diff --git a/.github/workflows/find-whitespace.yml b/.github/workflows/find-whitespace.yml
new file mode 100644
index 0000000000..a8b5cf84d0
--- /dev/null
+++ b/.github/workflows/find-whitespace.yml
@@ -0,0 +1,22 @@
+name: Find whitespace
+
+on:
+  pull_request:
+    branches: [testing-devel]
+
+permissions:
+  contents: read
+
+jobs:
+  find-whitespace:
+    name: Find whitespace
+    runs-on: ubuntu-latest
+    container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v3
+      # https://github.com/actions/checkout/issues/760
+      - name: Mark git checkout as safe
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - name: Look for whitespace at the end of line
+        run: ci/find-whitespace
diff --git a/ci/buildroot/buildroot-reqs.txt b/ci/buildroot/buildroot-reqs.txt
index c52b1c49d9..bf3db9c8bd 100644
--- a/ci/buildroot/buildroot-reqs.txt
+++ b/ci/buildroot/buildroot-reqs.txt
@@ -25,8 +25,9 @@ util-linux
 which
 xz
 
-# For rust projects like rpm-ostree
+# For rust projects
 rustfmt
+clippy
 
 # For unit tests at least.
 ostree
diff --git a/ci/find-whitespace b/ci/find-whitespace
new file mode 100755
index 0000000000..05817a5a08
--- /dev/null
+++ b/ci/find-whitespace
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -euo pipefail
+
+main() {
+    local files_with_whitespace
+    files_with_whitespace="$(find manifests overlay.d tests -type f -exec grep -El " +$" {} \;)"
+
+    if [[ -n "${files_with_whitespace}" ]]; then
+        echo "[+] Found files with whitespace at the end of line"
+        echo "${files_with_whitespace}"
+        exit 1
+    fi
+
+    echo "[+] No files with whitespace at the end of line"
+    exit 0
+}
+
+main "${@}"
diff --git a/kola-denylist.yaml b/kola-denylist.yaml
index 0d8c50a38b..a382dbcbbd 100644
--- a/kola-denylist.yaml
+++ b/kola-denylist.yaml
@@ -15,62 +15,90 @@
     - ppc64le
 - pattern: ext.config.kdump.crash
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1430
-  # snooze: 2023-08-31 (disabled on promotion)
+  # snooze: 2023-09-13 (disabled on promotion)
+  # warn: true (disabled on promotion)
   arches:
     - aarch64
+  streams:
+    - stable
+    - testing
+    - next
+    - testing-devel
+    - next-devel
+    - branched
 - pattern: ext.config.networking.nameserver
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
-  # snooze: 2023-08-28 (disabled on promotion)
+  # snooze: 2023-09-13 (disabled on promotion)
+  # warn: true (disabled on promotion)
   streams:
     - rawhide
     - branched
     - next-devel
 - pattern: ext.config.networking.no-persist-ip
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
-  # snooze: 2023-08-28 (disabled on promotion)
+  # snooze: 2023-09-13 (disabled on promotion)
+  # warn: true (disabled on promotion)
   streams:
     - rawhide
     - branched
     - next-devel
 - pattern: ext.config.networking.prefer-ignition-networking
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
-  # snooze: 2023-08-28 (disabled on promotion)
+  # snooze: 2023-09-13 (disabled on promotion)
+  # warn: true (disabled on promotion)
   streams:
     - rawhide
     - branched
     - next-devel
 - pattern: ext.config.networking.ifname-karg.everyboot-systemd-link-file
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
-  # snooze: 2023-08-28 (disabled on promotion)
+  # snooze: 2023-09-13 (disabled on promotion)
+  # warn: true (disabled on promotion)
   streams:
     - rawhide
     - branched
     - next-devel
 - pattern: ext.config.networking.force-persist-ip
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
-  # snooze: 2023-08-28 (disabled on promotion)
+  # snooze: 2023-09-13 (disabled on promotion)
+  # warn: true (disabled on promotion)
   streams:
     - rawhide
     - branched
     - next-devel
 - pattern: ext.config.networking.bridge-static-via-kargs
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
-  # snooze: 2023-08-28 (disabled on promotion)
+  # snooze: 2023-09-13 (disabled on promotion)
+  # warn: true (disabled on promotion)
   streams:
     - rawhide
     - branched
     - next-devel
 - pattern: ext.config.networking.ifname-karg.udev-rule-firstboot-propagation
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
-  # snooze: 2023-08-28 (disabled on promotion)
+  # snooze: 2023-09-13 (disabled on promotion)
+  # warn: true (disabled on promotion)
   streams:
     - rawhide
     - branched
     - next-devel
 - pattern: ext.config.networking.mtu-on-bond-kargs
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
-  # snooze: 2023-08-28 (disabled on promotion)
+  # snooze: 2023-09-13 (disabled on promotion)
+  # warn: true (disabled on promotion)
   streams:
     - rawhide
     - branched
     - next-devel
+- pattern: coreos.ignition.ssh.key
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1553
+  # snooze: 2023-09-04 (disabled on promotion)
+  # warn: true (disabled on promotion)
+  platforms:
+    - azure
+- pattern: ext.config.kdump.crash
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1560
+  # snooze: 2023-09-30 (disabled on promotion)
+  # warn: true (disabled on promotion)
+  streams:
+    - rawhide
diff --git a/manifest-lock.aarch64.json b/manifest-lock.aarch64.json
index 99b97d46ae..3a067e827e 100644
--- a/manifest-lock.aarch64.json
+++ b/manifest-lock.aarch64.json
@@ -85,7 +85,7 @@
       "evra": "3.6.1-4.fc38.aarch64"
     },
     "btrfs-progs": {
-      "evra": "6.3.2-1.fc38.aarch64"
+      "evra": "6.3.3-1.fc38.aarch64"
     },
     "bubblewrap": {
       "evra": "0.7.0-1.fc38.aarch64"
@@ -106,7 +106,7 @@
       "evra": "0.1.7-14.fc38.aarch64"
     },
     "chrony": {
-      "evra": "4.3-3.fc38.aarch64"
+      "evra": "4.4-1.fc38.aarch64"
     },
     "cifs-utils": {
       "evra": "7.0-1.fc38.aarch64"
@@ -142,7 +142,7 @@
       "evra": "0.21.3-4.fc38.noarch"
     },
     "container-selinux": {
-      "evra": "2:2.221.0-1.fc38.noarch"
+      "evra": "2:2.221.1-1.fc38.noarch"
     },
     "containerd": {
       "evra": "1.6.19-1.fc38.aarch64"
@@ -157,10 +157,10 @@
       "evra": "4:1-89.fc38.noarch"
     },
     "coreos-installer": {
-      "evra": "0.17.0-3.fc38.aarch64"
+      "evra": "0.17.0-5.fc38.aarch64"
     },
     "coreos-installer-bootinfra": {
-      "evra": "0.17.0-3.fc38.aarch64"
+      "evra": "0.17.0-5.fc38.aarch64"
     },
     "coreutils": {
       "evra": "9.1-12.fc38.aarch64"
@@ -181,7 +181,7 @@
       "evra": "3.17.1-5.fc38.aarch64"
     },
     "crun": {
-      "evra": "1.8.6-1.fc38.aarch64"
+      "evra": "1.8.7-1.fc38.aarch64"
     },
     "crypto-policies": {
       "evra": "20230301-1.gita12f7b2.fc38.noarch"
@@ -349,7 +349,7 @@
       "evra": "3.14.1-1.fc38.aarch64"
     },
     "fwupd": {
-      "evra": "1.9.3-2.fc38.aarch64"
+      "evra": "1.9.4-1.fc38.aarch64"
     },
     "gawk": {
       "evra": "5.1.1-5.fc38.aarch64"
@@ -373,7 +373,7 @@
       "evra": "2.41.0-1.fc38.aarch64"
     },
     "glib2": {
-      "evra": "2.76.4-3.fc38.aarch64"
+      "evra": "2.76.5-1.fc38.aarch64"
     },
     "glibc": {
       "evra": "2.37-4.fc38.aarch64"
@@ -394,7 +394,7 @@
       "evra": "2.4.0-3.fc38.aarch64"
     },
     "gnutls": {
-      "evra": "3.8.0-2.fc38.aarch64"
+      "evra": "3.8.1-1.fc38.aarch64"
     },
     "google-compute-engine-guest-configs-udev": {
       "evra": "20230808.00-1.fc38.noarch"
@@ -406,16 +406,16 @@
       "evra": "3.8-3.fc38.aarch64"
     },
     "grub2-common": {
-      "evra": "1:2.06-95.fc38.noarch"
+      "evra": "1:2.06-97.fc38.noarch"
     },
     "grub2-efi-aa64": {
-      "evra": "1:2.06-95.fc38.aarch64"
+      "evra": "1:2.06-97.fc38.aarch64"
     },
     "grub2-tools": {
-      "evra": "1:2.06-95.fc38.aarch64"
+      "evra": "1:2.06-97.fc38.aarch64"
     },
     "grub2-tools-minimal": {
-      "evra": "1:2.06-95.fc38.aarch64"
+      "evra": "1:2.06-97.fc38.aarch64"
     },
     "gzip": {
       "evra": "1.12-3.fc38.aarch64"
@@ -502,16 +502,16 @@
       "evra": "2.5.1-5.fc38.noarch"
     },
     "kernel": {
-      "evra": "6.4.11-200.fc38.aarch64"
+      "evra": "6.4.12-200.fc38.aarch64"
     },
     "kernel-core": {
-      "evra": "6.4.11-200.fc38.aarch64"
+      "evra": "6.4.12-200.fc38.aarch64"
     },
     "kernel-modules": {
-      "evra": "6.4.11-200.fc38.aarch64"
+      "evra": "6.4.12-200.fc38.aarch64"
     },
     "kernel-modules-core": {
-      "evra": "6.4.11-200.fc38.aarch64"
+      "evra": "6.4.12-200.fc38.aarch64"
     },
     "kexec-tools": {
       "evra": "2.0.26-3.fc38.aarch64"
@@ -598,7 +598,7 @@
       "evra": "0.5.0-53.fc38.aarch64"
     },
     "libeconf": {
-      "evra": "0.4.0-5.fc38.aarch64"
+      "evra": "0.5.2-1.fc38.aarch64"
     },
     "libedit": {
       "evra": "3.1-45.20221030cvs.fc38.aarch64"
@@ -766,7 +766,7 @@
       "evra": "2.38.1-4.fc38.aarch64"
     },
     "libsmbclient": {
-      "evra": "2:4.18.5-0.fc38.aarch64"
+      "evra": "2:4.18.6-1.fc38.aarch64"
     },
     "libsolv": {
       "evra": "0.7.22-4.fc38.aarch64"
@@ -835,7 +835,7 @@
       "evra": "0.3.2-5.fc38.aarch64"
     },
     "libwbclient": {
-      "evra": "2:4.18.5-0.fc38.aarch64"
+      "evra": "2:4.18.6-1.fc38.aarch64"
     },
     "libxcrypt": {
       "evra": "4.4.36-1.fc38.aarch64"
@@ -997,10 +997,10 @@
       "evra": "1.5.2-16.fc38.aarch64"
     },
     "passt": {
-      "evra": "0^20230625.g32660ce-1.fc38.aarch64"
+      "evra": "0^20230823.ga7e4bfb-1.fc38.aarch64"
     },
     "passt-selinux": {
-      "evra": "0^20230625.g32660ce-1.fc38.noarch"
+      "evra": "0^20230823.ga7e4bfb-1.fc38.noarch"
     },
     "passwd": {
       "evra": "0.80-14.fc38.aarch64"
@@ -1024,10 +1024,10 @@
       "evra": "1.8.0-6.fc38.aarch64"
     },
     "podman": {
-      "evra": "5:4.6.1-1.fc38.aarch64"
+      "evra": "5:4.6.2-1.fc38.aarch64"
     },
     "podman-plugins": {
-      "evra": "5:4.6.1-1.fc38.aarch64"
+      "evra": "5:4.6.2-1.fc38.aarch64"
     },
     "policycoreutils": {
       "evra": "3.5-1.fc38.aarch64"
@@ -1045,7 +1045,7 @@
       "evra": "1.19-2.fc38.aarch64"
     },
     "procps-ng": {
-      "evra": "3.3.17-10.fc38.aarch64"
+      "evra": "3.3.17-11.fc38.aarch64"
     },
     "protobuf-c": {
       "evra": "1.4.1-4.fc38.aarch64"
@@ -1057,7 +1057,7 @@
       "evra": "20230812-1.fc38.noarch"
     },
     "qemu-user-static-x86": {
-      "evra": "2:7.2.4-2.fc38.aarch64"
+      "evra": "2:7.2.5-1.fc38.aarch64"
     },
     "readline": {
       "evra": "8.2-3.fc38.aarch64"
@@ -1084,7 +1084,7 @@
       "evra": "4.18.1-3.fc38.aarch64"
     },
     "rpm-sequoia": {
-      "evra": "1.4.1-1.fc38.aarch64"
+      "evra": "1.5.0-1.fc38.aarch64"
     },
     "rsync": {
       "evra": "3.2.7-2.fc38.aarch64"
@@ -1093,22 +1093,22 @@
       "evra": "2:1.1.7-1.fc38.aarch64"
     },
     "samba-client-libs": {
-      "evra": "2:4.18.5-0.fc38.aarch64"
+      "evra": "2:4.18.6-1.fc38.aarch64"
     },
     "samba-common": {
-      "evra": "2:4.18.5-0.fc38.noarch"
+      "evra": "2:4.18.6-1.fc38.noarch"
     },
     "samba-common-libs": {
-      "evra": "2:4.18.5-0.fc38.aarch64"
+      "evra": "2:4.18.6-1.fc38.aarch64"
     },
     "sed": {
       "evra": "4.8-12.fc38.aarch64"
     },
     "selinux-policy": {
-      "evra": "38.24-1.fc38.noarch"
+      "evra": "38.25-1.fc38.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.24-1.fc38.noarch"
+      "evra": "38.25-1.fc38.noarch"
     },
     "setup": {
       "evra": "2.14.3-2.fc38.noarch"
@@ -1138,7 +1138,7 @@
       "evra": "2.3.3-3.fc38.aarch64"
     },
     "slirp4netns": {
-      "evra": "1.2.0-12.fc38.aarch64"
+      "evra": "1.2.1-1.fc38.aarch64"
     },
     "snappy": {
       "evra": "1.1.9-7.fc38.aarch64"
@@ -1277,16 +1277,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-08-19T00:00:00Z",
+    "generated": "2023-09-02T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2023-04-13T20:36:48Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2023-08-18T06:29:41Z"
+        "generated": "2023-09-01T22:30:50Z"
       },
       "fedora-updates": {
-        "generated": "2023-08-19T01:06:38Z"
+        "generated": "2023-09-02T01:03:54Z"
       }
     }
   }
diff --git a/manifest-lock.ppc64le.json b/manifest-lock.ppc64le.json
index 8dbb67bcd2..a08c40167e 100644
--- a/manifest-lock.ppc64le.json
+++ b/manifest-lock.ppc64le.json
@@ -85,7 +85,7 @@
       "evra": "3.6.1-4.fc38.ppc64le"
     },
     "btrfs-progs": {
-      "evra": "6.3.2-1.fc38.ppc64le"
+      "evra": "6.3.3-1.fc38.ppc64le"
     },
     "bubblewrap": {
       "evra": "0.7.0-1.fc38.ppc64le"
@@ -106,7 +106,7 @@
       "evra": "0.1.7-14.fc38.ppc64le"
     },
     "chrony": {
-      "evra": "4.3-3.fc38.ppc64le"
+      "evra": "4.4-1.fc38.ppc64le"
     },
     "cifs-utils": {
       "evra": "7.0-1.fc38.ppc64le"
@@ -142,7 +142,7 @@
       "evra": "0.21.3-4.fc38.noarch"
     },
     "container-selinux": {
-      "evra": "2:2.221.0-1.fc38.noarch"
+      "evra": "2:2.221.1-1.fc38.noarch"
     },
     "containerd": {
       "evra": "1.6.19-1.fc38.ppc64le"
@@ -157,10 +157,10 @@
       "evra": "4:1-89.fc38.noarch"
     },
     "coreos-installer": {
-      "evra": "0.17.0-3.fc38.ppc64le"
+      "evra": "0.17.0-5.fc38.ppc64le"
     },
     "coreos-installer-bootinfra": {
-      "evra": "0.17.0-3.fc38.ppc64le"
+      "evra": "0.17.0-5.fc38.ppc64le"
     },
     "coreutils": {
       "evra": "9.1-12.fc38.ppc64le"
@@ -181,7 +181,7 @@
       "evra": "3.17.1-5.fc38.ppc64le"
     },
     "crun": {
-      "evra": "1.8.6-1.fc38.ppc64le"
+      "evra": "1.8.7-1.fc38.ppc64le"
     },
     "crypto-policies": {
       "evra": "20230301-1.gita12f7b2.fc38.noarch"
@@ -340,7 +340,7 @@
       "evra": "3.14.1-1.fc38.ppc64le"
     },
     "fwupd": {
-      "evra": "1.9.3-2.fc38.ppc64le"
+      "evra": "1.9.4-1.fc38.ppc64le"
     },
     "gawk": {
       "evra": "5.1.1-5.fc38.ppc64le"
@@ -364,7 +364,7 @@
       "evra": "2.41.0-1.fc38.ppc64le"
     },
     "glib2": {
-      "evra": "2.76.4-3.fc38.ppc64le"
+      "evra": "2.76.5-1.fc38.ppc64le"
     },
     "glibc": {
       "evra": "2.37-4.fc38.ppc64le"
@@ -385,7 +385,7 @@
       "evra": "2.4.0-3.fc38.ppc64le"
     },
     "gnutls": {
-      "evra": "3.8.0-2.fc38.ppc64le"
+      "evra": "3.8.1-1.fc38.ppc64le"
     },
     "gpgme": {
       "evra": "1.17.1-5.fc38.ppc64le"
@@ -394,19 +394,19 @@
       "evra": "3.8-3.fc38.ppc64le"
     },
     "grub2-common": {
-      "evra": "1:2.06-95.fc38.noarch"
+      "evra": "1:2.06-97.fc38.noarch"
     },
     "grub2-ppc64le": {
-      "evra": "1:2.06-95.fc38.ppc64le"
+      "evra": "1:2.06-97.fc38.ppc64le"
     },
     "grub2-ppc64le-modules": {
-      "evra": "1:2.06-95.fc38.noarch"
+      "evra": "1:2.06-97.fc38.noarch"
     },
     "grub2-tools": {
-      "evra": "1:2.06-95.fc38.ppc64le"
+      "evra": "1:2.06-97.fc38.ppc64le"
     },
     "grub2-tools-minimal": {
-      "evra": "1:2.06-95.fc38.ppc64le"
+      "evra": "1:2.06-97.fc38.ppc64le"
     },
     "gzip": {
       "evra": "1.12-3.fc38.ppc64le"
@@ -493,16 +493,16 @@
       "evra": "2.5.1-5.fc38.noarch"
     },
     "kernel": {
-      "evra": "6.4.11-200.fc38.ppc64le"
+      "evra": "6.4.12-200.fc38.ppc64le"
     },
     "kernel-core": {
-      "evra": "6.4.11-200.fc38.ppc64le"
+      "evra": "6.4.12-200.fc38.ppc64le"
     },
     "kernel-modules": {
-      "evra": "6.4.11-200.fc38.ppc64le"
+      "evra": "6.4.12-200.fc38.ppc64le"
     },
     "kernel-modules-core": {
-      "evra": "6.4.11-200.fc38.ppc64le"
+      "evra": "6.4.12-200.fc38.ppc64le"
     },
     "kexec-tools": {
       "evra": "2.0.26-3.fc38.ppc64le"
@@ -589,7 +589,7 @@
       "evra": "0.5.0-53.fc38.ppc64le"
     },
     "libeconf": {
-      "evra": "0.4.0-5.fc38.ppc64le"
+      "evra": "0.5.2-1.fc38.ppc64le"
     },
     "libedit": {
       "evra": "3.1-45.20221030cvs.fc38.ppc64le"
@@ -763,7 +763,7 @@
       "evra": "2.38.1-4.fc38.ppc64le"
     },
     "libsmbclient": {
-      "evra": "2:4.18.5-0.fc38.ppc64le"
+      "evra": "2:4.18.6-1.fc38.ppc64le"
     },
     "libsolv": {
       "evra": "0.7.22-4.fc38.ppc64le"
@@ -832,7 +832,7 @@
       "evra": "0.3.2-5.fc38.ppc64le"
     },
     "libwbclient": {
-      "evra": "2:4.18.5-0.fc38.ppc64le"
+      "evra": "2:4.18.6-1.fc38.ppc64le"
     },
     "libxcrypt": {
       "evra": "4.4.36-1.fc38.ppc64le"
@@ -994,10 +994,10 @@
       "evra": "1.5.2-16.fc38.ppc64le"
     },
     "passt": {
-      "evra": "0^20230625.g32660ce-1.fc38.ppc64le"
+      "evra": "0^20230823.ga7e4bfb-1.fc38.ppc64le"
     },
     "passt-selinux": {
-      "evra": "0^20230625.g32660ce-1.fc38.noarch"
+      "evra": "0^20230823.ga7e4bfb-1.fc38.noarch"
     },
     "passwd": {
       "evra": "0.80-14.fc38.ppc64le"
@@ -1021,10 +1021,10 @@
       "evra": "1.8.0-6.fc38.ppc64le"
     },
     "podman": {
-      "evra": "5:4.6.1-1.fc38.ppc64le"
+      "evra": "5:4.6.2-1.fc38.ppc64le"
     },
     "podman-plugins": {
-      "evra": "5:4.6.1-1.fc38.ppc64le"
+      "evra": "5:4.6.2-1.fc38.ppc64le"
     },
     "policycoreutils": {
       "evra": "3.5-1.fc38.ppc64le"
@@ -1048,7 +1048,7 @@
