diff --git a/packages/bsp/common/usr/lib/armbian/armbian-firstlogin b/packages/bsp/common/usr/lib/armbian/armbian-firstlogin
index 1302616b356d..ff1ab38e17ff 100644
--- a/packages/bsp/common/usr/lib/armbian/armbian-firstlogin
+++ b/packages/bsp/common/usr/lib/armbian/armbian-firstlogin
@@ -7,6 +7,7 @@
 # warranty of any kind, whether express or implied.
 
 # read distribution status
+# shellcheck source=/dev/null
 [[ -f /etc/lsb-release ]] && . /etc/lsb-release
 [[ -f /etc/os-release ]] && . /etc/os-release
 [[ -z "$DISTRIB_CODENAME" ]] && DISTRIB_CODENAME="${VERSION_CODENAME}"
@@ -72,7 +73,7 @@ read_password()
 set_shell()
 {
 
-	optionsAudits=($(grep "zsh\|/bash" /etc/shells | sed 's/\/bin\///g' | sed 's/\/usr//g' | uniq))
+	readarray -t optionsAudits <<<"$(grep "zsh\|/bash" /etc/shells | sed 's/\/bin\///g' | sed 's/\/usr//g' | uniq)"
 	USER_SHELL="bash"
 
 	if [[ "${#optionsAudits[@]}" -gt 1 ]]; then
@@ -82,9 +83,9 @@ set_shell()
 				echo -e "\nChoose default system command shell:\n"
 				for o in  "${optionsAudits[@]}"; do
 					echo "$i) $o"
-					let i++
+					(( i++ )) || true
 				done
-				read -n1 -s reply
+				read -r -n1 -s reply
 				case $reply in
 					"1"|"${optionsAudits[0]}") USER_SHELL="${optionsAudits[0]}"; break;;
 					"2"|"${optionsAudits[1]}") USER_SHELL="${optionsAudits[1]}"; break;;
@@ -92,9 +93,9 @@ set_shell()
 				esac
 			done
 	fi
-	SHELL_PATH=$(grep /$USER_SHELL$ /etc/shells | tail -1)
+	SHELL_PATH=$(grep "/$USER_SHELL$" /etc/shells | tail -1)
 
-	chsh -s $(grep -iF "/$USER_SHELL" /etc/shells | tail -1)
+	chsh -s "$(grep -iF "/$USER_SHELL" /etc/shells | tail -1)"
 	echo -e "\nShell: \x1B[92m${USER_SHELL^^}\x1B[0m"
 
 	# change shell for future users
@@ -107,10 +108,10 @@ set_timezone_and_locales()
 {
 
 	# Grab this machine's public IP address
-	PUBLIC_IP=`curl --max-time 5 -s https://ipinfo.io/ip`
+	PUBLIC_IP=$(curl --max-time 5 -s https://ipinfo.io/ip)
 
 	# Check if we have wireless adaptor
-        WIFI_DEVICE=$(LC_ALL=C nmcli dev status | grep  " wifi " 2>/dev/null)
+	WIFI_DEVICE=$(LC_ALL=C nmcli dev status | grep  " wifi " 2>/dev/null)
 
 	if [ -z "$PUBLIC_IP" ]; then
 
@@ -128,21 +129,20 @@ set_timezone_and_locales()
 	fi
 
 	# Grab IP once again if not found
-	[[ -z "$PUBLIC_IP" && -n "$WIFI_DEVICE" ]] && PUBLIC_IP=`curl --max-time 5 -s https://ipinfo.io/ip`
+	[[ -z "$PUBLIC_IP" && -n "$WIFI_DEVICE" ]] && PUBLIC_IP=$(curl --max-time 5 -s https://ipinfo.io/ip)
 
 	# Call the geolocation API and capture the output
 	RES=$(
-		curl --max-time 5 -s http://ipwhois.app/json/${PUBLIC_IP} | \
+		curl --max-time 5 -s "http://ipwhois.app/json/${PUBLIC_IP}" | \
 			jq '.timezone, .country, .country_code' | \
 			while read -r TIMEZONE; do
 				read -r COUNTRY
-				echo "${TIMEZONE},${COUNTRY},${COUNTRYCODE}" | tr --delete \"
+				echo "${TIMEZONE},${COUNTRY},${COUNTRYCODE}" | tr --delete '"\n'
 			done
 		)
 
