diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 23fd045d..33e3e4dd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,11 +60,15 @@ jobs:
       - name: Build Archive
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN_QAWARE_TAP_REPO: ${{ secrets.GH_TOKEN_QAWARE_TAP_REPO }}
         run: |
-          export PATH=$PATH:/usr/local/go/bin
-          export GORELEASER_CURRENT_TAG="v${{ github.event.inputs.version }}"
-          export GORELEASER_PREVIOUS_TAG="${{ env.GORELEASER_PREVIOUS_TAG }}"
+          PATH=$PATH:/usr/local/go/bin
+          GORELEASER_CURRENT_TAG="v${{ github.event.inputs.version }}"
+          GORELEASER_PREVIOUS_TAG="${{ env.GORELEASER_PREVIOUS_TAG }}"
+          export PATH GORELEASER_CURRENT_TAG GORELEASER_PREVIOUS_TAG 
+          echo "$GH_TOKEN_QAWARE_TAP_REPO" > /tmp/GH_TOKEN_QAWARE_TAP_REPO
           ./release/30-build-go-archive.sh
+          rm -rf /tmp/GH_TOKEN_QAWARE_TAP_REPO
 
       - name: DockerHub Login
         uses: docker/login-action@v3
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index df78a0a2..82a9f94f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,6 +14,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master
+
       - name: Setup
         run: |
           sudo apt-get -q update
diff --git a/.gitignore b/.gitignore
index 42cf6f3a..2baf1987 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,8 +33,8 @@ node_modules/
 