       "evra": "2.7.9-2.fc38.ppc64le"
     },
     "procps-ng": {
-      "evra": "3.3.17-10.fc38.ppc64le"
+      "evra": "3.3.17-11.fc38.ppc64le"
     },
     "protobuf-c": {
       "evra": "1.4.1-4.fc38.ppc64le"
@@ -1060,7 +1060,7 @@
       "evra": "20230812-1.fc38.noarch"
     },
     "qemu-user-static-x86": {
-      "evra": "2:7.2.4-2.fc38.ppc64le"
+      "evra": "2:7.2.5-1.fc38.ppc64le"
     },
     "readline": {
       "evra": "8.2-3.fc38.ppc64le"
@@ -1087,7 +1087,7 @@
       "evra": "4.18.1-3.fc38.ppc64le"
     },
     "rpm-sequoia": {
-      "evra": "1.4.1-1.fc38.ppc64le"
+      "evra": "1.5.0-1.fc38.ppc64le"
     },
     "rsync": {
       "evra": "3.2.7-2.fc38.ppc64le"
@@ -1096,22 +1096,22 @@
       "evra": "2:1.1.7-1.fc38.ppc64le"
     },
     "samba-client-libs": {
-      "evra": "2:4.18.5-0.fc38.ppc64le"
+      "evra": "2:4.18.6-1.fc38.ppc64le"
     },
     "samba-common": {
-      "evra": "2:4.18.5-0.fc38.noarch"
+      "evra": "2:4.18.6-1.fc38.noarch"
     },
     "samba-common-libs": {
-      "evra": "2:4.18.5-0.fc38.ppc64le"
+      "evra": "2:4.18.6-1.fc38.ppc64le"
     },
     "sed": {
       "evra": "4.8-12.fc38.ppc64le"
     },
     "selinux-policy": {
-      "evra": "38.24-1.fc38.noarch"
+      "evra": "38.25-1.fc38.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.24-1.fc38.noarch"
+      "evra": "38.25-1.fc38.noarch"
     },
     "servicelog": {
       "evra": "1.1.16-3.fc38.ppc64le"
@@ -1141,7 +1141,7 @@
       "evra": "2.3.3-3.fc38.ppc64le"
     },
     "slirp4netns": {
-      "evra": "1.2.0-12.fc38.ppc64le"
+      "evra": "1.2.1-1.fc38.ppc64le"
     },
     "snappy": {
       "evra": "1.1.9-7.fc38.ppc64le"
@@ -1280,16 +1280,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-08-19T00:00:00Z",
+    "generated": "2023-09-02T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2023-04-13T20:36:47Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2023-08-18T06:29:13Z"
+        "generated": "2023-09-01T22:29:56Z"
       },
       "fedora-updates": {
-        "generated": "2023-08-19T01:06:45Z"
+        "generated": "2023-09-02T01:04:01Z"
       }
     }
   }
diff --git a/manifest-lock.s390x.json b/manifest-lock.s390x.json
index f071917f12..d4a5998570 100644
--- a/manifest-lock.s390x.json
+++ b/manifest-lock.s390x.json
@@ -82,7 +82,7 @@
       "evra": "3.6.1-4.fc38.s390x"
     },
     "btrfs-progs": {
-      "evra": "6.3.2-1.fc38.s390x"
+      "evra": "6.3.3-1.fc38.s390x"
     },
     "bubblewrap": {
       "evra": "0.7.0-1.fc38.s390x"
@@ -103,7 +103,7 @@
       "evra": "0.1.7-14.fc38.s390x"
     },
     "chrony": {
-      "evra": "4.3-3.fc38.s390x"
+      "evra": "4.4-1.fc38.s390x"
     },
     "cifs-utils": {
       "evra": "7.0-1.fc38.s390x"
@@ -139,7 +139,7 @@
       "evra": "0.21.3-4.fc38.noarch"
     },
     "container-selinux": {
-      "evra": "2:2.221.0-1.fc38.noarch"
+      "evra": "2:2.221.1-1.fc38.noarch"
     },
     "containerd": {
       "evra": "1.6.19-1.fc38.s390x"
@@ -154,10 +154,10 @@
       "evra": "4:1-89.fc38.noarch"
     },
     "coreos-installer": {
-      "evra": "0.17.0-3.fc38.s390x"
+      "evra": "0.17.0-5.fc38.s390x"
     },
     "coreos-installer-bootinfra": {
-      "evra": "0.17.0-3.fc38.s390x"
+      "evra": "0.17.0-5.fc38.s390x"
     },
     "coreutils": {
       "evra": "9.1-12.fc38.s390x"
@@ -178,7 +178,7 @@
       "evra": "3.17.1-5.fc38.s390x"
     },
     "crun": {
-      "evra": "1.8.6-1.fc38.s390x"
+      "evra": "1.8.7-1.fc38.s390x"
     },
     "crypto-policies": {
       "evra": "20230301-1.gita12f7b2.fc38.noarch"
@@ -336,6 +336,9 @@
     "fuse3-libs": {
       "evra": "3.14.1-1.fc38.s390x"
     },
+    "fwupd": {
+      "evra": "1.9.4-1.fc38.s390x"
+    },
     "gawk": {
       "evra": "5.1.1-5.fc38.s390x"
     },
@@ -349,7 +352,7 @@
       "evra": "2.41.0-1.fc38.s390x"
     },
     "glib2": {
-      "evra": "2.76.4-3.fc38.s390x"
+      "evra": "2.76.5-1.fc38.s390x"
     },
     "glibc": {
       "evra": "2.37-4.fc38.s390x"
@@ -370,7 +373,7 @@
       "evra": "2.4.0-3.fc38.s390x"
     },
     "gnutls": {
-      "evra": "3.8.0-2.fc38.s390x"
+      "evra": "3.8.1-1.fc38.s390x"
     },
     "gpgme": {
       "evra": "1.17.1-5.fc38.s390x"
@@ -460,16 +463,16 @@
       "evra": "2.5.1-5.fc38.noarch"
     },
     "kernel": {
-      "evra": "6.4.11-200.fc38.s390x"
+      "evra": "6.4.12-200.fc38.s390x"
     },
     "kernel-core": {
-      "evra": "6.4.11-200.fc38.s390x"
+      "evra": "6.4.12-200.fc38.s390x"
     },
     "kernel-modules": {
-      "evra": "6.4.11-200.fc38.s390x"
+      "evra": "6.4.12-200.fc38.s390x"
     },
     "kernel-modules-core": {
-      "evra": "6.4.11-200.fc38.s390x"
+      "evra": "6.4.12-200.fc38.s390x"
     },
     "kexec-tools": {
       "evra": "2.0.26-3.fc38.s390x"
@@ -510,6 +513,9 @@
     "libassuan": {
       "evra": "2.5.6-1.fc38.s390x"
     },
+    "libatomic": {
+      "evra": "13.2.1-1.fc38.s390x"
+    },
     "libattr": {
       "evra": "2.5.1-6.fc38.s390x"
     },
@@ -553,7 +559,7 @@
       "evra": "0.5.0-53.fc38.s390x"
     },
     "libeconf": {
-      "evra": "0.4.0-5.fc38.s390x"
+      "evra": "0.5.2-1.fc38.s390x"
     },
     "libedit": {
       "evra": "3.1-45.20221030cvs.fc38.s390x"
@@ -570,6 +576,9 @@
     "libfido2": {
       "evra": "1.12.0-3.fc38.s390x"
     },
+    "libgcab1": {
+      "evra": "1.5-2.fc38.s390x"
+    },
     "libgcc": {
       "evra": "13.2.1-1.fc38.s390x"
     },
@@ -579,6 +588,12 @@
     "libgpg-error": {
       "evra": "1.47-1.fc38.s390x"
     },
+    "libgudev": {
+      "evra": "237-4.fc38.s390x"
+    },
+    "libgusb": {
+      "evra": "0.4.5-1.fc38.s390x"
+    },
     "libibverbs": {
       "evra": "44.0-3.fc38.s390x"
     },
@@ -594,6 +609,9 @@
     "libipa_hbac": {
       "evra": "2.9.1-1.fc38.s390x"
     },
+    "libjcat": {
+      "evra": "0.1.13-1.fc38.s390x"
+    },
     "libjose": {
       "evra": "11-7.fc38.s390x"
     },
@@ -709,7 +727,7 @@
       "evra": "2.38.1-4.fc38.s390x"
     },
     "libsmbclient": {
-      "evra": "2:4.18.5-0.fc38.s390x"
+      "evra": "2:4.18.6-1.fc38.s390x"
     },
     "libsolv": {
       "evra": "0.7.22-4.fc38.s390x"
@@ -759,6 +777,9 @@
     "libunistring1.0": {
       "evra": "1.0-1.fc38.s390x"
     },
+    "libusb1": {
+      "evra": "1.0.26-2.fc38.s390x"
+    },
     "libuser": {
       "evra": "0.64-2.fc38.s390x"
     },
@@ -775,7 +796,7 @@
       "evra": "0.3.2-5.fc38.s390x"
     },
     "libwbclient": {
-      "evra": "2:4.18.5-0.fc38.s390x"
+      "evra": "2:4.18.6-1.fc38.s390x"
     },
     "libxcrypt": {
       "evra": "4.4.36-1.fc38.s390x"
@@ -783,6 +804,9 @@
     "libxml2": {
       "evra": "2.10.4-1.fc38.s390x"
     },
+    "libxmlb": {
+      "evra": "0.3.12-1.fc38.s390x"
+    },
     "libyaml": {
       "evra": "0.2.5-9.fc38.s390x"
     },
@@ -925,10 +949,10 @@
       "evra": "1.5.2-16.fc38.s390x"
     },
     "passt": {
-      "evra": "0^20230625.g32660ce-1.fc38.s390x"
+      "evra": "0^20230823.ga7e4bfb-1.fc38.s390x"
     },
     "passt-selinux": {
-      "evra": "0^20230625.g32660ce-1.fc38.noarch"
+      "evra": "0^20230823.ga7e4bfb-1.fc38.noarch"
     },
     "passwd": {
       "evra": "0.80-14.fc38.s390x"
@@ -952,10 +976,10 @@
       "evra": "1.8.0-6.fc38.s390x"
     },
     "podman": {
-      "evra": "5:4.6.1-1.fc38.s390x"
+      "evra": "5:4.6.2-1.fc38.s390x"
     },
     "podman-plugins": {
-      "evra": "5:4.6.1-1.fc38.s390x"
+      "evra": "5:4.6.2-1.fc38.s390x"
     },
     "policycoreutils": {
       "evra": "3.5-1.fc38.s390x"
@@ -973,7 +997,7 @@
       "evra": "1.19-2.fc38.s390x"
     },
     "procps-ng": {
-      "evra": "3.3.17-10.fc38.s390x"
+      "evra": "3.3.17-11.fc38.s390x"
     },
     "protobuf-c": {
       "evra": "1.4.1-4.fc38.s390x"
@@ -985,7 +1009,7 @@
       "evra": "20230812-1.fc38.noarch"
     },
     "qemu-user-static-x86": {
-      "evra": "2:7.2.4-2.fc38.s390x"
+      "evra": "2:7.2.5-1.fc38.s390x"
     },
     "readline": {
       "evra": "8.2-3.fc38.s390x"
@@ -1012,7 +1036,7 @@
       "evra": "4.18.1-3.fc38.s390x"
     },
     "rpm-sequoia": {
-      "evra": "1.4.1-1.fc38.s390x"
+      "evra": "1.5.0-1.fc38.s390x"
     },
     "rsync": {
       "evra": "3.2.7-2.fc38.s390x"
@@ -1024,22 +1048,22 @@
       "evra": "2:2.25.0-4.fc38.s390x"
     },
     "samba-client-libs": {
-      "evra": "2:4.18.5-0.fc38.s390x"
+      "evra": "2:4.18.6-1.fc38.s390x"
     },
     "samba-common": {
-      "evra": "2:4.18.5-0.fc38.noarch"
+      "evra": "2:4.18.6-1.fc38.noarch"
     },
     "samba-common-libs": {
-      "evra": "2:4.18.5-0.fc38.s390x"
+      "evra": "2:4.18.6-1.fc38.s390x"
     },
     "sed": {
       "evra": "4.8-12.fc38.s390x"
     },
     "selinux-policy": {
-      "evra": "38.24-1.fc38.noarch"
+      "evra": "38.25-1.fc38.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.24-1.fc38.noarch"
+      "evra": "38.25-1.fc38.noarch"
     },
     "setup": {
       "evra": "2.14.3-2.fc38.noarch"
@@ -1056,6 +1080,9 @@
     "shadow-utils-subid": {
       "evra": "2:4.13-6.fc38.s390x"
     },
+    "shared-mime-info": {
+      "evra": "2.2-3.fc38.s390x"
+    },
     "skopeo": {
       "evra": "1:1.13.2-1.fc38.s390x"
     },
@@ -1063,7 +1090,7 @@
       "evra": "2.3.3-3.fc38.s390x"
     },
     "slirp4netns": {
-      "evra": "1.2.0-12.fc38.s390x"
+      "evra": "1.2.1-1.fc38.s390x"
     },
     "snappy": {
       "evra": "1.1.9-7.fc38.s390x"
@@ -1205,16 +1232,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-08-19T00:00:00Z",
+    "generated": "2023-09-02T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2023-04-13T20:36:40Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2023-08-18T06:29:07Z"
+        "generated": "2023-09-01T22:29:03Z"
       },
       "fedora-updates": {
-        "generated": "2023-08-19T01:06:52Z"
+        "generated": "2023-09-02T01:04:08Z"
       }
     }
   }
diff --git a/manifest-lock.x86_64.json b/manifest-lock.x86_64.json
index 4a616f7af5..6913b6f406 100644
--- a/manifest-lock.x86_64.json
+++ b/manifest-lock.x86_64.json
@@ -85,7 +85,7 @@
       "evra": "3.6.1-4.fc38.x86_64"
     },
     "btrfs-progs": {
-      "evra": "6.3.2-1.fc38.x86_64"
+      "evra": "6.3.3-1.fc38.x86_64"
     },
     "bubblewrap": {
       "evra": "0.7.0-1.fc38.x86_64"
@@ -106,7 +106,7 @@
       "evra": "0.1.7-14.fc38.x86_64"
     },
     "chrony": {
-      "evra": "4.3-3.fc38.x86_64"
+      "evra": "4.4-1.fc38.x86_64"
     },
     "cifs-utils": {
       "evra": "7.0-1.fc38.x86_64"
@@ -142,7 +142,7 @@
       "evra": "0.21.3-4.fc38.noarch"
     },
     "container-selinux": {
-      "evra": "2:2.221.0-1.fc38.noarch"
+      "evra": "2:2.221.1-1.fc38.noarch"
     },
     "containerd": {
       "evra": "1.6.19-1.fc38.x86_64"
@@ -157,10 +157,10 @@
       "evra": "4:1-89.fc38.noarch"
     },
     "coreos-installer": {
-      "evra": "0.17.0-3.fc38.x86_64"
+      "evra": "0.17.0-5.fc38.x86_64"
     },
     "coreos-installer-bootinfra": {
-      "evra": "0.17.0-3.fc38.x86_64"
+      "evra": "0.17.0-5.fc38.x86_64"
     },
     "coreutils": {
       "evra": "9.1-12.fc38.x86_64"
@@ -181,7 +181,7 @@
       "evra": "3.17.1-5.fc38.x86_64"
     },
     "crun": {
-      "evra": "1.8.6-1.fc38.x86_64"
+      "evra": "1.8.7-1.fc38.x86_64"
     },
     "crypto-policies": {
       "evra": "20230301-1.gita12f7b2.fc38.noarch"
@@ -349,7 +349,7 @@
       "evra": "3.14.1-1.fc38.x86_64"
     },
     "fwupd": {
-      "evra": "1.9.3-2.fc38.x86_64"
+      "evra": "1.9.4-1.fc38.x86_64"
     },
     "gawk": {
       "evra": "5.1.1-5.fc38.x86_64"
@@ -373,7 +373,7 @@
       "evra": "2.41.0-1.fc38.x86_64"
     },
     "glib2": {
-      "evra": "2.76.4-3.fc38.x86_64"
+      "evra": "2.76.5-1.fc38.x86_64"
     },
     "glibc": {
       "evra": "2.37-4.fc38.x86_64"
@@ -394,7 +394,7 @@
       "evra": "2.4.0-3.fc38.x86_64"
     },
     "gnutls": {
-      "evra": "3.8.0-2.fc38.x86_64"
+      "evra": "3.8.1-1.fc38.x86_64"
     },
     "google-compute-engine-guest-configs-udev": {
       "evra": "20230808.00-1.fc38.noarch"
@@ -406,22 +406,22 @@
       "evra": "3.8-3.fc38.x86_64"
     },
     "grub2-common": {
-      "evra": "1:2.06-95.fc38.noarch"
+      "evra": "1:2.06-97.fc38.noarch"
     },
     "grub2-efi-x64": {
-      "evra": "1:2.06-95.fc38.x86_64"
+      "evra": "1:2.06-97.fc38.x86_64"
     },
     "grub2-pc": {
-      "evra": "1:2.06-95.fc38.x86_64"
+      "evra": "1:2.06-97.fc38.x86_64"
     },
     "grub2-pc-modules": {
-      "evra": "1:2.06-95.fc38.noarch"
+      "evra": "1:2.06-97.fc38.noarch"
     },
     "grub2-tools": {
-      "evra": "1:2.06-95.fc38.x86_64"
+      "evra": "1:2.06-97.fc38.x86_64"
     },
     "grub2-tools-minimal": {
-      "evra": "1:2.06-95.fc38.x86_64"
+      "evra": "1:2.06-97.fc38.x86_64"
     },
     "gzip": {
       "evra": "1.12-3.fc38.x86_64"
@@ -508,16 +508,16 @@
       "evra": "2.5.1-5.fc38.noarch"
     },
     "kernel": {
-      "evra": "6.4.11-200.fc38.x86_64"
+      "evra": "6.4.12-200.fc38.x86_64"
     },
     "kernel-core": {
-      "evra": "6.4.11-200.fc38.x86_64"
+      "evra": "6.4.12-200.fc38.x86_64"
     },
     "kernel-modules": {
-      "evra": "6.4.11-200.fc38.x86_64"
+      "evra": "6.4.12-200.fc38.x86_64"
     },
     "kernel-modules-core": {
-      "evra": "6.4.11-200.fc38.x86_64"
+      "evra": "6.4.12-200.fc38.x86_64"
     },
     "kexec-tools": {
       "evra": "2.0.26-3.fc38.x86_64"
@@ -601,7 +601,7 @@
       "evra": "0.5.0-53.fc38.x86_64"
     },
     "libeconf": {
-      "evra": "0.4.0-5.fc38.x86_64"
+      "evra": "0.5.2-1.fc38.x86_64"
     },
     "libedit": {
       "evra": "3.1-45.20221030cvs.fc38.x86_64"
@@ -769,7 +769,7 @@
       "evra": "2.38.1-4.fc38.x86_64"
     },
     "libsmbclient": {
-      "evra": "2:4.18.5-0.fc38.x86_64"
+      "evra": "2:4.18.6-1.fc38.x86_64"
     },
     "libsolv": {
       "evra": "0.7.22-4.fc38.x86_64"
@@ -838,7 +838,7 @@
       "evra": "0.3.2-5.fc38.x86_64"
     },
     "libwbclient": {
-      "evra": "2:4.18.5-0.fc38.x86_64"
+      "evra": "2:4.18.6-1.fc38.x86_64"
     },
     "libxcrypt": {
       "evra": "4.4.36-1.fc38.x86_64"
@@ -1003,10 +1003,10 @@
       "evra": "1.5.2-16.fc38.x86_64"
     },
     "passt": {
-      "evra": "0^20230625.g32660ce-1.fc38.x86_64"
+      "evra": "0^20230823.ga7e4bfb-1.fc38.x86_64"
     },
     "passt-selinux": {
-      "evra": "0^20230625.g32660ce-1.fc38.noarch"
+      "evra": "0^20230823.ga7e4bfb-1.fc38.noarch"
     },
     "passwd": {
       "evra": "0.80-14.fc38.x86_64"
@@ -1030,10 +1030,10 @@
       "evra": "1.8.0-6.fc38.x86_64"
     },
     "podman": {
-      "evra": "5:4.6.1-1.fc38.x86_64"
+      "evra": "5:4.6.2-1.fc38.x86_64"
     },
     "podman-plugins": {
-      "evra": "5:4.6.1-1.fc38.x86_64"
+      "evra": "5:4.6.2-1.fc38.x86_64"
     },
     "policycoreutils": {
       "evra": "3.5-1.fc38.x86_64"
@@ -1051,7 +1051,7 @@
       "evra": "1.19-2.fc38.x86_64"
     },
     "procps-ng": {
-      "evra": "3.3.17-10.fc38.x86_64"
+      "evra": "3.3.17-11.fc38.x86_64"
     },
     "protobuf-c": {
       "evra": "1.4.1-4.fc38.x86_64"
@@ -1087,7 +1087,7 @@
       "evra": "4.18.1-3.fc38.x86_64"
     },
     "rpm-sequoia": {
-      "evra": "1.4.1-1.fc38.x86_64"
+      "evra": "1.5.0-1.fc38.x86_64"
     },
     "rsync": {
       "evra": "3.2.7-2.fc38.x86_64"
@@ -1096,22 +1096,22 @@
       "evra": "2:1.1.7-1.fc38.x86_64"
     },
     "samba-client-libs": {
-      "evra": "2:4.18.5-0.fc38.x86_64"
+      "evra": "2:4.18.6-1.fc38.x86_64"
     },
     "samba-common": {
-      "evra": "2:4.18.5-0.fc38.noarch"
+      "evra": "2:4.18.6-1.fc38.noarch"
     },
     "samba-common-libs": {
-      "evra": "2:4.18.5-0.fc38.x86_64"
+      "evra": "2:4.18.6-1.fc38.x86_64"
     },
     "sed": {
       "evra": "4.8-12.fc38.x86_64"
     },
     "selinux-policy": {
-      "evra": "38.24-1.fc38.noarch"
+      "evra": "38.25-1.fc38.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.24-1.fc38.noarch"
+      "evra": "38.25-1.fc38.noarch"
     },
     "setup": {
       "evra": "2.14.3-2.fc38.noarch"
@@ -1141,7 +1141,7 @@
       "evra": "2.3.3-3.fc38.x86_64"
     },
     "slirp4netns": {
-      "evra": "1.2.0-12.fc38.x86_64"
+      "evra": "1.2.1-1.fc38.x86_64"
     },
     "snappy": {
       "evra": "1.1.9-7.fc38.x86_64"
@@ -1280,16 +1280,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-08-19T00:00:00Z",
+    "generated": "2023-09-02T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2023-04-13T20:37:10Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2023-08-18T06:29:59Z"
+        "generated": "2023-09-01T22:30:01Z"
       },
       "fedora-updates": {
-        "generated": "2023-08-19T01:06:59Z"
+        "generated": "2023-09-02T01:04:16Z"
       }
     }
   }
diff --git a/manifests/bootable-rpm-ostree.yaml b/manifests/bootable-rpm-ostree.yaml
index a1f83f191b..fdb9c8b078 100644
--- a/manifests/bootable-rpm-ostree.yaml
+++ b/manifests/bootable-rpm-ostree.yaml
@@ -13,16 +13,14 @@ packages:
  - linux-firmware
  # rpm-ostree
  - rpm-ostree nss-altfiles
+ # firmware updates
+ - fwupd
 