-	TZDATA=$(echo ${RES} | cut -d"," -f1)
-	STATE=$(echo ${RES} | cut -d"," -f2)
-	CCODE=$(echo ${RES} | cut -d"," -f3 | xargs)
+	TZDATA=$(echo "${RES}" | cut -d"," -f1)
+	CCODE=$(echo "${RES}" | cut -d"," -f3 | xargs)
 	echo -e "Detected timezone: \x1B[92m$TZDATA\x1B[0m"
 	echo ""
 	unset response
@@ -161,7 +161,7 @@ set_timezone_and_locales()
 	[[ -z "$LOCALES" ]] && LOCALES=$(grep territory /usr/share/i18n/locales/* | grep _"$CCODE" | cut -d ":" -f 1 | cut -d "/" -f 6 |  \
 	xargs -I{} grep {} /usr/share/i18n/SUPPORTED | cut -d " " -f 1)
 
-	options=(`echo ${LOCALES}`);
+	readarray -t options <<<"${LOCALES}"
 
 	# when having more locales, prompt for choosing one
 	if [[ "${#options[@]}" -gt 1 ]]; then
@@ -171,12 +171,12 @@ set_timezone_and_locales()
 		PS3='Please enter your choice:'
 		select opt in "${options[@]}"
 			do
-				if [[ " ${options[@]} " =~ " ${opt} " ]]; then
+				if [[ " ${options[*]} " == *" ${opt} "* ]]; then
 					LOCALES=${opt}
 					break
 				fi
 			done
-		fi
+	fi
 
 	if [[ "${LOCALES}" != *Skip* ]]; then
 
@@ -195,12 +195,16 @@ set_timezone_and_locales()
 		locale-gen "${LOCALES}" > /dev/null 2>&1
 
 		# setting detected locales only for user
-		echo "export LC_ALL=$LOCALES" >> /home/"$RealUserName"/.bashrc
-		echo "export LANG=$LOCALES" >> /home/"$RealUserName"/.bashrc
-		echo "export LANGUAGE=$LOCALES" >> /home/"$RealUserName"/.bashrc
-		echo "export LC_ALL=$LOCALES" >> /home/"$RealUserName"/.xsessionrc
-		echo "export LANG=$LOCALES" >> /home/"$RealUserName"/.xsessionrc
-		echo "export LANGUAGE=$LOCALES" >> /home/"$RealUserName"/.xsessionrc
+		{
+			echo "export LC_ALL=$LOCALES"
+			echo "export LANG=$LOCALES"
+			echo "export LANGUAGE=$LOCALES"
+		} >> /home/"$RealUserName"/.bashrc
+		{
+			echo "export LC_ALL=$LOCALES"
+			echo "export LANG=$LOCALES"
+			echo "export LANGUAGE=$LOCALES"
+		} >> /home/"$RealUserName"/.xsessionrc
 
 	fi
 }
@@ -235,12 +239,12 @@ add_profile_sync_settings()
 
 add_user()
 {
-	read -t 0 temp
+	read -r -t 0 _
 	REPEATS=3
 	while [ -f "/root/.not_logged_in_yet" ]; do
 		echo -e "\nPlease provide a username (eg. your first name): \c"
-		read -e username
-		if ! grep '^[a-zA-Z]*$' <<< $username > /dev/null ; then
+		read -r -e username
+		if ! grep '^[a-zA-Z]*$' <<< "$username" > /dev/null ; then
 			echo -e "\n\x1B[91mError\x1B[0m: illegal characters in username"
 			return
 		fi
@@ -265,7 +269,7 @@ add_user()
 				echo -e "\n\e[0;31mWarning:\x1B[0m Weak password, $okay \b!"
 			fi
 			echo -e ""
-			read -e -p "Please provide your real name: " -i "${RealUserName^}" RealName
+			read -r -e -p "Please provide your real name: " -i "${RealUserName^}" RealName
 
