diff --git a/twoliter/embedded/imghelper b/twoliter/embedded/imghelper
index 615911fff..0091093ee 100755
--- a/twoliter/embedded/imghelper
+++ b/twoliter/embedded/imghelper
@@ -478,6 +478,7 @@ sbsetup_signing_profile() {
 undo_sign() {
   local what
   what="${1:?}"
+  # shellcheck disable=SC2076 # literal match is intended.
   if [[ ! "$(pesign -i "${what}" -l)" =~ 'No signatures found.' ]]; then
     mv "${what}" "${what}.orig"
     pesign -i "${what}.orig" -o "${what}" -u 0 -r
@@ -574,7 +575,7 @@ generate_hmac() {
   local vmlinuz
   vmlinuz="${1:?}"
   openssl sha512 -hmac FIPS-FTW-RHT2009 -hex "${vmlinuz}" |
-    awk -v vmlinuz="${vmlinuz}" '{ print $2 "  " vmlinuz }' \
+    awk '{ print $2 "  vmlinuz" }' \
       >"${vmlinuz%/*}/.${vmlinuz##*/}.hmac"
 }