 # bootloader
 packages-aarch64:
   - grub2-efi-aa64 efibootmgr shim
-  # firmware updates
-  - fwupd
 packages-ppc64le:
   - grub2 ostree-grub2
-  # firmware updates
-  - fwupd
 packages-s390x:
   # On Fedora, this is provided by s390utils-core. on RHEL, this is for now
   # provided by s390utils-base, but soon will be -core too.
@@ -32,8 +30,6 @@ packages-s390x:
 packages-x86_64:
   - grub2 grub2-efi-x64 efibootmgr shim
   - microcode_ctl
-  # firmware updates
-  - fwupd
 
 exclude-packages:
   # Exclude kernel-debug-core to make sure that it doesn't somehow get
diff --git a/manifests/enable-fwupd-refresh-timer.yaml b/manifests/enable-fwupd-refresh-timer.yaml
new file mode 100644
index 0000000000..79cd710aa5
--- /dev/null
+++ b/manifests/enable-fwupd-refresh-timer.yaml
@@ -0,0 +1,2 @@
+ostree-layers:
+  - overlay/18fwupd-refresh-timer
diff --git a/manifests/fedora-coreos-base.yaml b/manifests/fedora-coreos-base.yaml
index 4ad1554b5f..eec7561aef 100644
--- a/manifests/fedora-coreos-base.yaml
+++ b/manifests/fedora-coreos-base.yaml
@@ -16,6 +16,7 @@ ostree-layers:
   - overlay/09misc
   - overlay/20platform-chrony
   - overlay/25azure-udev-rules
+  - overlay/30lvmdevices
 
 # Be minimal
 recommends: false
diff --git a/manifests/fedora-coreos.yaml b/manifests/fedora-coreos.yaml
index a30e010858..59217fc705 100644
--- a/manifests/fedora-coreos.yaml
+++ b/manifests/fedora-coreos.yaml
@@ -46,6 +46,11 @@ conditional-include:
     # Modularity is going away in F39+ so we'll only include
     # the fedora-repos-modular package in <39.
     include: fedora-modularity.yaml
+  - if: releasever >= 39
+    # https://fedoraproject.org/wiki/Changes/EnableFwupdRefreshByDefault
+    # Merge with overlay.d/15fcos/usr/lib/systemd/system-preset/45-fcos.preset
+    # once Fedora 39 is released to all streams
+    include: enable-fwupd-refresh-timer.yaml
 
 ostree-layers:
   - overlay/15fcos
diff --git a/overlay.d/05core/usr/lib/coreos/generator-lib.sh b/overlay.d/05core/usr/lib/coreos/generator-lib.sh
index dd19ad813d..84547ce36b 100644
--- a/overlay.d/05core/usr/lib/coreos/generator-lib.sh
+++ b/overlay.d/05core/usr/lib/coreos/generator-lib.sh
@@ -8,7 +8,7 @@ UNIT_DIR="${1:-/tmp}"
 
 have_karg() {
     local arg="$1"
-    local cmdline=( $(</proc/cmdline) )
+    IFS=" " read -r -a cmdline <<< "$(</proc/cmdline)"
     local i
     for i in "${cmdline[@]}"; do
         if [[ "$i" =~ "$arg=" ]]; then
@@ -20,7 +20,7 @@ have_karg() {
 
 karg() {
     local name="$1" value="${2:-}"
-    local cmdline=( $(</proc/cmdline) )
+    IFS=" " read -r -a cmdline <<< "$(</proc/cmdline)"
     for arg in "${cmdline[@]}"; do
         if [[ "${arg%%=*}" == "${name}" ]]; then
             value="${arg#*=}"
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-boot-edit.sh b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-boot-edit.sh
index ecd758a675..ec1ae40bc5 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-boot-edit.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-boot-edit.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 
 # For a description of how this is used, see `coreos-boot-edit.service`.
 
-cmdline=( $(</proc/cmdline) )
+IFS=" " read -r -a cmdline <<< "$(</proc/cmdline)"
 karg() {
     local name="$1" value="${2:-}"
     for arg in "${cmdline[@]}"; do
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator
index 8414013758..e7d1d688c3 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator
@@ -14,7 +14,7 @@ exec 1>/dev/kmsg; exec 2>&1
 
 UNIT_DIR="${1:-/tmp}"
 
-cmdline=( $(</proc/cmdline) )
+IFS=" " read -r -a cmdline <<< "$(</proc/cmdline)"
 cmdline_arg() {
     local name="$1" value="$2"
     for arg in "${cmdline[@]}"; do
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-populate-var.sh b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-populate-var.sh
index 01212db7d5..e630b8753d 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-populate-var.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-populate-var.sh
@@ -35,11 +35,5 @@ for varsubdir in lib log home roothome opt srv usrlocal mnt media; do
         systemd-tmpfiles --create --boot --root=/sysroot --prefix="/var/${varsubdir}"
     fi
 
-    if [[ $varsubdir == roothome ]]; then
-        # TODO move this to tmpfiles.d once systemd-tmpfiles handles C! with --root correctly.
-        # See https://github.com/coreos/fedora-coreos-config/pull/137
-        cp /sysroot/etc/skel/.bash* /sysroot/var/${varsubdir}
-    fi
-
     coreos-relabel "/var/${varsubdir}"
 done
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
index 6f89c4007e..62fa977043 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
@@ -139,17 +139,24 @@ should_autosave_rootfs() {
         return
     fi
     local agcount
+    # This runs xfs_info on the unmounted filesystem, because mounting an
+    # XFS filesystem that has grown an excessive number of allocation groups
+    # can be very slow.
     eval $(xfs_info "${root_part}" | grep -o 'agcount=[0-9]*')
-    # Semi-arbitrarily chosen: this is roughly ~64G currently (based on initial
-    # ag sizing at build time) which seems like a good rootfs size at which to
-    # discriminate between "throwaway/short-lived systems" and "long-running
-    # workload systems". It's not like XFS performance is way worse at 128.
-    if [ "$agcount" -lt 128 ]; then
-        echo "Filesystem agcount is $agcount; skipping" >&2
+    # This is roughly ~700GiB currently (based on initial ag sizing at build time)
+    # which ensures we grow only on "large" root filesystems.
+    # Specifically for e.g. OpenShift, this ensures we don't reprovision on default
+    # worker node root filesystems.
+    local threshold
+    threshold=400
+    if [ "$agcount" -lt "${threshold}" ]; then
+        echo "autosave-xfs: ${root_part} agcount=$agcount is lower than threshold=${threshold}" >&2
         echo 0
         return
+    else
+        echo "autosave-xfs: ${root_part} agcount=$agcount meets threshold=${threshold}" >&2
+        echo 1
     fi
-    echo 1
 }
 
 ensure_zram_dev() {
diff --git a/overlay.d/05core/usr/lib/tmpfiles.d/root-bash.conf b/overlay.d/05core/usr/lib/tmpfiles.d/root-bash.conf
new file mode 100644
index 0000000000..d59075ba29
--- /dev/null
+++ b/overlay.d/05core/usr/lib/tmpfiles.d/root-bash.conf
@@ -0,0 +1,4 @@
+# Use C! according to https://github.com/coreos/fedora-coreos-config/pull/137/files#diff-4c7caeddac3f43acdf59b41ffa4e3533bb846d2e3bfa31f885a65e9598a2c4a1R1-R2
+C!	/var/roothome/.bashrc	-	-	-	-	/usr/etc/skel/.bashrc
+C!	/var/roothome/.bash_profile	-	-	-	-	/usr/etc/skel/.bash_profile
+C!	/var/roothome/.bash_logout	-	-	-	-	/usr/etc/skel/.bash_logout
diff --git a/overlay.d/05core/usr/libexec/coreos-ignition-delete-config b/overlay.d/05core/usr/libexec/coreos-ignition-delete-config
index 59d4f0cf60..69d32b709e 100755
--- a/overlay.d/05core/usr/libexec/coreos-ignition-delete-config
+++ b/overlay.d/05core/usr/libexec/coreos-ignition-delete-config
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-cmdline=( $(</proc/cmdline) )
+IFS=" " read -r -a cmdline <<< "$(</proc/cmdline)"
 cmdline_arg() {
     local name="$1" value
     for arg in "${cmdline[@]}"; do
diff --git a/overlay.d/17fedora-modularity/usr/libexec/coreos-check-modularity b/overlay.d/17fedora-modularity/usr/libexec/coreos-check-modularity
index fc862d244c..4855059cd4 100755
--- a/overlay.d/17fedora-modularity/usr/libexec/coreos-check-modularity
+++ b/overlay.d/17fedora-modularity/usr/libexec/coreos-check-modularity
@@ -19,7 +19,7 @@ ${warn}
 ############################################################################
 WARNING: This system has layered modularity RPMs. In Fedora 39 modularity
 has been retired. The system will most likely stop updating successfully
-when Fedora CoreOS transitions to Fedora 39. See this tracker for more info: 
+when Fedora CoreOS transitions to Fedora 39. See this tracker for more info:
 https://github.com/coreos/fedora-coreos-tracker/issues/1513
 