 			adduser --quiet --disabled-password --home /home/"$RealUserName" --gecos "$RealName" "$RealUserName"
 			(echo "$first_input";echo "$second_input";) | passwd "$RealUserName" >/dev/null 2>&1
@@ -283,8 +287,7 @@ add_user()
 			rm -f /root/.not_logged_in_yet
 			chmod +x /etc/update-motd.d/*
 			# set up profile sync daemon on desktop systems
-			command -v psd >/dev/null 2>&1
-			if [ $? -eq 0 ]; then
+			if command -v psd >/dev/null 2>&1; then
 				echo -e "${RealUserName} ALL=(ALL) NOPASSWD: /usr/bin/psd-overlay-helper" >> /etc/sudoers
 				touch /home/"${RealUserName}"/.activate_psd
 				chown "$RealUserName":"$RealUserName" /home/"${RealUserName}"/.activate_psd
@@ -314,7 +317,7 @@ if [[ -f /root/.not_logged_in_yet && -n $(tty) ]]; then
 	systemctl is-system-running --wait >/dev/null
 
 	# enable hiDPI support
-	if [[ "$(cat /sys/class/graphics/fb0/virtual_size 2>/dev/null | cut -d, -f1)" -gt 1920 ]]; then
+	if [[ "$(cut -d, -f1 < /sys/class/graphics/fb0/virtual_size 2> /dev/null)" -gt 1920 ]]; then
 		# lightdm
 		[[ -f /etc/lightdm/slick-greeter.conf ]] && echo "enable-hidpi = on" >> /etc/lightdm/slick-greeter.conf
 		# xfce
@@ -403,6 +406,7 @@ if [[ -f /root/.not_logged_in_yet && -n $(tty) ]]; then
 		printf "\nYou selected \e[0;91mZSH\x1B[0m as your default shell. If you want to use it right away, please logout and login! \n\n"
 	fi
 
+	declare ConfigureDisplay
 	# check whether desktop environment has to be considered
 	if [ -n "$desktop_lightdm" ] && [ -n "$RealName" ] ; then
 
@@ -435,9 +439,9 @@ if [[ -f /root/.not_logged_in_yet && -n $(tty) ]]; then
 			[[ -x $(command -v mate-wm) ]] && sed -i "s/user-session.*/user-session=mate/" /etc/lightdm/lightdm.conf.d/11-armbian.conf
 			[[ -x $(command -v mate-wm) ]] && sed -i "s/user-session.*/user-session=mate/" /etc/lightdm/lightdm.conf.d/22-armbian-autologin.conf
 
-                        # select plasma wayland session
-                        [[ -x $(command -v plasmashell) ]] && sed -i "s/user-session.*/user-session=plasmawayland/" /etc/lightdm/lightdm.conf.d/11-armbian.conf
-                        [[ -x $(command -v plasmashell) ]] && sed -i "s/user-session.*/user-session=plasmawayland/" /etc/lightdm/lightdm.conf.d/22-armbian-autologin.conf
+			# select plasma wayland session
+			[[ -x $(command -v plasmashell) ]] && sed -i "s/user-session.*/user-session=plasmawayland/" /etc/lightdm/lightdm.conf.d/11-armbian.conf
+			[[ -x $(command -v plasmashell) ]] && sed -i "s/user-session.*/user-session=plasmawayland/" /etc/lightdm/lightdm.conf.d/22-armbian-autologin.conf
 
 			ln -sf /lib/systemd/system/lightdm.service /etc/systemd/system/display-manager.service
 
@@ -456,7 +460,7 @@ if [[ -f /root/.not_logged_in_yet && -n $(tty) ]]; then
 					systemctl start armbian-disable-autologin.timer
 				fi
 				# logout if logged at console
-				[[ -n $(who -la | grep root | grep tty1) ]] && exit 1
+				who -la | grep root | grep -q tty1 && exit 1
 			fi
 
 	elif [ -n "$desktop_gdm3" ] && [ -n "$RealName" ] ; then
@@ -488,7 +492,7 @@ if [[ -f /root/.not_logged_in_yet && -n $(tty) ]]; then
 						(sleep 20; sed -i "s/AutomaticLoginEnable.*/AutomaticLoginEnable = false/" /etc/gdm3/custom.conf) &
 					fi
 					# logout if logged at console
-					[[ -n $(who -la | grep root | grep tty1) ]] && exit 1
+					who -la | grep root | grep -q tty1 && exit 1
 
 				fi