG:-/usr/bin/dpkg}"
 
 # Detect which one of apt/aptitude we should use.
+# shellcheck disable=SC2120
 get_apt_binary() {
-    root="$1"
+    root="${1:-}"
     # apt could be a Java binary...
-    if [ -x $root/usr/bin/apt ] && ! $root/usr/bin/apt --version 2>&1 |grep -q "javac"; then
+    if [ -x "${root}/usr/bin/apt" ] && ! ${root}/usr/bin/apt --version 2>&1 | grep -q "javac"; then
         echo "apt"
-    elif [ -x $root/usr/bin/aptitude ]; then
+    elif [ -x "${root}/usr/bin/aptitude" ]; then
         echo "aptitude"
     # Usually in containers
     else
         echo "apt-get"
     fi
 }
+
+listupgrade_state_dir="${listupgrade_state_dir:-/var/lib/listupgrade}"
+
 APT=$(get_apt_binary)
 
 list="$("${DPKG}" -l | awk '/^[ih][^nc][ ]+(linux|kfreebsd|gnumach)-image-[0-9]+\./ && $2 !~ /-dbg(:.*)?$/ && $2 !~ /-dbgsym(:.*)?$/ { print $2,$3; }' \
    | sed -e 's#^\(linux\|kfreebsd\|gnumach\)-image-##' -e 's#:[^:]\+ # #')"
-debverlist="$(echo "$list" | cut -d' ' -f 2 | sort --unique --reverse --version-sort)"
+debverlist="$(echo "${list}" | cut -d' ' -f 2 | sort --unique --reverse --version-sort)"
 
 if [ -n "$1" ]; then
     installed_version="$(echo "$list" | awk "\$1 == \"$1\" { print \$2;exit; }")"
 fi
-unamer="$(uname -r | tr '[A-Z]' '[a-z]')"
-if [ -n "$unamer" ]; then
-    running_version="$(echo "$list" | awk "\$1 == \"$unamer\" { print \$2;exit; }")"
+unamer="$(uname -r | tr '[:upper:]' '[:lower:]')"
+if [ -n "${unamer}" ]; then
+    running_version="$(echo "${list}" | awk "\$1 == \"${unamer}\" { print \$2;exit; }")"
 fi
 # ignore the currently running version if attempting a reproducible build
 if [ -n "${SOURCE_DATE_EPOCH}" ]; then
     unamer=""
     running_version=""
 fi
-latest_version="$(echo "$debverlist" | sed -n 1p)"
-previous_version="$(echo "$debverlist" | sed -n 2p)"
+latest_version="$(echo "${debverlist}" | sed -n 1p)"
+previous_version="$(echo "${debverlist}" | sed -n 2p)"
 
-debkernels="$(echo "$latest_version
-$installed_version
-$running_version" | sort -u | sed -e '/^$/ d')"
+debkernels="$(echo "${latest_version}
+${installed_version}
+${running_version}" | sort -u | sed -e '/^$/ d')"
 kernels="$( (echo "$1
-$unamer"; for deb in $debkernels; do echo "$list" | awk "\$2 == \"$deb\" { print \$1; }"; done; ) \
+${unamer}"; for deb in ${debkernels}; do echo "${list}" | awk "\$2 == \"${deb}\" { print \$1; }"; done; ) \
    | sed -e 's#\([\.\+]\)#\\\1#g' -e '/^$/ d' | sort -u|tr '\n' '|' | sed -e 's/|$//')"
 
 
@@ -54,19 +59,19 @@ List of installed kernel packages:
 $list
 
 # Running kernel: ${running_version:-ignored} (${unamer:-ignored})
-# Last kernel: $latest_version
-# Previous kernel: $previous_version
+# Last kernel: ${latest_version}
+# Previous kernel: ${previous_version}
 # Kernel versions list to keep:
-$debkernels
+${debkernels}
 
 # Kernel packages (version part) to protect:
-$kernels
+${kernels}
 "
 
 echo "BEFORE"
 dpkg -l | grep linux-image
 
-dpkg --get-selections | tr '\t' ' ' | cut -d" " -f1 | grep ^linux-image-[234] | egrep -v  "($kernels)" | xargs --no-run-if-empty $APT -y purge
+dpkg --get-selections | tr '\t' ' ' | cut -d" " -f1 | grep '^linux-image-[234]' | grep -v -E "(${kernels})" | xargs --no-run-if-empty ${APT} -o Dir::State::Lists="${listupgrade_state_dir}" -y purge
 
 echo "
 AFTER"