 To disable this warning, use:
diff --git a/overlay.d/18fwupd-refresh-timer/statoverride b/overlay.d/18fwupd-refresh-timer/statoverride
new file mode 100644
index 0000000000..27a95affe2
--- /dev/null
+++ b/overlay.d/18fwupd-refresh-timer/statoverride
@@ -0,0 +1,2 @@
+# Config file for overriding permission bits on overlay files/dirs
+# Format: =<file mode in decimal> <absolute path to a file or directory>
diff --git a/overlay.d/18fwupd-refresh-timer/usr/lib/systemd/system-preset/50-fwupd-refresh-timer.preset b/overlay.d/18fwupd-refresh-timer/usr/lib/systemd/system-preset/50-fwupd-refresh-timer.preset
new file mode 100644
index 0000000000..d6f4bf900c
--- /dev/null
+++ b/overlay.d/18fwupd-refresh-timer/usr/lib/systemd/system-preset/50-fwupd-refresh-timer.preset
@@ -0,0 +1,4 @@
+# https://fedoraproject.org/wiki/Changes/EnableFwupdRefreshByDefault
+# As this is for FCOS only for now, once Fedora 39 is released to all streams,
+# this should be moved to overlay.d/15fcos/usr/lib/systemd/system-preset/45-fcos.preset
+enable fwupd-refresh.timer
diff --git a/overlay.d/20platform-chrony/usr/libexec/coreos-platform-chrony-config b/overlay.d/20platform-chrony/usr/libexec/coreos-platform-chrony-config
index e25cbb528d..9d7076661c 100755
--- a/overlay.d/20platform-chrony/usr/libexec/coreos-platform-chrony-config
+++ b/overlay.d/20platform-chrony/usr/libexec/coreos-platform-chrony-config
@@ -23,7 +23,7 @@ if ! cmp {/usr,}/etc/sysconfig/chronyd >/dev/null; then
     exit 0
 fi
 
-cmdline=( $(</proc/cmdline) )
+IFS=" " read -r -a cmdline <<< "$(</proc/cmdline)"
 cmdline_arg() {
     local name="$1" value
     for arg in "${cmdline[@]}"; do
diff --git a/overlay.d/30lvmdevices/etc/lvm/devices/system.devices b/overlay.d/30lvmdevices/etc/lvm/devices/system.devices
new file mode 100644
index 0000000000..94f55ea0d6
--- /dev/null
+++ b/overlay.d/30lvmdevices/etc/lvm/devices/system.devices
@@ -0,0 +1,8 @@
+# LVM uses devices listed in this file.
+#
+# This is an empty lvmdevices(8) file placed here by the CoreOS overlays.
+# The existence of the file prevents LVM from auto-activating any LVM devices
+# that aren't explicitly allowlisted by being added to this file. Any newly
+# added PV/VG devices that get created via pvcreate/vgreate will have an entry
+# added here automatically by the tools. For more information on this see
+# https://github.com/coreos/fedora-coreos-tracker/issues/1517
diff --git a/overlay.d/30lvmdevices/statoverride b/overlay.d/30lvmdevices/statoverride
new file mode 100644
index 0000000000..27a95affe2
--- /dev/null
+++ b/overlay.d/30lvmdevices/statoverride
@@ -0,0 +1,2 @@
+# Config file for overriding permission bits on overlay files/dirs
+# Format: =<file mode in decimal> <absolute path to a file or directory>
diff --git a/overlay.d/30lvmdevices/usr/lib/systemd/system-preset/45-coreos-populate-lvmdevices.preset b/overlay.d/30lvmdevices/usr/lib/systemd/system-preset/45-coreos-populate-lvmdevices.preset
new file mode 100644
index 0000000000..7a4fe5dfc8
--- /dev/null
+++ b/overlay.d/30lvmdevices/usr/lib/systemd/system-preset/45-coreos-populate-lvmdevices.preset
@@ -0,0 +1 @@
+enable coreos-populate-lvmdevices.service
diff --git a/overlay.d/30lvmdevices/usr/lib/systemd/system/coreos-populate-lvmdevices.service b/overlay.d/30lvmdevices/usr/lib/systemd/system/coreos-populate-lvmdevices.service
new file mode 100644
index 0000000000..8349d0253b
--- /dev/null
+++ b/overlay.d/30lvmdevices/usr/lib/systemd/system/coreos-populate-lvmdevices.service
@@ -0,0 +1,25 @@
+[Unit]
+Description=CoreOS Populate LVM Devices File
+Documentation=https://github.com/coreos/fedora-coreos-tracker/issues/1517
+# Only run this import once.
+ConditionPathExists=!/var/lib/coreos-populate-lvmdevices.stamp
+# Don't add default dependencies so we can run early enough to populate
+# the devices file before any LVM devices are used.
+DefaultDependencies=false
+# Since our ConditionPathExists file lives under /var/lib/ let's make
+# sure any filesystems/mounts that exist and are needed to access that
+# directory are set up.
+RequiresMountsFor=/var/lib
+# On OpenShift/Kubernetes we want to ensure we run before kubernetes
+# comes up where storage drivers may be initiated and present more LVM
+# devices to the system that we don't want to be considered.
+Before=kubelet.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/libexec/coreos-populate-lvmdevices
+ExecStartPost=touch /var/lib/coreos-populate-lvmdevices.stamp
+
+[Install]
+WantedBy=default.target
diff --git a/overlay.d/30lvmdevices/usr/libexec/coreos-populate-lvmdevices b/overlay.d/30lvmdevices/usr/libexec/coreos-populate-lvmdevices
new file mode 100755
index 0000000000..d479fcc51d
--- /dev/null
+++ b/overlay.d/30lvmdevices/usr/libexec/coreos-populate-lvmdevices
@@ -0,0 +1,46 @@
+#!/bin/bash
+set -euo pipefail
+
+# This script will detect any LVM devices and add them to the lvmdevices
+# file, which will force this host to only consider those devices in
+# the future. This script should be run once to do the population and
+# should not need to be run again. See
+# https://github.com/coreos/fedora-coreos-tracker/issues/1517
+
+LVMDEVICESFILENAME="system.devices"
+LVMDEVICESFILE="/etc/lvm/devices/${LVMDEVICESFILENAME}"
+
+# If the devices file doesn't exist that is a bit odd because we
+# shipped it in the same update this migration script runs but let's
+# just bail out. Someone could have deleted the lvmdevices file and
+# then later accidentally run the migration script again.
+if [ ! -f $LVMDEVICESFILE ]; then
+    echo "$LVMDEVICESFILE does not exist. Exiting."
+    exit 0
+fi
+
+# If the file exists and the file is different than what was shipped
+# then we exit early. In this case the system likely already had an
+# lvmdevices file defined already.
+if ! diff -u "/usr/${LVMDEVICESFILE}" "${LVMDEVICESFILE}"; then
+    echo "Detected modified $LVMDEVICESFILE file. Exiting."
+    exit 0
+fi
+
+# Detect all existing PVs using `pvs` with a blank devicesfile
+# setting, which will un-limit the search.
+PVS=$(pvs --devicesfile="" --noheadings -o pv_name)
+
+if [ -z "$PVS" ]; then
+    echo "No LVM devices detected. Exiting."
+    exit 0
+fi
+
+echo "Populating lvmdevices file with detected devices."
+for pv in $(pvs --devicesfile="" --noheadings -o pv_name); do
+    echo "Adding ${pv} to lvmdevices file $LVMDEVICESFILE"
+    lvmdevices --journal output --adddev "$pv" --devicesfile "$LVMDEVICESFILENAME"
+done
+
+echo "Activating lvmdevices after devices file population"
+pvscan --cache --activate ay
diff --git a/overlay.d/README.md b/overlay.d/README.md
index ec51984b46..23b64bdd13 100644
--- a/overlay.d/README.md
+++ b/overlay.d/README.md
@@ -42,6 +42,23 @@ Things that are more closely "Fedora CoreOS":
 Disable Zincati on non-production streams:
 https://github.com/coreos/fedora-coreos-tracker/issues/163
 
+17fedora-modularity
+-------------------
+
+Check for layered modularity RPMs to warn users of the retirement in Fedora 39
+via Console Login Helper Messages.
+
+Remove once Fedora 39 lands in all streams.
+
+18fwupd-refresh-timer
+---------------------
+
+Enable fwupd-refresh.timer on Fedora 39:
+https://fedoraproject.org/wiki/Changes/EnableFwupdRefreshByDefault
+
+Move to overlay.d/15fcos/usr/lib/systemd/system-preset/45-fcos.preset once
+Fedora 39 lands in all streams.
+
 20platform-chrony
 -----------------
 
@@ -50,7 +67,7 @@ such as `azure`, `aws`, `gcp`. The chrony config for these NTP servers
 should override other chrony configuration (e.g. DHCP-provided)
 configuration.
 
-25-azure-udev-rules
+25azure-udev-rules
 -------------------
 
 Add udev rules for SRIOV networking on Azure. The udev rules are also
@@ -62,3 +79,17 @@ bits to include the rules in the initramfs too.
 [1] https://github.com/coreos/fedora-coreos-tracker/issues/1383
 [2] https://github.com/Azure/WALinuxAgent/pull/1622
 [3] https://src.fedoraproject.org/rpms/WALinuxAgent/pull-request/4
+
+30lvmdevices
+-------------------
+
+Populate an lvmdevices(8) file to limit LVM from autoactivating all
+devices it sees in a system. By default systems will get a "blank"
+configuration file with a comment in it explaining what it is used
+for. There is also a one-time "populate" service that will run and
+add any devices it sees into the devices file. This will serve to
+import existing devices on upgrading systems or new systems with
+pre-existing LVM devices attached. See the tracker issue [1] for more
+information.
+
+[1] https://github.com/coreos/fedora-coreos-tracker/issues/1517
diff --git a/tests/kola/binfmt/qemu b/tests/kola/binfmt/qemu
index 3b736e3921..f28a2229c7 100755
--- a/tests/kola/binfmt/qemu
+++ b/tests/kola/binfmt/qemu
@@ -15,7 +15,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 case "$(arch)" in
     aarch64|ppc64le|s390x)
diff --git a/tests/kola/boot/bootupd b/tests/kola/boot/bootupd
index 1c8aee58cb..ea4f948b1e 100755
--- a/tests/kola/boot/bootupd
+++ b/tests/kola/boot/bootupd
@@ -9,7 +9,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 case "$(arch)" in
     x86_64|aarch64)
diff --git a/tests/kola/boot/grub2-install b/tests/kola/boot/grub2-install
index b415dae14b..6064c46ec5 100755
--- a/tests/kola/boot/grub2-install
+++ b/tests/kola/boot/grub2-install
@@ -13,7 +13,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 boot_dev=/boot
 arch=$(arch)
@@ -34,7 +35,7 @@ case ${arch} in
     device=$(realpath /dev/disk/by-partlabel/PowerPC-PReP-boot)
     # sync grub2-install parameter according to image build script
     # https://github.com/coreos/coreos-assembler/blob/main/src/create_disk.sh
-    grub_install_args="--no-nvram"   
+    grub_install_args="--no-nvram"
     ;;
 
   *)
diff --git a/tests/kola/butane/grub-users/test.sh b/tests/kola/butane/grub-users/test.sh
index 4691bad8cc..beb28f8de4 100755
--- a/tests/kola/butane/grub-users/test.sh
+++ b/tests/kola/butane/grub-users/test.sh
@@ -10,7 +10,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 case "${AUTOPKGTEST_REBOOT_MARK:-}" in
 "")
diff --git a/tests/kola/clhm/ignition-warnings/test.sh b/tests/kola/clhm/ignition-warnings/test.sh
index 761ec2df4b..74b22eddd1 100755
--- a/tests/kola/clhm/ignition-warnings/test.sh
+++ b/tests/kola/clhm/ignition-warnings/test.sh
@@ -8,7 +8,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 WARN='\e\[0;33m' # yellow
 RESET='\e\[0m' # reset
diff --git a/tests/kola/clhm/network-device-info b/tests/kola/clhm/network-device-info
index 2e6e03450e..a89ad8346f 100755
--- a/tests/kola/clhm/network-device-info
+++ b/tests/kola/clhm/network-device-info
@@ -8,7 +8,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 for file in /etc/issue.d/22*.issue
 do
diff --git a/tests/kola/containers/cgroups-v2 b/tests/kola/containers/cgroups-v2
index a1b1490dba..292d0a038b 100755
--- a/tests/kola/containers/cgroups-v2
+++ b/tests/kola/containers/cgroups-v2
@@ -9,7 +9,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # make sure the system is on cgroups v2
 has_cgroup_karg=1
diff --git a/tests/kola/containers/quadlet/test.sh b/tests/kola/containers/quadlet/test.sh
index 50ad787fe3..966f26bc89 100755
--- a/tests/kola/containers/quadlet/test.sh
+++ b/tests/kola/containers/quadlet/test.sh
@@ -6,7 +6,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if [[ "$(podman volume inspect systemd-test | jq -r '.[0].Labels."org.test.Key"')" != "quadlet-test-volume" ]]; then
     fatal "Volume not correctly created"
diff --git a/tests/kola/content-origins/test.sh b/tests/kola/content-origins/test.sh
index 43246eb4a4..ea3dd9f3c5 100755
--- a/tests/kola/content-origins/test.sh
+++ b/tests/kola/content-origins/test.sh
@@ -5,12 +5,13 @@
 ##   exclusive: false
 ##   # May support e.g. centos in the future
 ##   distros: "fcos rhcos"
-##   description: Verify the RPM %{vendor} flag for everything installed 
+##   description: Verify the RPM %{vendor} flag for everything installed
 ##     matches what we expect.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 . /usr/lib/os-release
 
diff --git a/tests/kola/data/commonlib.sh b/tests/kola/data/commonlib.sh
index 006bbfdc98..79166f9977 100644
--- a/tests/kola/data/commonlib.sh
+++ b/tests/kola/data/commonlib.sh
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 # This is a common library created for the ok & fatal function and symlinks
 # added to the data/ in each directory
 
@@ -12,12 +13,13 @@ fatal() {
 
 get_ipv4_for_nic() {
     local nic_name=$1
-    local ip=$(ip -j addr show ${nic_name} | jq -r '.[0].addr_info | map(select(.family == "inet")) | .[0].local')
+    local ip
+    ip="$(ip -j addr show "${nic_name}" | jq -r '.[0].addr_info | map(select(.family == "inet")) | .[0].local')"
     if [ -z "$ip" ]; then
         echo "Error: can not get ip for ${nic_name}"
         exit 1
     fi
-    echo $ip
+    echo "$ip"
 }
 
 get_fcos_stream() {
@@ -65,7 +67,7 @@ is_scos() {
     [ "${ID}" == "scos" ] && [ "${VARIANT_ID}" == "coreos" ]
 }
 
-cmdline=( $(</proc/cmdline) )
+IFS=" " read -r -a cmdline <<< "$(</proc/cmdline)"
 cmdline_arg() {
     local name="$1" value=""
     for arg in "${cmdline[@]}"; do
@@ -79,8 +81,8 @@ cmdline_arg() {
 # wait for ~60s when in activating status
 is_service_active() {
     local service="$1"
-    for x in {0..60}; do
-        [ $(systemctl is-active "${service}") != "activating" ] && break
+    for _x in {0..60}; do
+        [ "$(systemctl is-active "${service}")" != "activating" ] && break
         sleep 1
     done
     # return actual result
@@ -95,22 +97,23 @@ vereq() {
 
 # Returns true iff $1 is less than $2
 verlt() {
-    vereq $1 $2 && return 1
-    local lowest="$(echo -e "$1\n$2" | sort -V | head -n 1)"
+    vereq "$1" "$2" && return 1
+    local lowest
+    lowest="$(echo -e "$1\n$2" | sort -V | head -n 1)"
     [ "$1" == "$lowest" ]
 }
 
 # Returns true iff $1 is less than or equal to $2
 verlte() {
-    vereq $1 $2 || verlt $1 $2
+    vereq "$1" "$2" || verlt "$1" "$2"
 }
 