 # IntelliJ
 .idea
+*.iml
 
 # GoReleaser
-dist/
-# template output
-.goreleaser.yaml
+/dist/
+/completions/
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
new file mode 100644
index 00000000..0a9d44fe
--- /dev/null
+++ b/.goreleaser.yaml
@@ -0,0 +1,155 @@
+# Documentation at https://goreleaser.com
+
+before:
+  hooks: []
+    # - ./release/completions.sh # TODO: Fix completions build
+
+# https://goreleaser.com/customization/build/
+builds:
+  - binary: bin/protocurl
+    dir: src
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - windows
+      - darwin
+    ignore:
+      # This combination is not pre-built by Google Protobuf
+      - goos: windows
+        goarch: arm64
+
+
+# https://goreleaser.com/customization/archive/
+archives:
+  - format: zip
+    files:
+      # NOTE: These files are listed again in the packages below. Keep them synced!
+      # binary is added implicitly
+      - README.md
+      - LICENSE.md
+      # - completions/* ' TODO: Fix completions build
+      # copy protoc binaries and their .proto files previously downloaded
+      - src: 'release/tmp/protoc-{{ .Env.PROTO_VERSION }}-{{ .Os }}-{{ .Arch }}/bin'
+        dst: 'protocurl-internal/bin'
+        strip_parent: true # avoids, that protoc is copied into protocurl-internal/bin/release/tmp/.../bin
+      - src: 'release/tmp/protoc-{{ .Env.PROTO_VERSION }}-{{ .Os }}-{{ .Arch }}/include/google/protobuf'
+        dst: 'protocurl-internal/include/google/protobuf'
+        strip_parent: true
+
+# Linux packages
+nfpms:
+  - package_name: "{{ .ProjectName }}"
+    description: |-
+      protoCURL is cURL for Protobuf:
+      The command-line tool for interacting with Protobuf over
+      HTTP REST endpoints using human-readable text formats.
+
+    homepage: https://github.com/qaware/{{ .ProjectName }}
+    license: MIT
+    maintainer: GollyTicker <golly.ticker@gmail.com>
+    priority: extra
+
+    formats:
+      - apk
+      - deb
+    dependencies:
+      - curl
+    suggests:
+      - curl
+
+    overrides:
+      # protoc is compiled against glibc whereas alpine uses musl.
+      # See: https://stackoverflow.com/a/64447927
+      apk:
+        dependencies:
+          - curl
+          - gcompat
+
+    # adds the ./bin/protocurl
+    bindir: "/opt/protocurl"
+
+    # GoReleaser will automatically add the binaries.
+    contents:
+      - src: /opt/protocurl/bin/protocurl
+        dst: /usr/bin/protocurl
+        type: "symlink"
+
+      # NOTE: These files are listed again in the archives above. Keep them synced!
+      # binary is added implicitly
+      - src: README.md
+        dst: /opt/protocurl/README.md
+      - src: LICENSE.md
+        dst: /opt/protocurl/LICENSE.md
+      # copy protoc binaries and their .proto files previously downloaded
+      - src: 'release/tmp/protoc-{{ .Env.PROTO_VERSION }}-{{ .Os }}-{{ .Arch }}/bin'
+        dst: '/opt/protocurl/protocurl-internal/bin'
+      - src: 'release/tmp/protoc-{{ .Env.PROTO_VERSION }}-{{ .Os }}-{{ .Arch }}/include/google/protobuf'
+        dst: '/opt/protocurl/protocurl-internal/include/google/protobuf'
+      # Completions
+      # TODO: Fix completions build
+#      - src: ./completions/{{ .ProjectName }}.bash
+#        dst: /usr/share/bash-completion/completions/{{ .ProjectName }}
+#        file_info:
+#          mode: 0644
+#      - src: ./completions/{{ .ProjectName }}.fish
+#        dst: /usr/share/fish/vendor_completions.d/{{ .ProjectName }}.fish
+#        file_info:
+#          mode: 0644
+#      - src: ./completions/{{ .ProjectName }}.zsh
+#        dst: /usr/share/zsh/vendor-completions/_{{ .ProjectName }}
+#        file_info:
+#          mode: 0644
+
+brews:
+  # We will deploy always the latest
+  - &brew
+    name: "{{ .ProjectName }}"
+    homepage: https://gitlab.com/qaware/protocurl
+    description: >-
+      protoCURL is cURL for Protobuf:
+      The command-line tool for interacting with Protobuf over
+      HTTP REST endpoints using human-readable text formats.
+    license: MIT
+    url_template: "https://github.com/qaware/protocurl/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
+    skip_upload: auto
+    # GitHub/GitLab repository to push the formula to
+    repository:
+      owner: qaware
+      name: homebrew-tap
+      branch: main
+      git:
+        url: git@github.com:qaware/homebrew-tap.git
+        private_key: /tmp/GH_TOKEN_QAWARE_TAP_REPO
+    folder: Formula
+    dependencies:
+      - name: curl
+    install: |-
+      bin.install "{{ .ProjectName }}"
+#    TODO: Make completion build run
+#      bash_completion.install "completions/{{ .ProjectName }}.bash" => "{{ .ProjectName }}"
+#      zsh_completion.install "completions/{{ .ProjectName }}.zsh" => "_{{ .ProjectName }}"
+#      fish_completion.install "completions/{{ .ProjectName }}.fish"
+    test: |
+      system "#{bin}/{{ .ProjectName }} --version"
+  # Additionally Major is deployed to offer older versions
+  - <<: *brew
+    name: "{{ .ProjectName }}@{{ .Major }}"
+
+release:
+  # If set to auto, will mark the release as not ready for production
+  # in case there is an indicator for this in the tag e.g. v1.0.0-rc1
+  prerelease: auto
+
+checksum:
+  name_template: 'checksums.txt'
+
+snapshot:
+  name_template: "{{ .Version }}-dev"
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - '^docs:'
+      - '^test:'
diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 00000000..8226afb6
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1 @@
+external-sources=true
diff --git a/RELEASE.md b/RELEASE.md
index 0de57ce7..cf9f9d79 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -3,7 +3,7 @@
 We use [GoReleaser](https://goreleaser.com/) to create static binaries and Docker Buildx to build multi-architecture
 images.
 
