diff --git a/tools/packaging/static-build/ovmf/build-ovmf.sh b/tools/packaging/static-build/ovmf/build-ovmf.sh
index d42178e40f..645d4f6479 100755
--- a/tools/packaging/static-build/ovmf/build-ovmf.sh
+++ b/tools/packaging/static-build/ovmf/build-ovmf.sh
@@ -10,6 +10,7 @@ set -o nounset
 set -o pipefail
 
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
 source "${script_dir}/../../scripts/lib.sh"
 
 # disabling set -u because scripts attempt to expand undefined variables
@@ -28,19 +29,19 @@ fi
 toolchain="${toolchain:-GCC5}"
 build_target="${build_target:-RELEASE}"
 
-[ -n "$ovmf_repo" ] || die "failed to get ovmf repo"
+[[ -n "${ovmf_repo}" ]] || die "failed to get ovmf repo"
 if [[ -z "${ovmf_version}" ]] && [[ -z "${ovmf_branch}" ]]; then
     die "failed to get ovmf version or branch"
 fi
-[ -n "$ovmf_package" ] || die "failed to get ovmf package or commit"
-[ -n "$package_output_dir" ] || die "failed to get ovmf package or commit"
+[[ -n "${ovmf_package}" ]] || die "failed to get ovmf package or commit"
+[[ -n "${package_output_dir}" ]] || die "failed to get ovmf package or commit"
 
 ovmf_dir="${ovmf_repo##*/}"
 
 info "Build ${ovmf_repo} version: ${ovmf_version}"
 
 build_root=$(mktemp -d)
-pushd $build_root
+pushd "${build_root}"
 git clone --single-branch --depth 1 -b "${ovmf_version}" "${ovmf_repo}"
 cd "${ovmf_dir}"
 git submodule init
@@ -50,9 +51,10 @@ info "Using BaseTools make target"
 make -C BaseTools/
 
 info "Calling edksetup script"
+# shellcheck source=/dev/null
 source edksetup.sh
 
-if [ "${ovmf_build}" == "sev" ]; then
+if [[ "${ovmf_build}" == "sev" ]]; then
 	info "Creating dummy grub file"
 	#required for building AmdSev package without grub
 	touch OvmfPkg/AmdSev/Grub/grub.efi
@@ -66,10 +68,11 @@ info "Done Building"
 
 build_path_target_toolchain="Build/${package_output_dir}/${build_target}_${toolchain}"
 build_path_fv="${build_path_target_toolchain}/FV"
-if [ "${ovmf_build}" == "tdx" ]; then
+if [[ "${ovmf_build}" == "tdx" ]]; then
+	# shellcheck disable=SC2034
 	build_path_arch="${build_path_target_toolchain}/X64"
 	stat "${build_path_fv}/OVMF.fd"
-elif [ "${ovmf_build}" == "arm64" ] || [ "${ovmf_build}" == "cca" ]; then
+elif [[ "${ovmf_build}" == "arm64" ]] || [[ "${ovmf_build}" == "cca" ]]; then
 	stat "${build_path_fv}/QEMU_EFI.fd"
 	stat "${build_path_fv}/QEMU_VARS.fd"
 else
@@ -80,30 +83,30 @@ fi
 popd
 
 info "Install fd to destdir"
-if [ "${ovmf_build}" == "arm64" ] || [ "${ovmf_build}" == "cca" ]; then
+if [[ "${ovmf_build}" == "arm64" ]] || [[ "${ovmf_build}" == "cca" ]]; then
 	install_dir="${DESTDIR}/${PREFIX}/share/aavmf"
 else
 	install_dir="${DESTDIR}/${PREFIX}/share/ovmf"
 fi
 
 mkdir -p "${install_dir}"
-if [ "${ovmf_build}" == "sev" ]; then
-	install $build_root/$ovmf_dir/"${build_path_fv}"/OVMF.fd "${install_dir}/AMDSEV.fd"
-elif [ "${ovmf_build}" == "tdx" ]; then
-	install $build_root/$ovmf_dir/"${build_path_fv}"/OVMF.fd "${install_dir}/OVMF.inteltdx.fd"
-elif [ "${ovmf_build}" == "arm64" ] || [ "${ovmf_build}" == "cca" ]; then
-	install $build_root/$ovmf_dir/"${build_path_fv}"/QEMU_EFI.fd "${install_dir}/AAVMF_CODE.fd"
-	install $build_root/$ovmf_dir/"${build_path_fv}"/QEMU_VARS.fd "${install_dir}/AAVMF_VARS.fd"
+if [[ "${ovmf_build}" == "sev" ]]; then
+	install "${build_root}"/"${ovmf_dir}"/"${build_path_fv}"/OVMF.fd "${install_dir}/AMDSEV.fd"
+elif [[ "${ovmf_build}" == "tdx" ]]; then
+	install "${build_root}"/"${ovmf_dir}"/"${build_path_fv}"/OVMF.fd "${install_dir}/OVMF.inteltdx.fd"
+elif [[ "${ovmf_build}" == "arm64" ]] || [[ "${ovmf_build}" == "cca" ]]; then
+	install "${build_root}"/"${ovmf_dir}"/"${build_path_fv}"/QEMU_EFI.fd "${install_dir}/AAVMF_CODE.fd"
+	install "${build_root}"/"${ovmf_dir}"/"${build_path_fv}"/QEMU_VARS.fd "${install_dir}/AAVMF_VARS.fd"
 	# QEMU expects 64MiB CODE and VARS files on ARM/AARCH64 architectures
 	# Truncate the firmware files to the expected size
-	truncate -s 64M ${install_dir}/AAVMF_CODE.fd
-	truncate -s 64M ${install_dir}/AAVMF_VARS.fd
+	truncate -s 64M "${install_dir}/AAVMF_CODE.fd"
+	truncate -s 64M "${install_dir}/AAVMF_VARS.fd"
 else
-	install $build_root/$ovmf_dir/"${build_path_fv}"/OVMF.fd "${install_dir}"
+	install "${build_root}"/"${ovmf_dir}"/"${build_path_fv}"/OVMF.fd "${install_dir}"
 fi
 
 local_dir=${PWD}
-pushd $DESTDIR
-tar -czvf "${local_dir}/${ovmf_dir}-${ovmf_build}.tar.gz" "./$PREFIX"
-rm -rf $(dirname ./$PREFIX)
+pushd "${DESTDIR}"
+tar -czvf "${local_dir}/${ovmf_dir}-${ovmf_build}.tar.gz" "./${PREFIX}"
+rm -rf "$(dirname "./${PREFIX}")"
 popd