 # Returns true iff $1 is greater than to $2
 vergt() {
-    ! verlte $1 $2
+    ! verlte "$1" "$2"
 }
 
 # Returns true iff $1 is greater than or equal to $2
 vergte() {
-    vereq $1 $2 || vergt $1 $2
+    vereq "$1" "$2" || vergt "$1" "$2"
 }
diff --git a/tests/kola/disks/growfs b/tests/kola/disks/growfs
index 875cc5d462..fd88336377 100755
--- a/tests/kola/disks/growfs
+++ b/tests/kola/disks/growfs
@@ -1,12 +1,13 @@
 #!/bin/bash
 ## kola:
 ##   exclusive: false
-##   description: Verify that the rootfs is automatically grown on first 
+##   description: Verify that the rootfs is automatically grown on first
 ##     boot by default and that the autosave-xfs logic didn't kick in.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if [ ! -f /run/ignition-ostree-growfs.stamp ]; then
     fatal "rootfs was not grown on first boot"
diff --git a/tests/kola/disks/lvmdevices b/tests/kola/disks/lvmdevices
new file mode 100755
index 0000000000..b651affa87
--- /dev/null
+++ b/tests/kola/disks/lvmdevices
@@ -0,0 +1,65 @@
+#!/bin/bash
+## kola:
+##   description: Verify LVM devices file handling works as expected.
+##                This test is meant to cover coreos-populate-lvmdevices.service.
+##   # additionalDisks is only supported on qemu.
+##   platforms: qemu
+##   # A few extra disks to set up LVM on.
+##   additionalDisks: ["1G", "2G"]
+
+set -xeuo pipefail
+
+. $KOLA_EXT_DATA/commonlib.sh
+
+LVMDEVICESFILENAME="system.devices"
+LVMDEVICESFILE="/etc/lvm/devices/${LVMDEVICESFILENAME}"
+
+# Check that coreos-populate-lvmdevices did run
+if [ ! -e /var/lib/coreos-populate-lvmdevices.stamp ]; then
+  fatal "coreos-populate-lvmdevices didn't run"
+fi
+
+case "${AUTOPKGTEST_REBOOT_MARK:-}" in
+  "")
+      # Verify the lvmdevices file by default matches what was shipped.
+      if ! diff -u "/usr/${LVMDEVICESFILE}" "${LVMDEVICESFILE}"; then
+          fatal "Detected modified $LVMDEVICESFILE file."
+      fi
+
+      # Set up LVM on the two disks and set up a vg/lv/fs/mount on one
+      # of them. Specify a blank devicesfile so the *create commands
+      # won't touch our devices file.
+      pvcreate --devicesfile="" /dev/vda /dev/vdb
+      vgcreate --devicesfile="" vg1 /dev/vda
+      lvcreate --devicesfile="" vg1 --name=lv1 -l 100%FREE
+      mkfs.ext4 /dev/vg1/lv1
+      echo "/dev/vg1/lv1 /srv/ ext4 defaults 0 2" >> /etc/fstab
+
+      # Remove the stamp file to force the "migration" to happen on
+      # next boot.
+      rm -f /var/lib/coreos-populate-lvmdevices.stamp
+
+      # reboot to simulate running migration for first time on a
+      # system with pre-existing LVM devices
+      /tmp/autopkgtest-reboot rebooted
+      ;;
+
+  rebooted)
+      # Check that the devices are in the devices file.
+      grep -q 'DEVNAME=/dev/vda' "$LVMDEVICESFILE" || fatal "Missing vda in devices file"
+      grep -q 'DEVNAME=/dev/vdb' "$LVMDEVICESFILE" || fatal "Missing vdb in devices file"
+
+      # Check that we can see the PVs
+      if [ "$(pvs --noheadings | wc -l)" != '2' ]; then
+        fatal "Incorrect number of LVM PVs detected"
+      fi
+
+      # Check that /srv/ is a mountpoint
+      if ! mountpoint /srv; then
+        fatal "/srv/ is not mounted, but it should be"
+      fi
+
+      ok "LVM Devices file populated correctly"
+      ;;
+  *) fatal "unexpected mark: ${AUTOPKGTEST_REBOOT_MARK}";;
+esac
diff --git a/tests/kola/disks/no-google-device-links b/tests/kola/disks/no-google-device-links
index f31e5f299d..9ed282ba11 100755
--- a/tests/kola/disks/no-google-device-links
+++ b/tests/kola/disks/no-google-device-links
@@ -8,7 +8,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 links=$(find /dev/disk/by-id/ -iname "*google*")
 if [[ -n "${links:-}" ]]; then
diff --git a/tests/kola/disks/root-boot-ro b/tests/kola/disks/root-boot-ro
index 1f85d77aae..c197b804b9 100755
--- a/tests/kola/disks/root-boot-ro
+++ b/tests/kola/disks/root-boot-ro
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 for part in /sysroot /boot; do
     if ! findmnt -n -o options ${part} | grep -q "ro,"; then
diff --git a/tests/kola/disks/root-prjquota b/tests/kola/disks/root-prjquota
index f197b5e77a..1da66d491e 100755
--- a/tests/kola/disks/root-prjquota
+++ b/tests/kola/disks/root-prjquota
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 rootflags=$(findmnt /sysroot -no OPTIONS)
 if ! grep prjquota <<< "${rootflags}"; then
diff --git a/tests/kola/disks/systemd-repart-service b/tests/kola/disks/systemd-repart-service
index 4ac5dab6dd..527fdd2a81 100755
--- a/tests/kola/disks/systemd-repart-service
+++ b/tests/kola/disks/systemd-repart-service
@@ -7,7 +7,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if [ "$(systemctl is-enabled systemd-repart.service)" != 'masked' ]; then
     fatal "systemd-repart.service systemd unit should be masked"
diff --git a/tests/kola/disks/tmpfs b/tests/kola/disks/tmpfs
index bf1669db6f..370810660c 100755
--- a/tests/kola/disks/tmpfs
+++ b/tests/kola/disks/tmpfs
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 tmpfs=$(findmnt -n -o FSTYPE /tmp)
 if [ "${tmpfs}" != "tmpfs" ]; then
diff --git a/tests/kola/extensions/package b/tests/kola/extensions/package
index 48cc995fbb..92539d8ac5 100755
--- a/tests/kola/extensions/package
+++ b/tests/kola/extensions/package
@@ -11,7 +11,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 commands=(
   'gdb'
diff --git a/tests/kola/files/aleph-version b/tests/kola/files/aleph-version
index de44b7f2fc..acea887355 100755
--- a/tests/kola/files/aleph-version
+++ b/tests/kola/files/aleph-version
@@ -7,7 +7,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 jq . < /sysroot/.coreos-aleph-version.json >/dev/null
 ok aleph
diff --git a/tests/kola/files/check-symlink b/tests/kola/files/check-symlink
index 32959af1a3..abe044180f 100755
--- a/tests/kola/files/check-symlink
+++ b/tests/kola/files/check-symlink
@@ -9,7 +9,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 for file_name in /etc/system-release-cpe /etc/system-release /etc/redhat-release /etc/os-release
 do
diff --git a/tests/kola/files/console-config b/tests/kola/files/console-config
index 87d1fcaa67..95c66c70e4 100755
--- a/tests/kola/files/console-config
+++ b/tests/kola/files/console-config
@@ -5,15 +5,16 @@
 ##   # s390x doesn't have any configuration in platforms.yaml, so
 ##   # platforms.json is not included in the image
 ##   architectures: "! s390x"
-##   description: Verify that the kargs and grub.cfg commands specified in 
-##     platforms.json have been properly applied to the image. 
+##   description: Verify that the kargs and grub.cfg commands specified in
+##     platforms.json have been properly applied to the image.
 
-# Also check cosa correctly translated platforms.yaml to platforms.json, by 
+# Also check cosa correctly translated platforms.yaml to platforms.json, by
 # spot-checking certain expected values in platforms.json.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 platform_json_kargs() {
     jq -r ".$1.kernel_arguments // [] | join(\" \")" < /boot/coreos/platforms.json
diff --git a/tests/kola/files/etc-passwd-group-permissions b/tests/kola/files/etc-passwd-group-permissions
index 6b2918ffbe..5eb98363a8 100755
--- a/tests/kola/files/etc-passwd-group-permissions
+++ b/tests/kola/files/etc-passwd-group-permissions
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 for f in '/etc/passwd' '/etc/group'; do
     if [[ $(stat --format="%a %u %g" "${f}") != "644 0 0" ]]; then
diff --git a/tests/kola/files/file-directory-permissions b/tests/kola/files/file-directory-permissions
index e985c48a6c..b10c8fb329 100755
--- a/tests/kola/files/file-directory-permissions
+++ b/tests/kola/files/file-directory-permissions
@@ -1,12 +1,13 @@
 #!/bin/bash
 ## kola:
 ##   exclusive: false
-##   description: Verify that there are no files and directories 
+##   description: Verify that there are no files and directories
 ##     with 'g+w' or 'o+w' permission in /etc, except the known lists.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # List of known files and directories with group write permission
 list_known=()
diff --git a/tests/kola/files/fwupd-refresh-timer b/tests/kola/files/fwupd-refresh-timer
new file mode 100755
index 0000000000..3624e539d8
--- /dev/null
+++ b/tests/kola/files/fwupd-refresh-timer
@@ -0,0 +1,23 @@
+#!/bin/bash
+## kola:
+##   exclusive: false
+##   description: Verify fwupd-refresh.timer is enabled.
+##   tags: "platform-independent"
+##   # This test only runs on FCOS as we only enable the timer there
+##   distros: fcos
+
+set -xeuo pipefail
+
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
+
+if verlt "$(get_fedora_ver)" 39; then
+    ok "Skipping fwupd-refresh.timer test"
+    exit 0
+fi
+
+unit="fwupd-refresh.timer"
+if ! systemctl is-enabled ${unit} 1>/dev/null; then
+    fatal "Unit ${unit} should be enabled"
+fi
+ok "Unit ${unit} is enabled as expected"
diff --git a/tests/kola/files/initrd/compression b/tests/kola/files/initrd/compression
index 37821ecc6f..4a46680305 100755
--- a/tests/kola/files/initrd/compression
+++ b/tests/kola/files/initrd/compression
@@ -8,7 +8,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Check initrd for zstd magic number
 if is_rhcos8; then
diff --git a/tests/kola/files/initrd/executables b/tests/kola/files/initrd/executables
index 29954b00df..9d4a0ce317 100755
--- a/tests/kola/files/initrd/executables
+++ b/tests/kola/files/initrd/executables
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 tmpd=$(mktemp -d)
 ( cd "${tmpd}" && lsinitrd --unpack /boot/ostree/*/init* )
diff --git a/tests/kola/files/initrd/expected-contents b/tests/kola/files/initrd/expected-contents
index f45bec7b6a..6db63a18a9 100755
--- a/tests/kola/files/initrd/expected-contents
+++ b/tests/kola/files/initrd/expected-contents
@@ -13,7 +13,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 required_initrd_files=(
     # Files from the 25azure-udev-rules overlay
diff --git a/tests/kola/files/kernel-headers b/tests/kola/files/kernel-headers
index c6396eafb4..fb4114c070 100755
--- a/tests/kola/files/kernel-headers
+++ b/tests/kola/files/kernel-headers
@@ -9,7 +9,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if test -d /usr/include/linux; then
    fatal "Error: should not have kernel headers on host"
diff --git a/tests/kola/files/license b/tests/kola/files/license
index 1b438ad275..4722f541a2 100755
--- a/tests/kola/files/license
+++ b/tests/kola/files/license
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! test -f /usr/share/licenses/fedora-coreos-config/LICENSE; then
     fatal missing LICENSE
diff --git a/tests/kola/files/logrotate-service b/tests/kola/files/logrotate-service
index ce1b7f694d..7f8273be8f 100755
--- a/tests/kola/files/logrotate-service
+++ b/tests/kola/files/logrotate-service
@@ -2,10 +2,12 @@
 ## kola:
 ##   exclusive: false
 ##   description: Verify logrotate and logrotate.timer services are enabled.
+##   tags: "platform-independent"
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 for unit in logrotate logrotate.timer; do
     if ! systemctl is-enabled ${unit} 1>/dev/null; then
diff --git a/tests/kola/files/remove-manifest-files b/tests/kola/files/remove-manifest-files
index 4e64921b39..c4dc186814 100755
--- a/tests/kola/files/remove-manifest-files
+++ b/tests/kola/files/remove-manifest-files
@@ -9,7 +9,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # See remove-files in the manifest
 if test -d /usr/share/info; then
diff --git a/tests/kola/files/root-bash b/tests/kola/files/root-bash
new file mode 100755
index 0000000000..94caff2e6f
--- /dev/null
+++ b/tests/kola/files/root-bash
@@ -0,0 +1,17 @@
+#!/bin/bash
+## kola:
+##   exclusive: false
+##   description: Verify /var/roothome/.bash* files exist.
+
+# See https://bugzilla.redhat.com/show_bug.cgi?id=1193590
+set -xeuo pipefail
+
+. $KOLA_EXT_DATA/commonlib.sh
+
+for bashfile in .bashrc .bash_profile .bash_logout
+do
+    if ! test -f "/var/roothome/${bashfile}"; then
+        fatal "Error: could not find /var/roothome/${bashfile}"
+    fi
+done
+ok "have /var/roothome/.bash* files"
diff --git a/tests/kola/files/root-immutable-bit b/tests/kola/files/root-immutable-bit
index 7b24cdd22a..5884b9daf7 100755
--- a/tests/kola/files/root-immutable-bit
+++ b/tests/kola/files/root-immutable-bit
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! lsattr -d / | grep -qe '--i--'; then
     fatal "missing immutable bit on /"
diff --git a/tests/kola/files/rpmdb-sqlite b/tests/kola/files/rpmdb-sqlite
index 39cb9a91bb..dfacf784e6 100755
--- a/tests/kola/files/rpmdb-sqlite
+++ b/tests/kola/files/rpmdb-sqlite
@@ -9,7 +9,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if is_rhcos8; then
     ok "nothing to check for RHCOS 8"
diff --git a/tests/kola/files/setgid b/tests/kola/files/setgid
index beb9e3f20a..0dd9259e1c 100755
--- a/tests/kola/files/setgid
+++ b/tests/kola/files/setgid
@@ -1,12 +1,13 @@
 #!/bin/bash
 ## kola:
 ##   exclusive: false
-##   description: Verify that there are no file/directory with 
+##   description: Verify that there are no file/directory with
 ##     SetGID bit set, except the known files and directories.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # List of known files and directories with SetGID bit set
 # Drop '/usr/libexec/openssh/ssh-keysign' after
diff --git a/tests/kola/files/setuid b/tests/kola/files/setuid
index d30d367446..3b4d01e6cc 100755
--- a/tests/kola/files/setuid
+++ b/tests/kola/files/setuid
@@ -1,12 +1,13 @@
 #!/bin/bash
 ## kola:
 ##   exclusive: false
-##   description: Verify that there are no file/directory with 
+##   description: Verify that there are no file/directory with
 ##     SetUID bit set, except the known files and directories.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # List of known files and directories with SetUID bit set
 list_setuid_files=(
diff --git a/tests/kola/files/sudoers b/tests/kola/files/sudoers
index edab075b45..ac15f14e3e 100755
--- a/tests/kola/files/sudoers
+++ b/tests/kola/files/sudoers
@@ -1,14 +1,15 @@
 #!/bin/bash
 ## kola:
 ##   exclusive: false
-##   description: Verify the permissions and syntax of /etc/sudoers 
+##   description: Verify the permissions and syntax of /etc/sudoers
 ##     and /etc/sudoers.d/* are readable only for root.
 
 # See https://bugzilla.redhat.com/show_bug.cgi?id=1981979
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 visudo -c
 ok "sudoers files are valid"
diff --git a/tests/kola/files/system-generators b/tests/kola/files/system-generators
index a1fc4a78ed..a24ab11ebd 100755
--- a/tests/kola/files/system-generators
+++ b/tests/kola/files/system-generators
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 find /usr/lib/systemd/system-generators -type f | while read -r f; do
     mode=$(stat -c '%a' "${f}")
diff --git a/tests/kola/files/unlabeled-contexts b/tests/kola/files/unlabeled-contexts
index 12eb2f2c03..08e7b46c70 100755
--- a/tests/kola/files/unlabeled-contexts
+++ b/tests/kola/files/unlabeled-contexts
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # check that no files are unlabeled
 unlabeled=$(find /var /etc -context '*:unlabeled_t:*')
diff --git a/tests/kola/files/validate-symlinks b/tests/kola/files/validate-symlinks
index 319c994a19..cb73cff08c 100755
--- a/tests/kola/files/validate-symlinks
+++ b/tests/kola/files/validate-symlinks
@@ -3,14 +3,15 @@
 ##   tags: "platform-independent"
 ##   # This is a read-only test that can be run with other tests.
 ##   exclusive: false
-##   description: Verify that there are no broken symlinks in /etc/ and /usr/, 
+##   description: Verify that there are no broken symlinks in /etc/ and /usr/,
 ##     except the known files which require further investigation.
 
 # See https://github.com/coreos/fedora-coreos-config/issues/1782
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # List of known broken symlinks that require further investigation.
 # The sym links in /usr/lib/firmware are often broken and are
diff --git a/tests/kola/files/yum-repo-dir b/tests/kola/files/yum-repo-dir
index 56080d668c..8b8a42f187 100755
--- a/tests/kola/files/yum-repo-dir
+++ b/tests/kola/files/yum-repo-dir
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! test -d /etc/yum.repos.d; then
     fatal "Error: not find /etc/yum.repos.d"
diff --git a/tests/kola/firewall/iptables-legacy/test.sh b/tests/kola/firewall/iptables-legacy/test.sh
index 2df6974d20..1c3055d7b8 100755
--- a/tests/kola/firewall/iptables-legacy/test.sh
+++ b/tests/kola/firewall/iptables-legacy/test.sh
@@ -2,14 +2,15 @@
 ## kola:
 ##   distros: fcos
 ##   exclusive: true
-##   description: Verify that one can configure a node to use the legacy 
-##     iptables backend. 
+##   description: Verify that one can configure a node to use the legacy
+##     iptables backend.
 
 # It is scoped to only FCOS because RHCOS only supports nft.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Make sure we're on legacy iptables
 if ! iptables --version | grep legacy; then
diff --git a/tests/kola/firewall/iptables/test.sh b/tests/kola/firewall/iptables/test.sh
index 3c6838bfc8..75ebb78551 100755
--- a/tests/kola/firewall/iptables/test.sh
+++ b/tests/kola/firewall/iptables/test.sh
@@ -7,7 +7,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! iptables --version | grep nf_tables; then
     iptables --version # output for logs
diff --git a/tests/kola/gshadow b/tests/kola/gshadow
index aa9e613055..d01a304355 100755
--- a/tests/kola/gshadow
+++ b/tests/kola/gshadow
@@ -1,6 +1,6 @@
 #!/bin/bash
 ## kola:
-##   description: Verify that glibc's parsing of /etc/gshadow does 
+##   description: Verify that glibc's parsing of /etc/gshadow does
 ##     not cause systemd-sysusers to segfault on specially constructed lines.
 
 # See https://github.com/coreos/bugs/issues/1394
diff --git a/tests/kola/ignition/delete-config/test.sh b/tests/kola/ignition/delete-config/test.sh
index 3a0d575186..0cd4c1de2b 100755
--- a/tests/kola/ignition/delete-config/test.sh
+++ b/tests/kola/ignition/delete-config/test.sh
@@ -1,28 +1,29 @@
 #!/bin/bash
 ## kola:
 ##   platforms: qemu
-##   description: Verify that we delete userdata from provider after Ignition 
+##   description: Verify that we delete userdata from provider after Ignition
 ##     completes.
 
 # See https://github.com/coreos/ignition/issues/1315
-# There are 2 services: 
-# 1)ignition-delete-config.service, which deletes Ignition 
+# There are 2 services:
+# 1)ignition-delete-config.service, which deletes Ignition
 # configs from VMware and VirtualBox on first boot.
-# 2)coreos-ignition-delete-config.service, do the same thing 
-# on existing machines on upgrade, using a stamp file in /var/lib 
+# 2)coreos-ignition-delete-config.service, do the same thing
+# on existing machines on upgrade, using a stamp file in /var/lib
 # to avoid multiple runs.
 # Ideally we'd test on virtualbox and vmware, but we don't have tests
 # there, so we mock specifically for ignition.platform.id=qemu.
 # Test scenarios:
-# On first boot, verify that both 2 services ran. 
+# On first boot, verify that both 2 services ran.
 # On upgrade boot, verify that 1) should not run, 2) should run.
 # On normal boot, verify that both 2 services should not run.
-# On upgrade boot with 2) masked, verify that both 2 services 
+# On upgrade boot with 2) masked, verify that both 2 services
 # should not run.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 case "${AUTOPKGTEST_REBOOT_MARK:-}" in
 "")
diff --git a/tests/kola/ignition/journald-log b/tests/kola/ignition/journald-log
index 5dde2d88e9..0a98841229 100755
--- a/tests/kola/ignition/journald-log
+++ b/tests/kola/ignition/journald-log
@@ -1,14 +1,15 @@
 #!/bin/bash
 ## kola:
 ##   exclusive: false
-##   description: Verify that we send the journald log entry for a 
+##   description: Verify that we send the journald log entry for a
 ##     user-provided config.
 