-The relevant configuration for the release process is in [template.goreleaser.yml](template.goreleaser.yaml)
+The relevant configuration for the release process is in [.goreleaser.yml](.goreleaser.yaml)
 and [release/source.sh](release/source.sh). It **automatically** fetches the **latest** Go, Goreleaser and Protobuf
 versions via GitHub API.
 
diff --git a/dev/generate-local.Dockerfile.sh b/dev/generate-local.Dockerfile.sh
index 6929aad6..33465ade 100755
--- a/dev/generate-local.Dockerfile.sh
+++ b/dev/generate-local.Dockerfile.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Concatenate the dev dockerfile and the final release dockerfile to get the combined one
diff --git a/doc/generate-docs.sh b/doc/generate-docs.sh
index 2e99869b..cac63885 100755
--- a/doc/generate-docs.sh
+++ b/doc/generate-docs.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 WORKING_DIR="$1"
@@ -212,8 +212,8 @@ echo "Generating README.md..."
 README_TEMPLATE="$(cat doc/template.README.md)"
 
 # replacements ============================
-echo "$README_TEMPLATE" |
-  sed "s%___EXAMPLE_1_OUT___%$EXAMPLE_1_OUT%" >README.md
+# shellcheck disable=SC2001
+sed "s%___EXAMPLE_1_OUT___%$EXAMPLE_1_OUT%" >README.md <<<"$README_TEMPLATE"
 
 normaliseOutput README.md
 
diff --git a/release/0-get-latest-dependencies-versions.sh b/release/0-get-latest-dependencies-versions.sh
index e02c38f6..ff572a6c 100755
--- a/release/0-get-latest-dependencies-versions.sh
+++ b/release/0-get-latest-dependencies-versions.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 LATEST_VERSION=""
@@ -23,6 +23,7 @@ retrieveLatestVersion() {
   REPO="$2"
   TAG_FILTER="$3"
 
+  # shellcheck disable=SC2001
   FILE_FRIENDLY_NAME="$(echo "$REPO" | sed 's#/#.#g')"
 
   CACHE_FILE="release/.cache/$FILE_FRIENDLY_NAME.cache.json"
@@ -51,7 +52,7 @@ retrieveLatestVersion() {
     -H "Accept: application/vnd.github.v3+json" \
     "https://api.github.com/repos/$REPO/$ENDPOINT")"
 
-  STATUS_CODE_LINE="$(cat "$HEADERS_FILE" | head -n 1)"
+  STATUS_CODE_LINE="$(head -n 1 < "$HEADERS_FILE")"
 
   if [[ "$STATUS_CODE_LINE" == *" 200"* ]]; then
     echo "Populating cache..."
diff --git a/release/10-ensure-protoc-binaries-exist.sh b/release/10-ensure-protoc-binaries-exist.sh
index 11400596..9c428b9b 100755
--- a/release/10-ensure-protoc-binaries-exist.sh
+++ b/release/10-ensure-protoc-binaries-exist.sh
@@ -1,10 +1,10 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 source ./release/0-get-latest-dependencies-versions.sh
 
 FILES_EXIST="true"
-ls release/tmp/protoc-$PROTO_VERSION-*.zip > /dev/null 2>&1 || FILES_EXIST="false"
+ls release/tmp/protoc-"$PROTO_VERSION"-*.zip > /dev/null 2>&1 || FILES_EXIST="false"
 
 if [[ "$FILES_EXIST" == "true" ]]; then
   echo "Found protoc binaries for $PROTO_VERSION."
diff --git a/release/10.1-get-protoc-binaries.sh b/release/10.1-get-protoc-binaries.sh
index 84693b42..4490a718 100755
--- a/release/10.1-get-protoc-binaries.sh
+++ b/release/10.1-get-protoc-binaries.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # platforms and architectures for which Google released pre-built binaries
diff --git a/release/100-check-latest-versions.sh b/release/100-check-latest-versions.sh
index a124bfe5..72252455 100755
--- a/release/100-check-latest-versions.sh
+++ b/release/100-check-latest-versions.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 SAVED="release/versions.txt"
diff --git a/release/101-save-latest-versions.sh b/release/101-save-latest-versions.sh
index 3b3efe2f..0c74ed69 100755
--- a/release/101-save-latest-versions.sh
+++ b/release/101-save-latest-versions.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # See RELEASE.md
diff --git a/release/20-install-go.sh b/release/20-install-go.sh
index 7a566806..c71ac8f7 100755
--- a/release/20-install-go.sh
+++ b/release/20-install-go.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 set -x
 
diff --git a/release/30-build-go-archive.sh b/release/30-build-go-archive.sh
index 9c71d27d..6237fc50 100755
--- a/release/30-build-go-archive.sh
+++ b/release/30-build-go-archive.sh
@@ -1,11 +1,8 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 source release/source.sh
 
