diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 0000000..eef8cdc
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,7 @@
+# Hooks, configure items and config files are sourced from paths only known at
+# run time
+disable=SC1090
+
+# mkdir -p -m only sets the mode of the last directory; every use here makes
+# one directory in a parent that already exists
+disable=SC2174
diff --git a/install.sh b/install.sh
index 274edb4..449a2dc 100644
--- a/install.sh
+++ b/install.sh
@@ -56,6 +56,8 @@ while true; do
 done
 
 save_config "$dir"
+# For hook_path, from lib/hooks.sh
+# shellcheck disable=SC2034
 WORKING_COPY="$dir"
 echo "Working copy: $dir (saved in $CONFIG)"
 
diff --git a/lib/common.sh b/lib/common.sh
index d508e80..8c020e0 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -9,7 +9,8 @@ CONFIG_DIR="$HOME/.config/coredesktop-dev"
 CONFIG="$CONFIG_DIR/config"
 
 # First line after the shebang of the pre-push hook this project installs, so it
-# never overwrites or removes a hook someone else wrote
+# never overwrites or removes a hook someone else wrote. Used by hooks.sh.
+# shellcheck disable=SC2034
 HOOK_MARKER="# Installed by coredesktop-dev; remove with: coredesktop-dev hooks remove"
 
 die() {
diff --git a/lib/smoketest.sh b/lib/smoketest.sh
index 622e58c..bfc4c32 100644
--- a/lib/smoketest.sh
+++ b/lib/smoketest.sh
@@ -107,7 +107,7 @@ select_scenarios() {
 }
 
 smoketest_run() {
-  local tier=pr ref=HEAD keep=0 names=()
+  local tier="pr" ref=HEAD keep=0 names=()
   while (( $# > 0 )); do
     case "$1" in
       --tier) tier="${2:-}"; shift 2 || die "--tier needs pr or all" ;;
@@ -338,7 +338,9 @@ smoketest_shell() {
   mkdir -p "$dir"
   qemu-img create -q -f qcow2 -b "$IMAGES/$image.qcow2" -F qcow2 "$dir/disk.qcow2"
   vm_start "$dir" "$dir/disk.qcow2"
-  trap 'vm_kill; rm -rf "$dir"' EXIT
+  # Expanded now: $dir is local, and gone by the time the script exits
+  # shellcheck disable=SC2064
+  trap "vm_kill; rm -rf $(printf '%q' "$dir")" EXIT
   echo "Starting a throwaway copy of the $image image..."
   vm_wait_up
   vm_ssh -t
diff --git a/lib/vm.sh b/lib/vm.sh
index 38b113d..79d20de 100644
--- a/lib/vm.sh
+++ b/lib/vm.sh
@@ -5,10 +5,13 @@
 #           vm_exec, vm_put, vm_reboot, VM_GIT_SSH and VM_GIT_URL.
 
 SMOKETEST_STATE="${XDG_CACHE_HOME:-$HOME/.cache}/coredesktop-dev/smoketest"
+# IMAGES and KVM_DEVICE are used by smoketest.sh
+# shellcheck disable=SC2034
 IMAGES="$SMOKETEST_STATE/images"
 # Shared with every VM as its /var/cache/pacman/pkg, so packages download once
 PKG_CACHE="$SMOKETEST_STATE/pkg"
 SSH_KEY="$SMOKETEST_STATE/id_ed25519"
+# shellcheck disable=SC2034
 KVM_DEVICE="${KVM_DEVICE:-/dev/kvm}"
 
 VM_USER=tester
@@ -43,8 +46,8 @@ ensure_ssh_key() {
 }
 
 free_port() {
-  local port i
-  for i in $(seq 50); do
+  local port
+  for _ in $(seq 50); do
     port=$((20000 + RANDOM % 20000))
     [ -z "$(ss -Hltn "( sport = :$port )" 2> /dev/null)" ] && { echo "$port"; return 0; }
   done
diff --git a/tests/smoketest.bats b/tests/smoketest.bats
index 911096d..73f965f 100644
--- a/tests/smoketest.bats
+++ b/tests/smoketest.bats
@@ -27,11 +27,14 @@ setup() {
   stub ss
   stub ssh-keygen 'touch "${@: -1}" "${@: -1}.pub"'
   stub systemctl
+  # Like a real SSH session, the command gets no controlling terminal: the
+  # driver runs bash -i, which would otherwise try to take over the one bats
+  # runs in, and be stopped for it
   stub ssh 'while [ $# -gt 0 ]; do
       case "$1" in -i | -o | -p) shift 2 ;; *@*) shift; break ;; *) shift ;; esac
     done
     [ $# -gt 0 ] || exit 0
-    cd "$HOME" && exec bash -c "$*"'
+    cd "$HOME" && exec setsid -w bash -c "$*"'
   stub scp 'dest="${*: -1}"; cp "${@: -2:1}" "${dest#*:}"'
 
   SC="$WC/smoketest/scenarios"
diff --git a/tests/test_helper.bash b/tests/test_helper.bash
index c4642da..ae150fb 100644
--- a/tests/test_helper.bash
+++ b/tests/test_helper.bash
@@ -9,6 +9,8 @@
 # shellcheck disable=SC2034
 PROJECT="$(cd "$BATS_TEST_DIRNAME/.." && pwd)"
 
+# UPSTREAM, DEPLOYED and WC are used by the .bats files
+# shellcheck disable=SC2034
 common_setup() {
   export HOME="$BATS_TEST_TMPDIR/home"
   export STUB_BIN="$BATS_TEST_TMPDIR/bin"