 # See https://github.com/coreos/ignition/pull/958 for the MESSAGE_ID source.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 ignitionJournalMsgId="57124006b5c94805b77ce473e92a8aeb"
 
diff --git a/tests/kola/ignition/kargs/test.sh b/tests/kola/ignition/kargs/test.sh
index 669c556ad4..c29b1f1c7e 100755
--- a/tests/kola/ignition/kargs/test.sh
+++ b/tests/kola/ignition/kargs/test.sh
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! grep foobar /proc/cmdline; then
     fatal "missing foobar in kernel cmdline"
diff --git a/tests/kola/ignition/remote/test.sh b/tests/kola/ignition/remote/test.sh
index 0985684ed9..6b2fa6a07c 100755
--- a/tests/kola/ignition/remote/test.sh
+++ b/tests/kola/ignition/remote/test.sh
@@ -4,14 +4,15 @@
 ##   description: Verify Ignition supports remote config.
 
 # See https://bugzilla.redhat.com/show_bug.cgi?id=1980679
-# remote.ign is on github, inject kernelArguments and write 
+# remote.ign is on github, inject kernelArguments and write
 # something to /etc/testfile.
 # config.ign is to include remote kargsfile.ign.
 
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! grep -q foobar /proc/cmdline; then
     fatal "missing foobar in kernel cmdline"
diff --git a/tests/kola/ignition/resource/authenticated-gs/test.sh b/tests/kola/ignition/resource/authenticated-gs/test.sh
index 058cc59f5f..8f39c30b05 100755
--- a/tests/kola/ignition/resource/authenticated-gs/test.sh
+++ b/tests/kola/ignition/resource/authenticated-gs/test.sh
@@ -7,7 +7,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! diff -rZ $KOLA_EXT_DATA/expected /var/resource; then
     fatal "fetched data mismatch"
diff --git a/tests/kola/ignition/resource/authenticated-s3/test.sh b/tests/kola/ignition/resource/authenticated-s3/test.sh
index e79dd6ef64..e7ab36b9d2 100755
--- a/tests/kola/ignition/resource/authenticated-s3/test.sh
+++ b/tests/kola/ignition/resource/authenticated-s3/test.sh
@@ -7,7 +7,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! diff -rZ $KOLA_EXT_DATA/expected /var/resource; then
     fatal "fetched data mismatch"
diff --git a/tests/kola/ignition/resource/remote/test.sh b/tests/kola/ignition/resource/remote/test.sh
index b720aac145..21df7c9df4 100755
--- a/tests/kola/ignition/resource/remote/test.sh
+++ b/tests/kola/ignition/resource/remote/test.sh
@@ -3,12 +3,13 @@
 ##   tags: needs-internet
 ##   # Don't pass AWS or GCP credentials to instance
 ##   noInstanceCreds: true
-##   description: Verify that Ignition can fetch anonymous resources within a 
+##   description: Verify that Ignition can fetch anonymous resources within a
 ##     cloud platform (S3 -> AWS, GCS -> GCP) when no credentials are supplied.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! diff -rZ $KOLA_EXT_DATA/expected /var/resource; then
     fatal "fetched data mismatch"
diff --git a/tests/kola/ignition/stable-boot/test.sh b/tests/kola/ignition/stable-boot/test.sh
index c9aeba1ca4..3916ef99d3 100755
--- a/tests/kola/ignition/stable-boot/test.sh
+++ b/tests/kola/ignition/stable-boot/test.sh
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # symlink shouldn't be propogated to real-root
 link="/dev/disk/by-id/coreos-boot-disk"
diff --git a/tests/kola/ignition/systemd-disable/test.sh b/tests/kola/ignition/systemd-disable/test.sh
index ad79d94892..7a1c2c4711 100755
--- a/tests/kola/ignition/systemd-disable/test.sh
+++ b/tests/kola/ignition/systemd-disable/test.sh
@@ -11,7 +11,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if [ "$(systemctl is-enabled zincati.service)" != 'disabled' ]; then
     fatal "zincati.service systemd unit should be disabled"
diff --git a/tests/kola/ignition/systemd-enable-units/test.sh b/tests/kola/ignition/systemd-enable-units/test.sh
index c8757f070f..31c6a63a7b 100755
--- a/tests/kola/ignition/systemd-enable-units/test.sh
+++ b/tests/kola/ignition/systemd-enable-units/test.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 ## kola:
 ##   tags: "platform-independent"
-##   description: Verify that Ignition supports to enable systemd units 
+##   description: Verify that Ignition supports to enable systemd units
 ##     of different types.
 
 # See
@@ -10,7 +10,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # make sure the presets worked and the instantiated unit is enabled
 if [ "$(systemctl is-enabled touch@foo.service)" != 'enabled' ]; then
diff --git a/tests/kola/ignition/systemd-unmasking/test.sh b/tests/kola/ignition/systemd-unmasking/test.sh
index d16fae7ee1..e600060e10 100755
--- a/tests/kola/ignition/systemd-unmasking/test.sh
+++ b/tests/kola/ignition/systemd-unmasking/test.sh
@@ -9,7 +9,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Make sure the systemd unit (dnsmasq) is unmasked and enabled
 if [ "$(systemctl is-enabled dnsmasq.service)" != 'enabled' ]; then
diff --git a/tests/kola/k8s/node-e2e/data/node-e2e b/tests/kola/k8s/node-e2e/data/node-e2e
index ee759a7cea..580c73a57b 100755
--- a/tests/kola/k8s/node-e2e/data/node-e2e
+++ b/tests/kola/k8s/node-e2e/data/node-e2e
@@ -3,7 +3,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 SELF=$(realpath "$0")
 IMAGE=quay.io/projectquay/golang:1.17
diff --git a/tests/kola/k8s/node-e2e/master b/tests/kola/k8s/node-e2e/master
index feeb393102..ec2dd3baa2 100755
--- a/tests/kola/k8s/node-e2e/master
+++ b/tests/kola/k8s/node-e2e/master
@@ -7,7 +7,7 @@
 ##   architectures: x86_64
 ##   requiredTag: k8s
 ##   tags: needs-internet
-##   description: Verify the Kubernetes e2e node tests work, and 
+##   description: Verify the Kubernetes e2e node tests work, and
 ##     ensure that we don't inadvertedly break Kubernetes.
 
 set -xeuo pipefail
diff --git a/tests/kola/kdump/crash/test.sh b/tests/kola/kdump/crash/test.sh
index b33b2b68cf..4989cc037d 100755
--- a/tests/kola/kdump/crash/test.sh
+++ b/tests/kola/kdump/crash/test.sh
@@ -14,7 +14,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 case "${AUTOPKGTEST_REBOOT_MARK:-}" in
   "")
diff --git a/tests/kola/kdump/service b/tests/kola/kdump/service
index fdffe9fc04..f6893b06b9 100755
--- a/tests/kola/kdump/service
+++ b/tests/kola/kdump/service
@@ -3,12 +3,13 @@
 ##   exclusive: false
 ##   description: Verify that kdump didn't start by default.
 
-# It's either disabled, or enabled but conditional on crashkernel= karg, 
+# It's either disabled, or enabled but conditional on crashkernel= karg,
 # which we don't bake.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! systemctl show -p ActiveState kdump.service | grep -q ActiveState=inactive; then
     fatal "Unit kdump.service shouldn't be active"
diff --git a/tests/kola/kubernetes/kube-watch/test.sh b/tests/kola/kubernetes/kube-watch/test.sh
index bfefa7f3b5..eb29e3b018 100755
--- a/tests/kola/kubernetes/kube-watch/test.sh
+++ b/tests/kola/kubernetes/kube-watch/test.sh
@@ -10,7 +10,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if [ "$(systemctl is-active kube-watch.path)" != "active" ]; then
     fatal "kube-watch.path did not activate successfully"
diff --git a/tests/kola/kubernetes/systemd-env-read/test.sh b/tests/kola/kubernetes/systemd-env-read/test.sh
index 0658064b5c..849177dd77 100755
--- a/tests/kola/kubernetes/systemd-env-read/test.sh
+++ b/tests/kola/kubernetes/systemd-env-read/test.sh
@@ -1,15 +1,16 @@
 #!/bin/bash
 ## kola:
 ##   exclusive: false
-##   description: Verify that `kubernetes_file_t` labeled files can be read 
-##     by systemd, also verify the `kube-env` service started successfully  
+##   description: Verify that `kubernetes_file_t` labeled files can be read
+##     by systemd, also verify the `kube-env` service started successfully
 ##     and the service wrote to the journal successfully.
 
 # See https://bugzilla.redhat.com/show_bug.cgi?id=1973418
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if [ "$( stat -c %C /etc/kubernetes/envfile)" != "system_u:object_r:kubernetes_file_t:s0" ]; then
     fatal "/etc/kubernetes/envfile is labeled incorrectly"
diff --git a/tests/kola/logging/printk b/tests/kola/logging/printk
index 4e6098a5c7..cd9e126d39 100755
--- a/tests/kola/logging/printk
+++ b/tests/kola/logging/printk
@@ -7,7 +7,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 printk=$(cat /proc/sys/kernel/printk)
 
diff --git a/tests/kola/networking/bridge-static-via-kargs b/tests/kola/networking/bridge-static-via-kargs
index 75de9d04b5..478d7639bd 100755
--- a/tests/kola/networking/bridge-static-via-kargs
+++ b/tests/kola/networking/bridge-static-via-kargs
@@ -13,7 +13,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 bridge="br0"
 
diff --git a/tests/kola/networking/default-network-behavior-change/test.sh b/tests/kola/networking/default-network-behavior-change/test.sh
index db29662f2b..0ff17a645d 100755
--- a/tests/kola/networking/default-network-behavior-change/test.sh
+++ b/tests/kola/networking/default-network-behavior-change/test.sh
@@ -2,7 +2,7 @@
 ## kola:
 ##   tags: "platform-independent"
 ##   exclusive: false
-##   description: Verify the default networking configurations match expected 
+##   description: Verify the default networking configurations match expected
 ##     results.
 #
 # Since we depend so much on the default networking configurations let's
@@ -13,7 +13,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # EXPECTED_INITRD_NETWORK_CFG2
 #   - used on older RHEL 8.4 release
diff --git a/tests/kola/networking/dnsmasq-service b/tests/kola/networking/dnsmasq-service
index eb0369fd38..3700592a60 100755
--- a/tests/kola/networking/dnsmasq-service
+++ b/tests/kola/networking/dnsmasq-service
@@ -11,7 +11,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if [ "$(systemctl is-enabled dnsmasq.service)" != 'masked' ]; then
     fatal "dnsmasq.service systemd unit should be masked"
diff --git a/tests/kola/networking/force-persist-ip/test.sh b/tests/kola/networking/force-persist-ip/test.sh
index c8501d40cd..bdecb10cf8 100755
--- a/tests/kola/networking/force-persist-ip/test.sh
+++ b/tests/kola/networking/force-persist-ip/test.sh
@@ -9,7 +9,7 @@
 ##   # different firmwares (BIOS vs UEFI) the NIC names are different.
 ##   # See https://github.com/coreos/fedora-coreos-tracker/issues/1060
 ##   appendKernelArgs: "ip=10.10.10.10::10.10.10.1:255.255.255.0:myhostname:eth1:none:8.8.8.8 net.ifnames=0 coreos.force_persist_ip"
-##   description: Verify that coreos.force_persist_ip will force propagating 
+##   description: Verify that coreos.force_persist_ip will force propagating
 ##     kernel argument based networking configuration into the real root.
 
 # Setup configuration for a single NIC with two different ways:
@@ -22,7 +22,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Verify eth1 gets staic ip via kargs
 nic_name="eth1"
diff --git a/tests/kola/networking/hostname/fallback-hostname/test.sh b/tests/kola/networking/hostname/fallback-hostname/test.sh
index 563c40ed13..579f32fcb7 100755
--- a/tests/kola/networking/hostname/fallback-hostname/test.sh
+++ b/tests/kola/networking/hostname/fallback-hostname/test.sh
@@ -48,7 +48,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if is_rhcos8; then
     if [ $(hostnamectl --transient) != 'localhost' ]; then
diff --git a/tests/kola/networking/ifname-karg/data/ifname-karg-lib.sh b/tests/kola/networking/ifname-karg/data/ifname-karg-lib.sh
index 8b6dd2f8dc..b372b968f8 100644
--- a/tests/kola/networking/ifname-karg/data/ifname-karg-lib.sh
+++ b/tests/kola/networking/ifname-karg/data/ifname-karg-lib.sh
@@ -1,6 +1,7 @@
 # This is a library created for our ifname-karg tests
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # check IP for given NIC name
 check_ip() {
diff --git a/tests/kola/networking/ifname-karg/everyboot-systemd-link-file/test.sh b/tests/kola/networking/ifname-karg/everyboot-systemd-link-file/test.sh
index 0017eef53c..26b2c85e30 100755
--- a/tests/kola/networking/ifname-karg/everyboot-systemd-link-file/test.sh
+++ b/tests/kola/networking/ifname-karg/everyboot-systemd-link-file/test.sh
@@ -10,14 +10,15 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 . $KOLA_EXT_DATA/ifname-karg-lib.sh
 
 nicname='kolatest'
 
 run_tests() {
     # Make sure nothing was persisted from the initramfs
-    check_file_not_exists '/etc/udev/rules.d/80-ifname.rules' 
+    check_file_not_exists '/etc/udev/rules.d/80-ifname.rules'
     # Make sure systemd-network-generator ran (from the real root)
     check_file_exists "/run/systemd/network/90-${nicname}.link"
     # Make sure the NIC is in use and got the expected IP address
diff --git a/tests/kola/networking/ifname-karg/udev-rule-firstboot-propagation b/tests/kola/networking/ifname-karg/udev-rule-firstboot-propagation
index 4a2d755ab2..52350b96f6 100755
--- a/tests/kola/networking/ifname-karg/udev-rule-firstboot-propagation
+++ b/tests/kola/networking/ifname-karg/udev-rule-firstboot-propagation
@@ -11,7 +11,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 . $KOLA_EXT_DATA/ifname-karg-lib.sh
 
 nicname='kolatest'
@@ -20,7 +21,7 @@ case "${AUTOPKGTEST_REBOOT_MARK:-}" in
     "")
         ok "first boot"
         # Make sure the rules were persisted from the initramfs
-        check_file_exists '/etc/udev/rules.d/80-ifname.rules' 
+        check_file_exists '/etc/udev/rules.d/80-ifname.rules'
         # On first boot we expect systemd-network-generator to run too
         # because the ifname= karg was present, but only for first boot
         check_file_exists "/run/systemd/network/90-${nicname}.link"
@@ -32,7 +33,7 @@ case "${AUTOPKGTEST_REBOOT_MARK:-}" in
     rebooted)
         ok "second boot"
         # Make sure the rules are still there
-        check_file_exists '/etc/udev/rules.d/80-ifname.rules' 
+        check_file_exists '/etc/udev/rules.d/80-ifname.rules'
         # On second boot the ifname= karg isn't there so the file
         # created by systemd-network-generator shouldn't exist.
         check_file_not_exists "/run/systemd/network/90-${nicname}.link"
diff --git a/tests/kola/networking/kargs-rd-net b/tests/kola/networking/kargs-rd-net
index f055650726..557026c531 100755
--- a/tests/kola/networking/kargs-rd-net
+++ b/tests/kola/networking/kargs-rd-net
@@ -4,7 +4,7 @@
 ##   platforms: qemu
 ##   # The functionality we're testing here.
 ##   appendFirstbootKernelArgs: "rd.net.timeout.dhcp=30 rd.net.dhcp.retry=8"
-##   description: Verify rd.net.timeout.dhcp and rd.net.dhcp.retry 
+##   description: Verify rd.net.timeout.dhcp and rd.net.dhcp.retry
 ##     are supported by NetworkManager.
 
 # See
@@ -12,13 +12,14 @@
 # - https://bugzilla.redhat.com/show_bug.cgi?id=1879094#c10
 # - https://bugzilla.redhat.com/show_bug.cgi?id=1877740
 
-# Append "rd.net.timeout.dhcp=30 rd.net.dhcp.retry=8" to kernel parameter 
+# Append "rd.net.timeout.dhcp=30 rd.net.dhcp.retry=8" to kernel parameter
 # when boot, get total timeout is `timeout * retry`, 30*8(240) seconds
 # in this test scenario.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # check kernel parameter
 cmdline="/proc/cmdline"
diff --git a/tests/kola/networking/mtu-on-bond-ignition/test.sh b/tests/kola/networking/mtu-on-bond-ignition/test.sh
index 6ea2654962..865c59ca7f 100755
--- a/tests/kola/networking/mtu-on-bond-ignition/test.sh
+++ b/tests/kola/networking/mtu-on-bond-ignition/test.sh
@@ -8,7 +8,7 @@
 ##   # different firmwares (BIOS vs UEFI) the NIC names are different.
 ##   # See https://github.com/coreos/fedora-coreos-tracker/issues/1060
 ##   appendKernelArgs: net.ifnames=0
-##   description: Verify that configure MTU on a VLAN subinterface for 
+##   description: Verify that configure MTU on a VLAN subinterface for
 ##     the bond via Ignition works.
 #
 # Set MTU on a VLAN subinterface for the bond using Ignition config and check
@@ -28,7 +28,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 bond="bond0"
 vlan="bond0.100"
diff --git a/tests/kola/networking/mtu-on-bond-kargs b/tests/kola/networking/mtu-on-bond-kargs
index 86004be670..c91f6b76f7 100755
--- a/tests/kola/networking/mtu-on-bond-kargs
+++ b/tests/kola/networking/mtu-on-bond-kargs
@@ -9,7 +9,7 @@
 ##   # different firmwares (BIOS vs UEFI) the NIC names are different.
 ##   # See https://github.com/coreos/fedora-coreos-tracker/issues/1060
 ##   appendKernelArgs: "bond=bond0:eth1,eth2:mode=active-backup,miimon=100:9000 ip=10.10.10.10::10.10.10.1:255.255.255.0:staticvlanbond:bond0.100:none:9000 vlan=bond0.100:bond0 net.ifnames=0"
-##   description: Verify that configuring MTU on a VLAN subinterface 
+##   description: Verify that configuring MTU on a VLAN subinterface
 ##     for the bond via kernel arguements works.
 