-cp template.goreleaser.yaml .goreleaser.yaml
-sed -i "s/__PROTO_VERSION__/$PROTO_VERSION/g" .goreleaser.yaml
-
 set -x
 
 goreleaser check
@@ -14,9 +11,10 @@ echo "Using GORELEASER_CURRENT_TAG=$GORELEASER_CURRENT_TAG, GORELEASER_PREVIOUS_
 
 GORELEASER_ARGS=""
 if [[ "$SNAPSHOT" == "true" ]]; then
-  GORELEASER_ARGS="--skip-announce"
+  GORELEASER_ARGS="--skip=announce"
 fi
 
+goreleaser check
 goreleaser release --clean $GORELEASER_ARGS
 
 # Alternate commands when testing release process locally
diff --git a/release/40-generate-Dockerfile.sh b/release/40-generate-Dockerfile.sh
index 575814b6..acceafc0 100755
--- a/release/40-generate-Dockerfile.sh
+++ b/release/40-generate-Dockerfile.sh
@@ -1,3 +1,3 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 cat release/builder.Dockerfile <(echo "# ==================") release/final.Dockerfile >release/generated.Dockerfile
diff --git a/release/completions.sh b/release/completions.sh
new file mode 100755
index 00000000..40be3ff0
--- /dev/null
+++ b/release/completions.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# https://carlosbecker.com/posts/golang-completions-cobra/
+set -e
+
+rm -rf completions
+mkdir completions
+
+for sh in bash zsh fish; do
+  go run -C src protocurl.go completion "$sh" >"completions/protocurl.$sh"
+done
diff --git a/release/source.sh b/release/source.sh
index 73ad4d5d..160b3b68 100755
--- a/release/source.sh
+++ b/release/source.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # PRECONDITION: git fetch origin --tags
@@ -6,7 +6,8 @@ set -euo pipefail
 source ./release/10-ensure-protoc-binaries-exist.sh
 
 # should be one of 386, amd64 and arm64
-export BUILD_ARCH="$(uname -m | sed "s/x86_64/amd64/" | sed "s/x86_32/386/" | sed "s/aarch_64/arm64/")"
+BUILD_ARCH="$(uname -m | sed "s/x86_64/amd64/" | sed "s/x86_32/386/" | sed "s/aarch_64/arm64/")"
+export BUILD_ARCH
 