 # Configuring MTU on a VLAN subinterface for the bond,
@@ -20,7 +20,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 bond="bond0"
 vlan="bond0.100"
diff --git a/tests/kola/networking/nameserver b/tests/kola/networking/nameserver
index 8eabbebb5a..82f73eb633 100755
--- a/tests/kola/networking/nameserver
+++ b/tests/kola/networking/nameserver
@@ -3,7 +3,7 @@
 ##   # appendKernelArgs is only supported on QEMU
 ##   platforms: qemu
 ##   appendKernelArgs: "nameserver=8.8.8.8 nameserver=1.1.1.1"
-##   description: Verify that we config multiple nameservers via kernel 
+##   description: Verify that we config multiple nameservers via kernel
 ##     arguments work well.
 
 # RHCOS: need to check /etc/resolv.conf and nmconnection.
@@ -12,7 +12,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if is_fcos; then
     # run resolvectl
diff --git a/tests/kola/networking/network-online-service b/tests/kola/networking/network-online-service
index a81d7504e3..a167350993 100755
--- a/tests/kola/networking/network-online-service
+++ b/tests/kola/networking/network-online-service
@@ -7,7 +7,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # We shouldn't pull this into the transaction by default.
 # https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/
diff --git a/tests/kola/networking/nic-naming b/tests/kola/networking/nic-naming
index ccb2b83f45..e1dd12ba6e 100755
--- a/tests/kola/networking/nic-naming
+++ b/tests/kola/networking/nic-naming
@@ -14,7 +14,8 @@
 # - https://github.com/coreos/fedora-coreos-config/commit/2a5c2abc796ac645d705700bf445b50d4cda8f5f
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ip link | grep -o -e " eth[0-9]:"; then
     fatal "detected eth* NIC naming on node"
diff --git a/tests/kola/networking/nm-dhcp-client b/tests/kola/networking/nm-dhcp-client
index 13126c605e..e6b28e56c6 100755
--- a/tests/kola/networking/nm-dhcp-client
+++ b/tests/kola/networking/nm-dhcp-client
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! journalctl -b 0 -u NetworkManager --grep=dhcp | grep -q "Using DHCP client 'internal'"; then
   fatal "Error: NetworkManager's internal DHCP client is not running"
diff --git a/tests/kola/networking/nm-ifcfg-rh-plugin b/tests/kola/networking/nm-ifcfg-rh-plugin
index 93409f25b6..1f71433bd2 100755
--- a/tests/kola/networking/nm-ifcfg-rh-plugin
+++ b/tests/kola/networking/nm-ifcfg-rh-plugin
@@ -9,7 +9,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Check if it exists or not. The plugin provides a dbus interface
 # so if it is loaded there will be something listening at that name
diff --git a/tests/kola/networking/nm-start b/tests/kola/networking/nm-start
index 32131b2003..f78c4489a5 100755
--- a/tests/kola/networking/nm-start
+++ b/tests/kola/networking/nm-start
@@ -1,14 +1,15 @@
 #!/bin/bash
 ## kola:
 ##   exclusive: false
-##   description: Verify kola on QEMU shouldn't bring up networking in the 
+##   description: Verify kola on QEMU shouldn't bring up networking in the
 ##     initrd by default, and on AWS we did bring up networking in the initrd.
 
 # See https://github.com/coreos/fedora-coreos-config/pull/426
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 get_journal_msg_timestamp() {
     journalctl -o json -b 0 --grep "$1" \
diff --git a/tests/kola/networking/nmstate/data/nmstate-common.sh b/tests/kola/networking/nmstate/data/nmstate-common.sh
index ca8293fa8d..7cbf83c993 100755
--- a/tests/kola/networking/nmstate/data/nmstate-common.sh
+++ b/tests/kola/networking/nmstate/data/nmstate-common.sh
@@ -1,20 +1,21 @@
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 main() {
     nmstatectl show
     journalctl -u nmstate
-    
+
     local prefix="first boot"
     if [ "${AUTOPKGTEST_REBOOT_MARK:-}" == rebooted ]; then
         prefix="second boot"
     fi
-    
+
     if ! nmcli c show br-ex; then
         fatal "${prefix}: bridge not configured"
     fi
 
     if ! ls /etc/nmstate/*applied; then
-        fatal "${prefix}: nmstate yamls files not marked as applied"    
+        fatal "${prefix}: nmstate yamls files not marked as applied"
     fi
 
     if [ "${AUTOPKGTEST_REBOOT_MARK:-}" == "" ]; then
diff --git a/tests/kola/networking/nmstate/policy/test.sh b/tests/kola/networking/nmstate/policy/test.sh
index e31fba28b7..2387a688b5 100755
--- a/tests/kola/networking/nmstate/policy/test.sh
+++ b/tests/kola/networking/nmstate/policy/test.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 ## kola:
 ##   tags: "platform-independent needs-internet"
-##   description: Verify that configure a DHCP linux bridge using 
+##   description: Verify that configure a DHCP linux bridge using
 ##     butane and nmstate service with policy works.
 
 # See https://github.com/coreos/fedora-coreos-tracker/issues/1175
diff --git a/tests/kola/networking/nmstate/state/test.sh b/tests/kola/networking/nmstate/state/test.sh
index 8a690b509f..65bcafb40d 100755
--- a/tests/kola/networking/nmstate/state/test.sh
+++ b/tests/kola/networking/nmstate/state/test.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 ## kola:
 ##   tags: "platform-independent needs-internet"
-##   description: Verify that configure a DHCP linux bridge using 
+##   description: Verify that configure a DHCP linux bridge using
 ##     butane and nmstate service with state works.
 
 # See https://github.com/coreos/fedora-coreos-tracker/issues/1175
diff --git a/tests/kola/networking/no-default-initramfs-net-propagation/bootif b/tests/kola/networking/no-default-initramfs-net-propagation/bootif
index 24c1bfb70f..aee002a7c6 100755
--- a/tests/kola/networking/no-default-initramfs-net-propagation/bootif
+++ b/tests/kola/networking/no-default-initramfs-net-propagation/bootif
@@ -16,7 +16,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Run the test bits (sets the $fail var)
 . $KOLA_EXT_DATA/test-net-propagation.sh
diff --git a/tests/kola/networking/no-default-initramfs-net-propagation/default b/tests/kola/networking/no-default-initramfs-net-propagation/default
index 99ede4e4f6..85e722b24c 100755
--- a/tests/kola/networking/no-default-initramfs-net-propagation/default
+++ b/tests/kola/networking/no-default-initramfs-net-propagation/default
@@ -9,7 +9,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Run the test bits (sets the $fail var)
 . $KOLA_EXT_DATA/test-net-propagation.sh
diff --git a/tests/kola/networking/no-persist-ip b/tests/kola/networking/no-persist-ip
index 14766624bf..96822274d4 100755
--- a/tests/kola/networking/no-persist-ip
+++ b/tests/kola/networking/no-persist-ip
@@ -9,16 +9,17 @@
 ##   # different firmwares (BIOS vs UEFI) the NIC names are different.
 ##   # See https://github.com/coreos/fedora-coreos-tracker/issues/1060
 ##   appendKernelArgs: "ip=10.10.10.10::10.10.10.1:255.255.255.0:myhostname:eth1:none net.ifnames=0 coreos.no_persist_ip"
-##   description: Verify that the coreos.no_persist_ip kernel argument will 
-##     prevent propagating kernel argument based networking configuration 
-##     into the real root. 
+##   description: Verify that the coreos.no_persist_ip kernel argument will
+##     prevent propagating kernel argument based networking configuration
+##     into the real root.
 
-# It does this by providing karg static networking config for eth1 and 
+# It does this by providing karg static networking config for eth1 and
 # then verifying that DHCP is used in the real root.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Verify eth1 gets ip address via dhcp
 nic_name="eth1"
diff --git a/tests/kola/networking/prefer-ignition-networking/test.sh b/tests/kola/networking/prefer-ignition-networking/test.sh
index a7acec06eb..025fbd1d37 100755
--- a/tests/kola/networking/prefer-ignition-networking/test.sh
+++ b/tests/kola/networking/prefer-ignition-networking/test.sh
@@ -9,7 +9,7 @@
 ##   # different firmwares (BIOS vs UEFI) the NIC names are different.
 ##   # See https://github.com/coreos/fedora-coreos-tracker/issues/1060
 ##   appendKernelArgs: "ip=10.10.10.10::10.10.10.1:255.255.255.0:myhostname:eth1:none:8.8.8.8 net.ifnames=0"
-##   description: Verify that networking configuration is propagated 
+##   description: Verify that networking configuration is propagated
 ##     via Ignition by default.
 
 # Setup configuration for a single NIC with two different ways:
@@ -22,7 +22,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Verify eth1 gets ip address via dhcp
 nic_name="eth1"
diff --git a/tests/kola/networking/rd-net-timeout-carrier/test.sh b/tests/kola/networking/rd-net-timeout-carrier/test.sh
index cd5f4e3003..163b0c0ce7 100755
--- a/tests/kola/networking/rd-net-timeout-carrier/test.sh
+++ b/tests/kola/networking/rd-net-timeout-carrier/test.sh
@@ -20,7 +20,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 case "${AUTOPKGTEST_REBOOT_MARK:-}" in
   "")
diff --git a/tests/kola/networking/resolv/systemd-resolved b/tests/kola/networking/resolv/systemd-resolved
index c4556f2f1d..36de025c2e 100755
--- a/tests/kola/networking/resolv/systemd-resolved
+++ b/tests/kola/networking/resolv/systemd-resolved
@@ -4,12 +4,13 @@
 ##  # RHCOS
 ##   distros:  fcos
 ##   exclusive: false
-##   description: Verify systemd-resolved and the stub listener 
+##   description: Verify systemd-resolved and the stub listener
 ##     should be enabled by default.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! systemctl is-enabled systemd-resolved 1>/dev/null; then
     fatal "Unit systemd-resolved should be enabled"
diff --git a/tests/kola/networking/team-dhcp-via-ignition/test.sh b/tests/kola/networking/team-dhcp-via-ignition/test.sh
index 4f50f6f111..6d506c23c9 100755
--- a/tests/kola/networking/team-dhcp-via-ignition/test.sh
+++ b/tests/kola/networking/team-dhcp-via-ignition/test.sh
@@ -15,7 +15,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 team="team0"
 
diff --git a/tests/kola/networking/tls b/tests/kola/networking/tls
index b40a48fe2b..ebaff45f1c 100755
--- a/tests/kola/networking/tls
+++ b/tests/kola/networking/tls
@@ -6,7 +6,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 urls_to_fetch=(
     "https://cloud.google.com"
diff --git a/tests/kola/ntp/chrony/coreos-platform-chrony-config b/tests/kola/ntp/chrony/coreos-platform-chrony-config
index 36230c9ef7..d1dc0294eb 100755
--- a/tests/kola/ntp/chrony/coreos-platform-chrony-config
+++ b/tests/kola/ntp/chrony/coreos-platform-chrony-config
@@ -6,7 +6,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 platform=$(cmdline_arg ignition.platform.id)
 case "${platform}" in
diff --git a/tests/kola/ntp/chrony/dhcp-propagation b/tests/kola/ntp/chrony/dhcp-propagation
index 434df712be..fb3d6059aa 100755
--- a/tests/kola/ntp/chrony/dhcp-propagation
+++ b/tests/kola/ntp/chrony/dhcp-propagation
@@ -23,7 +23,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 . $KOLA_EXT_DATA/ntplib.sh
 
 main() {
diff --git a/tests/kola/ntp/data/ntplib.sh b/tests/kola/ntp/data/ntplib.sh
index a8dd540831..4f8e8cff2f 100644
--- a/tests/kola/ntp/data/ntplib.sh
+++ b/tests/kola/ntp/data/ntplib.sh
@@ -1,6 +1,7 @@
 # This is a library created for our NTP tests
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 ntp_test_setup() {
     ntp_host_ip=$1
diff --git a/tests/kola/ntp/timesyncd/dhcp-propagation/test.sh b/tests/kola/ntp/timesyncd/dhcp-propagation/test.sh
index 6324453149..f0baf6b46b 100755
--- a/tests/kola/ntp/timesyncd/dhcp-propagation/test.sh
+++ b/tests/kola/ntp/timesyncd/dhcp-propagation/test.sh
@@ -25,7 +25,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 . $KOLA_EXT_DATA/ntplib.sh
 
 main() {
diff --git a/tests/kola/platforms/aws/assert-xen b/tests/kola/platforms/aws/assert-xen
index 8120944808..3fe55e1150 100755
--- a/tests/kola/platforms/aws/assert-xen
+++ b/tests/kola/platforms/aws/assert-xen
@@ -13,7 +13,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 hypervisor=$(curl http://169.254.169.254/2022-09-24/meta-data/system || true)
 if [ "${hypervisor}" != "xen" ]; then
diff --git a/tests/kola/platforms/aws/nvme b/tests/kola/platforms/aws/nvme
index 7a2253ba94..3415544c63 100755
--- a/tests/kola/platforms/aws/nvme
+++ b/tests/kola/platforms/aws/nvme
@@ -35,7 +35,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 nvme_info=$(nvme list-subsys -o json || true)
 has_nvme=$(jq -r ".[].Subsystems[].Paths[] | select(.Name == \"nvme0\").Name" <<< "$nvme_info")
diff --git a/tests/kola/platforms/gcp/nvme-symlink b/tests/kola/platforms/gcp/nvme-symlink
index a3f3103942..652f477b3f 100755
--- a/tests/kola/platforms/gcp/nvme-symlink
+++ b/tests/kola/platforms/gcp/nvme-symlink
@@ -13,12 +13,13 @@
 # or `--tag confidential` is passed to `kola run`, also requires
 # `--gcp-machinetype n2d-standard-2 --gcp-confidential-vm`
 #
-# It will create confidential instance on GCP with 1 nvme persistent disk 
+# It will create confidential instance on GCP with 1 nvme persistent disk
 # and 1 local ssd disk, then check the new udev rules make effect.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Set global variable with NVME json info
 NVME_INFO=$(nvme list-subsys -o json)
diff --git a/tests/kola/podman/dns/test.sh b/tests/kola/podman/dns/test.sh
index 260ff24f1e..8ad98f8cad 100755
--- a/tests/kola/podman/dns/test.sh
+++ b/tests/kola/podman/dns/test.sh
@@ -8,14 +8,15 @@
 ##   # This test reaches out to the internet and it could take more
 ##   # time to pull down the container.
 ##   timeoutMin: 3
-##   description: Verify that DNS in rootless podman containers can 
+##   description: Verify that DNS in rootless podman containers can
 ##     resolve external domains.
 
 # See https://github.com/coreos/fedora-coreos-tracker/issues/923
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 runascoreuserscript='
 #!/bin/bash
diff --git a/tests/kola/podman/rootless-pasta-networking b/tests/kola/podman/rootless-pasta-networking
index 25e46495f5..8689162e38 100755
--- a/tests/kola/podman/rootless-pasta-networking
+++ b/tests/kola/podman/rootless-pasta-networking
@@ -13,7 +13,9 @@
 # See https://github.com/coreos/fedora-coreos-tracker/issues/1436
 
 set -xeuo pipefail
-. $KOLA_EXT_DATA/commonlib.sh
+
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 runascoreuserscript='#!/bin/bash
 set -euxo pipefail
diff --git a/tests/kola/podman/rootless-systemd b/tests/kola/podman/rootless-systemd
index a6b8ee75be..c5d32976ca 100755
--- a/tests/kola/podman/rootless-systemd
+++ b/tests/kola/podman/rootless-systemd
@@ -21,7 +21,9 @@
 # both on cgroups v1 and cgroups v2.
 
 set -xeuo pipefail
-. $KOLA_EXT_DATA/commonlib.sh
+
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 runascoreuserscript='
 #!/bin/bash
diff --git a/tests/kola/reboot/test.sh b/tests/kola/reboot/test.sh
index a09bcbc731..673e8ec2e3 100755
--- a/tests/kola/reboot/test.sh
+++ b/tests/kola/reboot/test.sh
@@ -1,12 +1,13 @@
 #!/bin/bash
 ## kola:
 ##   platforms: qemu
-##   description: Verify default system configuration are both on first and 
+##   description: Verify default system configuration are both on first and
 ##     subsequent boots.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # /var
 varsrc=$(findmnt -nvr /var -o SOURCE)
diff --git a/tests/kola/root-reprovision/autosave-xfs/test.sh b/tests/kola/root-reprovision/autosave-xfs/test.sh
index a7760e5818..4ac5c12afc 100755
--- a/tests/kola/root-reprovision/autosave-xfs/test.sh
+++ b/tests/kola/root-reprovision/autosave-xfs/test.sh
@@ -2,27 +2,32 @@
 ## kola:
 ##   # This test reprovisions the rootfs automatically.
 ##   tags: "platform-independent reprovision"
-##   # Trigger automatic XFS reprovisioning
-##   minDisk: 100
+##   # Trigger automatic XFS reprovisioning (heuristic)
+##   minDisk: 1000
 ##   # Root reprovisioning requires at least 4GiB of memory.
 ##   minMemory: 4096
 ##   # This test includes a lot of disk I/O and needs a higher
 ##   # timeout value than the default.
 ##   timeoutMin: 15
-##   description: Verify the root reprovision with XFS 
+##   description: Verify the root reprovision with XFS
 ##     on large disk triggers autosaved.
+##     This test is meant to cover ignition-ostree-transposefs-autosave-xfs.service
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if [ ! -f /run/ignition-ostree-autosaved-xfs.stamp ]; then
     fatal "expected autosaved XFS"
 fi
+# Verify we printed something about the agcount
+journalctl -u ignition-ostree-transposefs-autosave-xfs.service --grep=agcount
 ok "autosaved XFS on large disk"
 
 eval $(xfs_info / | grep -o 'agcount=[0-9]*')
-if [ "$agcount" -gt 4 ]; then
-    fatal "expected agcount of at most 4, got ${agcount}"
+expected=4
+if [ "$agcount" -gt "$expected" ]; then
+    fatal "expected agcount of at most ${expected}, got ${agcount}"
 fi
 ok "low agcount on large disk"
diff --git a/tests/kola/root-reprovision/filesystem-only/test.sh b/tests/kola/root-reprovision/filesystem-only/test.sh
index 6003d8c126..43cd85af1a 100755
--- a/tests/kola/root-reprovision/filesystem-only/test.sh
+++ b/tests/kola/root-reprovision/filesystem-only/test.sh
@@ -11,7 +11,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 fstype=$(findmnt -nvr / -o FSTYPE)
 [[ $fstype == ext4 ]]
diff --git a/tests/kola/root-reprovision/linear/test.sh b/tests/kola/root-reprovision/linear/test.sh
index a225261965..3dce05e080 100755
--- a/tests/kola/root-reprovision/linear/test.sh
+++ b/tests/kola/root-reprovision/linear/test.sh
@@ -15,7 +15,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 srcdev=$(findmnt -nvr / -o SOURCE)
 [[ ${srcdev} == $(realpath /dev/md/foobar) ]]
diff --git a/tests/kola/root-reprovision/luks/autosave-xfs/test.sh b/tests/kola/root-reprovision/luks/autosave-xfs/test.sh
index e15e82baeb..e238a4acd9 100755
--- a/tests/kola/root-reprovision/luks/autosave-xfs/test.sh
+++ b/tests/kola/root-reprovision/luks/autosave-xfs/test.sh
@@ -10,13 +10,15 @@
 ##   # timeout value than the default.
 ##   timeoutMin: 15
 ##   # Trigger automatic XFS reprovisioning
-##   minDisk: 100
-##   description: Verify the root reprovision with XFS and TPM 
+##   minDisk: 1000
+##   description: Verify the root reprovision with XFS and TPM
 ##     on large disk triggers autosaved.
+##     This test is meant to cover ignition-ostree-transposefs-autosave-xfs.service
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # check that we ran automatic XFS reprovisioning
 if [ -z "${AUTOPKGTEST_REBOOT_MARK:-}" ]; then
@@ -26,8 +28,9 @@ if [ -z "${AUTOPKGTEST_REBOOT_MARK:-}" ]; then
     ok "autosaved XFS on large disk"
 
     eval $(xfs_info / | grep -o 'agcount=[0-9]*')
-    if [ "$agcount" -gt 4 ]; then
-        fatal "expected agcount of at most 4, got ${agcount}"
+    expected=4
+    if [ "$agcount" -gt "${expected}" ]; then
+        fatal "expected agcount of at most ${expected}, got ${agcount}"
     fi
     ok "low agcount on large disk"
 fi
diff --git a/tests/kola/root-reprovision/luks/data/luks-test.sh b/tests/kola/root-reprovision/luks/data/luks-test.sh
index fe4b0dc3fe..8e2f8b47be 100755
--- a/tests/kola/root-reprovision/luks/data/luks-test.sh
+++ b/tests/kola/root-reprovision/luks/data/luks-test.sh
@@ -1,7 +1,8 @@
 # This file is sourced by both `ext.config.root-reprovision.luks`
 # and `ext.config.root-reprovision.luks.autosave-xfs`.
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 srcdev=$(findmnt -nvr / -o SOURCE)
 [[ ${srcdev} == /dev/mapper/myluksdev ]]
diff --git a/tests/kola/root-reprovision/luks/test.sh b/tests/kola/root-reprovision/luks/test.sh
index 3aa35a32f5..60b1585e02 100755
--- a/tests/kola/root-reprovision/luks/test.sh
+++ b/tests/kola/root-reprovision/luks/test.sh
@@ -9,12 +9,13 @@
 ##   # This test includes a lot of disk I/O and needs a higher
 ##   # timeout value than the default.
 ##   timeoutMin: 15
-##   description: Verify the root reprovision with XFS and TPM 
+##   description: Verify the root reprovision with XFS and TPM
 ##     does not trigger autosaved.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # check that we didn't run automatic XFS reprovisioning
 if [ -z "${AUTOPKGTEST_REBOOT_MARK:-}" ]; then
diff --git a/tests/kola/root-reprovision/raid1/test.sh b/tests/kola/root-reprovision/raid1/test.sh
index 6bf0e3c5cb..226540aab1 100755
--- a/tests/kola/root-reprovision/raid1/test.sh
+++ b/tests/kola/root-reprovision/raid1/test.sh
@@ -15,7 +15,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 srcdev=$(findmnt -nvr / -o SOURCE)
 [[ ${srcdev} == $(realpath /dev/md/foobar) ]]
diff --git a/tests/kola/root-reprovision/swap-before-root/test.sh b/tests/kola/root-reprovision/swap-before-root/test.sh
index e09819de00..654e5eee5e 100755
--- a/tests/kola/root-reprovision/swap-before-root/test.sh
+++ b/tests/kola/root-reprovision/swap-before-root/test.sh
@@ -16,7 +16,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 swapstatus=$(systemctl is-active dev-disk-by\\x2dpartlabel-swap.swap)
 [[ ${swapstatus} == active ]]
diff --git a/tests/kola/rpm-ostree-countme/test.sh b/tests/kola/rpm-ostree-countme/test.sh
index b87f973098..8f41159d9c 100755
--- a/tests/kola/rpm-ostree-countme/test.sh
+++ b/tests/kola/rpm-ostree-countme/test.sh
@@ -7,7 +7,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 journal_cursor() {
     journalctl --output json --lines 1 \
diff --git a/tests/kola/rpm-ostree/container-deps b/tests/kola/rpm-ostree/container-deps
index 154ef68f23..5b8d3fce95 100755
--- a/tests/kola/rpm-ostree/container-deps
+++ b/tests/kola/rpm-ostree/container-deps
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Verify this command exists since it's a hard dependency of ostree's container bits.
 skopeo experimental-image-proxy --help
diff --git a/tests/kola/rpm-ostree/kernel-replace b/tests/kola/rpm-ostree/kernel-replace
index a4412a7748..0b51d570cc 100755
--- a/tests/kola/rpm-ostree/kernel-replace
+++ b/tests/kola/rpm-ostree/kernel-replace
@@ -10,7 +10,7 @@
 ##   distros: fcos
 ##   # Needs internet access as we fetch files from koji
 ##   tags: "needs-internet platform-independent"
-##   description: Verify that build of a container image with a new kernel 
+##   description: Verify that build of a container image with a new kernel
 ##     and reboot into it succeeds.
 
 #
@@ -31,9 +31,11 @@
 # Free Software Foundation, Inc., 59 Temple Place - Suite 330,
 # Boston, MA 02111-1307, USA.
 
-set -euo pipefail
-. $KOLA_EXT_DATA/commonlib.sh
-set -x
+set -euxo pipefail
+
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
+
 cd $(mktemp -d)
 
 # TODO: It'd be much better to test this via a registry
diff --git a/tests/kola/secex/ensure/test.sh b/tests/kola/secex/ensure/test.sh
index 567363405c..54191e07b7 100755
--- a/tests/kola/secex/ensure/test.sh
+++ b/tests/kola/secex/ensure/test.sh
@@ -5,7 +5,7 @@
 ##   requiredTag: secex
 ##   timeoutMin: 3
 ##   description: Verify the s390x Secure Execution QEMU image works. It also
-##     implicitly tests Ignition config decryption. 
+##     implicitly tests Ignition config decryption.
 
 # We don't run it by default because it requires running with `--qemu-secex`.
 
diff --git a/tests/kola/secex/reboot/test.sh b/tests/kola/secex/reboot/test.sh
index 1624f268c6..c5dcb18adc 100755
--- a/tests/kola/secex/reboot/test.sh
+++ b/tests/kola/secex/reboot/test.sh
@@ -7,7 +7,7 @@
 ##   description: Verify the qemu-secex image reboots with SE enabled. It also
 ##     implicitly tests Ignition config decryption.
 
-# We don't run it by default because it requires running with 
+# We don't run it by default because it requires running with
 # `--qemu-secex --qemu-secex-hostkey HKD-<serial>.crt`.
 
 set -xeuo pipefail
diff --git a/tests/kola/security/coreos-update-ca-trust/test.sh b/tests/kola/security/coreos-update-ca-trust/test.sh
index 5dfa0a2bec..93f63fe86a 100755
--- a/tests/kola/security/coreos-update-ca-trust/test.sh
+++ b/tests/kola/security/coreos-update-ca-trust/test.sh
@@ -5,7 +5,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Make sure that coreos-update-ca-trust kicked in and observe the result.
 if ! systemctl show coreos-update-ca-trust.service -p ActiveState | grep ActiveState=active; then
diff --git a/tests/kola/security/passwd/test.sh b/tests/kola/security/passwd/test.sh
index 5856993160..a3c5637a21 100755
--- a/tests/kola/security/passwd/test.sh
+++ b/tests/kola/security/passwd/test.sh
@@ -8,7 +8,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 OUTPUT=$(echo 'foobar' | setsid su - tester -c id)
 
diff --git a/tests/kola/selinux/default b/tests/kola/selinux/default
index 096f34631a..e5bc702c2d 100755
--- a/tests/kola/selinux/default
+++ b/tests/kola/selinux/default
@@ -8,7 +8,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ostree admin config-diff | grep 'selinux/targeted/policy'; then
     fatal "SELinux policy is marked as modified"
diff --git a/tests/kola/selinux/enforcing b/tests/kola/selinux/enforcing
index 41502c8de2..2c163e3d50 100755
--- a/tests/kola/selinux/enforcing
+++ b/tests/kola/selinux/enforcing
@@ -6,7 +6,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 case "${AUTOPKGTEST_REBOOT_MARK:-}" in
   "")
@@ -40,14 +41,14 @@ case "${AUTOPKGTEST_REBOOT_MARK:-}" in
     ;;
   rebooted)
     # check SELinux is in permissive mode
-    enforce=$(getenforce)  
+    enforce=$(getenforce)
     if [ "${enforce}" != "Permissive" ]; then
       fatal "Error: Expected SELinux Permissive, found ${enforce}"
     fi
     ok "SELinux is Permissive"
     ok "Second boot"
     ;;
-  *) 
+  *)
     fatal "unexpected mark: ${AUTOPKGTEST_REBOOT_MARK}"
     ;;
 esac
diff --git a/tests/kola/selinux/podman-tmpfs-context b/tests/kola/selinux/podman-tmpfs-context
index 3d4d6bc527..8205aae166 100755
--- a/tests/kola/selinux/podman-tmpfs-context
+++ b/tests/kola/selinux/podman-tmpfs-context
@@ -5,14 +5,15 @@
 ##   exclusive: false
 ##   # This test pulls a container image from the network.
 ##   tags: "needs-internet platform-independent"
-##   description: Verify that tmpfs mounts inside a container 
+##   description: Verify that tmpfs mounts inside a container
 ##     have the `container_file_t` label.
 
 # See https://github.com/coreos/fedora-coreos-tracker/issues/1366
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 context=$(podman run --rm --privileged registry.fedoraproject.org/fedora:38 \
             bash -c "mount -t tmpfs tmpfs /mnt/ && stat --format '%C' /mnt/")
diff --git a/tests/kola/selinux/stub-resolve-context b/tests/kola/selinux/stub-resolve-context
index f7e0541387..9708af2c09 100755
--- a/tests/kola/selinux/stub-resolve-context
+++ b/tests/kola/selinux/stub-resolve-context
@@ -4,7 +4,7 @@
 ##   # RHCOS
 ##   distros:  fcos
 ##   exclusive: false
-##   description: Verify that the stub-resolv.conf file has the correct 
+##   description: Verify that the stub-resolv.conf file has the correct
 ##     selinux context.
 
 # See
@@ -13,7 +13,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 context=$(stat --format "%C" /run/systemd/resolve/stub-resolv.conf)
 if [ "$context" != "system_u:object_r:net_conf_t:s0" ]; then
diff --git a/tests/kola/selinux/usrlocal-context b/tests/kola/selinux/usrlocal-context
index 3e31b9cc63..2e7a61499f 100755
--- a/tests/kola/selinux/usrlocal-context
+++ b/tests/kola/selinux/usrlocal-context
@@ -1,12 +1,13 @@
 #!/bin/bash
 ## kola:
 ##   exclusive: false
-##   description: Verify /usr/sbin and /var/usrlocal/sbin have 
+##   description: Verify /usr/sbin and /var/usrlocal/sbin have
 ##     the same SELinux security context.
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 bin_ctx=$(stat -c %C /usr/sbin)
 usrlocal_sbin_ctx=$(stat -c %C /var/usrlocal/sbin)
diff --git a/tests/kola/ssh/custom-host-key-permissions/test.sh b/tests/kola/ssh/custom-host-key-permissions/test.sh
index 4599658301..a1abfc5f9c 100755
--- a/tests/kola/ssh/custom-host-key-permissions/test.sh
+++ b/tests/kola/ssh/custom-host-key-permissions/test.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 ## kola:
 ##   tags: platform-independent
-##   description: Verify that sshd still works with a custom 
+##   description: Verify that sshd still works with a custom
 ##     host key with mode 640 and group ssh_keys.
 
 # See
@@ -10,7 +10,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # recent Fedora sshd binaries will fail to start if all configured host keys
 # have mode > 600 and their modes haven't automatically been fixed
diff --git a/tests/kola/swap/zram-default b/tests/kola/swap/zram-default
index 3b2323daa3..6e9a11a88f 100755
--- a/tests/kola/swap/zram-default
+++ b/tests/kola/swap/zram-default
@@ -11,7 +11,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if [ -e /dev/zram0 ]; then
     fatal "zram0 swap device set up on default install"
diff --git a/tests/kola/swap/zram-generator/test.sh b/tests/kola/swap/zram-generator/test.sh
index cb47cbfbe2..e2ad3ea6ac 100755
--- a/tests/kola/swap/zram-generator/test.sh
+++ b/tests/kola/swap/zram-generator/test.sh
@@ -4,14 +4,15 @@
 ##   distros: fcos
 ##   # This test conflicts with swap/zram-default so we cannot set this to non-exclusive
 ##   exclusive: true
-##   description: Verify that swap on zram devices can be set up using the 
+##   description: Verify that swap on zram devices can be set up using the
 ##     zram-generator as defined.
 
 # See docs at https://docs.fedoraproject.org/en-US/fedora-coreos/sysconfig-configure-swaponzram/
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 if ! grep -q 'zram0' /proc/swaps; then
     fatal "expected zram0 to be set up"
diff --git a/tests/kola/systemd/default-unit-timeouts b/tests/kola/systemd/default-unit-timeouts
index 08d279dd7a..18570f3e70 100755
--- a/tests/kola/systemd/default-unit-timeouts
+++ b/tests/kola/systemd/default-unit-timeouts
@@ -8,7 +8,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 DefaultTimeoutStartUSec=$(systemctl show --value --property=DefaultTimeoutStartUSec)
 DefaultTimeoutStopUSec=$(systemctl show --value --property=DefaultTimeoutStopUSec)
diff --git a/tests/kola/systemd/network-online/test.sh b/tests/kola/systemd/network-online/test.sh
index 1512503541..442ef34ae0 100755
--- a/tests/kola/systemd/network-online/test.sh
+++ b/tests/kola/systemd/network-online/test.sh
@@ -20,7 +20,8 @@
 
 set -euo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # The fact that we're here means that `systemd-user-sessions.service` was
 # reached and logins work since kola was able to SSH to start us. But let's do
diff --git a/tests/kola/toolbox/test.sh b/tests/kola/toolbox/test.sh
index 5844837cfb..1221b50fe6 100755
--- a/tests/kola/toolbox/test.sh
+++ b/tests/kola/toolbox/test.sh
@@ -8,7 +8,7 @@
 ##   distros: fcos
 ##   # Toolbox container is currently available only for x86_64 and aarch64 in Fedora
 ##   architectures: x86_64 aarch64
-##   description: Make sure that basic toolbox functionality works (creating, 
+##   description: Make sure that basic toolbox functionality works (creating,
 ##     running commands, and removing).
 
 # Important note: Commands are run indirectly via calls to `machinectl shell`
@@ -19,7 +19,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # Try five times to create the toolbox to avoid Fedora registry infra flakes
 for i in $(seq 1 5); do
diff --git a/tests/kola/upgrade/extended/test.sh b/tests/kola/upgrade/extended/test.sh
index 596c47666b..c1d29b5a3a 100755
--- a/tests/kola/upgrade/extended/test.sh
+++ b/tests/kola/upgrade/extended/test.sh
@@ -10,7 +10,8 @@
 
 set -eux -o pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # This test will attempt to test an upgrade from a given starting
 # point (assumed by the caller passing in a specific
diff --git a/tests/kola/var-mount/luks/test.sh b/tests/kola/var-mount/luks/test.sh
index a9e61ee508..bb72e762c9 100755
--- a/tests/kola/var-mount/luks/test.sh
+++ b/tests/kola/var-mount/luks/test.sh
@@ -7,7 +7,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # /var
 
diff --git a/tests/kola/var-mount/scsi-id/test.sh b/tests/kola/var-mount/scsi-id/test.sh
index 591fd2bf04..afb834a5e3 100755
--- a/tests/kola/var-mount/scsi-id/test.sh
+++ b/tests/kola/var-mount/scsi-id/test.sh
@@ -3,14 +3,15 @@
 ##   # additionalDisks is only supported on QEMU
 ##   platforms: qemu
 ##   additionalDisks: ["5G:mpath"]
-##   description: Verify udev rules /dev/disk/by-id/scsi-* symlinks exist 
+##   description: Verify udev rules /dev/disk/by-id/scsi-* symlinks exist
 ##     in initramfs.
 
 # See https://bugzilla.redhat.com/show_bug.cgi?id=1990506
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 fstype=$(findmnt -nvr /var -o FSTYPE)
 if [ $fstype != xfs ]; then
diff --git a/tests/kola/var-mount/simple/test.sh b/tests/kola/var-mount/simple/test.sh
index 20b36af04b..9ccfed7c06 100755
--- a/tests/kola/var-mount/simple/test.sh
+++ b/tests/kola/var-mount/simple/test.sh
@@ -7,7 +7,8 @@
 
 set -xeuo pipefail
 
-. $KOLA_EXT_DATA/commonlib.sh
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
 
 # /var