 # ensure, that 1.2.3-rc < 1.2.3, since the opposite is the default
 git config versionsort.suffix -
diff --git a/template.goreleaser.yaml b/template.goreleaser.yaml
deleted file mode 100644
index 72bab779..00000000
--- a/template.goreleaser.yaml
+++ /dev/null
@@ -1,105 +0,0 @@
-# Documentation at https://goreleaser.com
-
-# This file is a template and expressions such as __PROTOC_VERSION__ are replaced
-# with environment variables such as $PROTOC_VERSION before usage.
-
-# https://goreleaser.com/customization/build/
-builds:
-  - binary: bin/protocurl
-    dir: src
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - windows
-      - darwin
-    ignore:
-      # This combination is not pre-built by Google Protobuf
-      - goos: windows
-        goarch: arm64
-
-
-# https://goreleaser.com/customization/archive/
-archives:
-  - format: zip
-    files:
-      # NOTE: These files are listed again in the packages below. Keep them synced!
-      # binary is added implicitly
-      - README.md
-      - LICENSE.md
-      # copy protoc binaries and their .proto files previously downloaded
-      - src: 'release/tmp/protoc-__PROTO_VERSION__-{{ .Os }}-{{ .Arch }}/bin'
-        dst: 'protocurl-internal/bin'
-        strip_parent: true # avoids, that protoc is copied into protocurl-internal/bin/release/tmp/.../bin
-      - src: 'release/tmp/protoc-__PROTO_VERSION__-{{ .Os }}-{{ .Arch }}/include/google/protobuf'
-        dst: 'protocurl-internal/include/google/protobuf'
-        strip_parent: true
-
-# Linux packages
-nfpms:
-  - package_name: protocurl
-    description: |-
-      protoCURL is cURL for Protobuf:
-      The command-line tool for interacting with Protobuf over
-      HTTP REST endpoints using human-readable text formats.
-
-    homepage: https://github.com/qaware/protocurl
-    license: MIT
-    maintainer: GollyTicker <golly.ticker@gmail.com>
-    priority: extra
-
-    formats:
-      - apk
-      - deb
-    dependencies:
-      - curl
-    suggests:
-      - curl
-
-    overrides:
-      # protoc is compiled against glibc whereas alpine uses musl.
-      # See: https://stackoverflow.com/a/64447927
-      apk:
-        dependencies:
-          - curl
-          - gcompat
-
-    # adds the ./bin/protocurl
-    bindir: /opt/protocurl
-
-    # GoReleaser will automatically add the binaries.
-    contents:
-      - src: /opt/protocurl/bin/protocurl
-        dst: /usr/bin/protocurl
-        type: "symlink"
-
-      # NOTE: These files are listed again in the archives above. Keep them synced!
-      # binary is added implicitly
-      - src: README.md
-        dst: /opt/protocurl/README.md
-      - src: LICENSE.md
-        dst: /opt/protocurl/LICENSE.md
-      # copy protoc binaries and their .proto files previously downloaded
-      - src: 'release/tmp/protoc-__PROTO_VERSION__-{{ .Os }}-{{ .Arch }}/bin'
-        dst: '/opt/protocurl/protocurl-internal/bin'
-      - src: 'release/tmp/protoc-__PROTO_VERSION__-{{ .Os }}-{{ .Arch }}/include/google/protobuf'
-        dst: '/opt/protocurl/protocurl-internal/include/google/protobuf'
-
-release:
-  # If set to auto, will mark the release as not ready for production
-  # in case there is an indicator for this in the tag e.g. v1.0.0-rc1
-  prerelease: auto
-
-
-checksum:
-  name_template: 'checksums.txt'
-
-snapshot:
-  name_template: "{{ .Version }}-dev"
-
-changelog:
-  sort: asc
-  filters:
-    exclude:
-      - '^docs:'
-      - '^test:'
diff --git a/test/suite/copy-test-results-output-to-expected.sh b/test/suite/copy-test-results-output-to-expected.sh
index e5edbf33..6e33f982 100755
--- a/test/suite/copy-test-results-output-to-expected.sh
+++ b/test/suite/copy-test-results-output-to-expected.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 source test/suite/setup.sh
@@ -8,8 +8,7 @@ source test/suite/setup.sh
 FILES="$(ls -a test/results/*-out.txt)"
 
 copyIfDiff() {
-  meaningfulDiff "$1" "${1%"-out.txt"}-expected.txt" >/dev/null
-  if [[ "$?" == "0" ]]; then
+  if meaningfulDiff "$1" "${1%"-out.txt"}-expected.txt" >/dev/null; then
     echo "✅ ${1%"-out.txt"}"
   else
     cp "$1" "${1%"-out.txt"}-expected.txt"
diff --git a/test/suite/linux/install-test-remove.sh b/test/suite/linux/install-test-remove.sh
index d02c3875..1dfa033e 100755
--- a/test/suite/linux/install-test-remove.sh
+++ b/test/suite/linux/install-test-remove.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # should be run inside ./test folder within a container to test packaged linux releases
@@ -7,6 +7,7 @@ OS_NAME="$1"
 EXT="$2"
 URL_NO_EXT="$3"
 
+# shellcheck source=test/suite/linux/package-debian.sh
 source "./test/suite/linux/package-${OS_NAME}.sh"
 
 setup
diff --git a/test/suite/linux/package-alpine.sh b/test/suite/linux/package-alpine.sh
index 0d81dd1d..a7e688f1 100644
--- a/test/suite/linux/package-alpine.sh
+++ b/test/suite/linux/package-alpine.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 set -x
 
diff --git a/test/suite/linux/package-debian.sh b/test/suite/linux/package-debian.sh
index f0c52bc1..00c99052 100755
--- a/test/suite/linux/package-debian.sh
+++ b/test/suite/linux/package-debian.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 setup() {
diff --git a/test/suite/setup.sh b/test/suite/setup.sh
index e06bfa49..1b0d9020 100755
--- a/test/suite/setup.sh
+++ b/test/suite/setup.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 source release/source.sh
 
@@ -12,8 +12,9 @@ buildProtocurl() {
   if [[ -v PROTOCURL_RELEASE_VERSION ]]; then
     export PROTOCURL_IMAGE_ORIGINAL="qaware/protocurl:$PROTOCURL_RELEASE_VERSION"
     export PROTOCURL_IMAGE="qaware/protocurl:$PROTOCURL_RELEASE_VERSION-test"
-    echo "Pulling $PROTOCURL_IMAGE_ORIGINAL ..." && docker pull $PROTOCURL_IMAGE_ORIGINAL && echo "Done."
+    echo "Pulling $PROTOCURL_IMAGE_ORIGINAL ..." && docker pull "$PROTOCURL_IMAGE_ORIGINAL" && echo "Done."
 
+    # shellcheck disable=SC2317
     customNormaliseOutput() {
       sed -i -E "s/protocurl version .*, build .*,/protocurl version <version>, build <hash>,/g" "$1"
       sed -i -E "s/protocurl [0-9].*, build .*,/protocurl <version>, build <hash>,/g" "$1"
@@ -25,8 +26,10 @@ buildProtocurl() {
     ./dev/generate-local.Dockerfile.sh
     BUILD_ARGS="-q -f dev/generated.local.Dockerfile"
     BUILD_ARGS="$BUILD_ARGS --build-arg PROTO_VERSION=$PROTO_VERSION"
+    # shellcheck disable=SC2153
     BUILD_ARGS="$BUILD_ARGS --build-arg ARCH=$BUILD_ARCH"
     BUILD_ARGS="$BUILD_ARGS --build-arg GO_DOWNLOAD_URL_ARCH_TEMPLATE=$GO_DOWNLOAD_URL_ARCH_TEMPLATE"
+    # shellcheck disable=SC2086
     echo "Building $PROTOCURL_IMAGE_ORIGINAL ..." &&
       docker build --target final -t $PROTOCURL_IMAGE_ORIGINAL $BUILD_ARGS . &&
       echo "Done."
@@ -34,25 +37,27 @@ buildProtocurl() {
 
   echo "Building test image variant of protocurl including additonal executables ..."
   TMP_DOCKERFILE="test/suite/tmp.Dockerfile"
-  echo "" >$TMP_DOCKERFILE
-  grep "^FROM " release/builder.Dockerfile >>$TMP_DOCKERFILE
-  # add inotify to binaries to test tmp-file permissions. also add pkill for cleanup
-  echo "RUN apt-get update && apt-get install -y inotify-tools procps" >>$TMP_DOCKERFILE
-  echo "# =============" >>$TMP_DOCKERFILE
-  echo "FROM $PROTOCURL_IMAGE_ORIGINAL as final" >>$TMP_DOCKERFILE
-  echo "COPY --from=builder /bin/* /bin/" >>$TMP_DOCKERFILE
-  echo "COPY --from=builder /usr/bin/* /usr/bin/" >>$TMP_DOCKERFILE
-  echo "
-COPY --from=builder /lib/*-linux-gnu /lib/x86_64-linux-gnu/
-COPY --from=builder /lib/*-linux-gnu /lib/aarch_64-linux-gnu/
-COPY --from=builder /usr/lib/*-linux-gnu /usr/lib/x86_64-linux-gnu/
-COPY --from=builder /usr/lib/*-linux-gnu /usr/lib/aarch_64-linux-gnu/
-COPY --from=builder /lib64*/ld-linux-*.so.2 /lib64/
-  " >>$TMP_DOCKERFILE
-  grep "^ENTRYPOINT " release/final.Dockerfile >>$TMP_DOCKERFILE
-  remove-leading-spaces-inplace $TMP_DOCKERFILE
-
-  cat $TMP_DOCKERFILE | docker build --target final -t $PROTOCURL_IMAGE -q -f - .
+  {
+    echo ""
+    grep "^FROM " release/builder.Dockerfile
+    # add inotify to binaries to test tmp-file permissions. also add pkill for cleanup
+      echo "RUN apt-get update && apt-get install -y inotify-tools procps"
+      echo "# ============="
+      echo "FROM $PROTOCURL_IMAGE_ORIGINAL as final"
+      echo "COPY --from=builder /bin/* /bin/"
+      echo "COPY --from=builder /usr/bin/* /usr/bin/"
+      echo "
+      COPY --from=builder /lib/*-linux-gnu /lib/x86_64-linux-gnu/
+      COPY --from=builder /lib/*-linux-gnu /lib/aarch_64-linux-gnu/
+      COPY --from=builder /usr/lib/*-linux-gnu /usr/lib/x86_64-linux-gnu/
+      COPY --from=builder /usr/lib/*-linux-gnu /usr/lib/aarch_64-linux-gnu/
+      COPY --from=builder /lib64*/ld-linux-*.so.2 /lib64/
+      "
+      grep "^ENTRYPOINT " release/final.Dockerfile
+  } >"$TMP_DOCKERFILE"
+  remove-leading-spaces-inplace "$TMP_DOCKERFILE"
+
+  docker build --target final -t "$PROTOCURL_IMAGE" -q -f - . <"$TMP_DOCKERFILE"
   echo "Done."
 }
 export -f buildProtocurl
diff --git a/test/suite/test.sh b/test/suite/test.sh
index afdc74a0..c98125a9 100755
--- a/test/suite/test.sh
+++ b/test/suite/test.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -euo pipefail
 
@@ -53,14 +53,13 @@ testSingleRequest() {
     2>"$OUT_ERR" >>"$OUT"
   EXIT_CODE="$?"
 
-  echo "######### STDERR #########" >>"$OUT"
-  cat "$OUT_ERR" >>"$OUT"
+  {
+    echo "######### STDERR #########"
+    cat "$OUT_ERR"
+    echo "######### EXIT $EXIT_CODE #########"
+  } >>"$OUT"
 
-  echo "######### EXIT $EXIT_CODE #########" >>"$OUT"
-
-  meaningfulDiff "$EXPECTED" "$OUT" >/dev/null
-
-  if [[ "$?" != 0 ]]; then
+  if ! meaningfulDiff "$EXPECTED" "$OUT" >/dev/null; then
     export TESTS_SUCCESS="false"
     echo "❌❌❌ FAILURE ❌❌❌ - $FILENAME"
     echo "=== Found difference between expected and actual output (ignoring $NORMALISED_ASPECTS) ==="
@@ -99,11 +98,12 @@ runAllTests() {
   # Convert each element in the JSON to the corresponding call of the testSingleRequest function.
   # Simply look at the produced run-testcases.sh file to see what it looks like.
   CONVERT_TESTCASE_TO_SINGLE_TEST_INVOCATION=".[] | \"testSingleSpec \(.filename|@sh) \(.args|join(\" \")|@sh) \(.beforeTestBash // \"\"|@sh) \(.afterTestBash // \"\"|@sh) \((.rerunwithArgForEachElement // [])|@sh)\""
-  cat test/suite/testcases.json | jq -r "$CONVERT_TESTCASE_TO_SINGLE_TEST_INVOCATION" >./test/suite/run-testcases.sh
+  jq -r "$CONVERT_TESTCASE_TO_SINGLE_TEST_INVOCATION" <test/suite/testcases.json >./test/suite/run-testcases.sh
 
   export -f testSingleSpec
   export -f testSingleRequest
   chmod +x ./test/suite/run-testcases.sh
+  # shellcheck source=/dev/null
   source ./test/suite/run-testcases.sh
 
   echo "=== Finished Running ALL Tests ==="