diff --git a/default.nix b/default.nix
index 38abcb5..c4f079c 100644
--- a/default.nix
+++ b/default.nix
@@ -10,6 +10,16 @@ let
     '';
   });
 in rec {
+  toStorePath = target:
+    # If a store path has been given, transform it to a string. And make sure
+    # to capture the store path in its context.
+    if lib.isStorePath target then
+      let path = toString target; in
+      builtins.appendContext path { "${path}" = { path = true; }; }
+    # Otherwise, add to the store. This takes care of appending the store path
+    # in the context automatically.
+    else "${target}";
+
   arx = { archive, startup}:
     stdenv.mkDerivation {
       name = "arx";
@@ -71,9 +81,13 @@ in rec {
     };
 
   makeStartup = { target, nixUserChrootFlags, nix-user-chroot', run }:
+  let
+    # Avoid re-adding a store path into the store
+    path = toStorePath target;
+  in
   writeScript "startup" ''
     #!/bin/sh
-    .${nix-user-chroot'}/bin/nix-user-chroot -n ./nix ${nixUserChrootFlags} -- ${target}${run} $@
+    .${nix-user-chroot'}/bin/nix-user-chroot -n ./nix ${nixUserChrootFlags} -- ${path}${run} "$@"
   '';
 
   nix-bootstrap = { target, extraTargets ? [], run, nix-user-chroot' ? nix-user-chroot, nixUserChrootFlags ? "" }:
diff --git a/nix-bootstrap.sh b/nix-bootstrap.sh
index 4d082a3..ce91ead 100755
--- a/nix-bootstrap.sh
+++ b/nix-bootstrap.sh
@@ -1,35 +1,35 @@
 #!/bin/sh
 
-cmd=sh
-if ! [ $# -eq 0 ]; then
-    cmd=$@
+if [ $# -gt 0 ]; then
+    set -- sh
 fi
 
 # should download this in the future
 # but the mirror is down
-proot=`dirname $0`/proot-`uname -p`
+proot=$(dirname "$0")/proot-$(uname -p)
 export PROOT_NO_SECCOMP=1
 
 nixdir=$HOME/.nix
 
 OLD_NIX_PATH=$NIX_PATH
-if [ -e $HOME/.nix-profile/etc/profile.d/nix.sh ]; then . $HOME/.nix-profile/etc/profile.d/nix.sh; fi
-if ! [ -z "$OLD_NIX_PATH" ]; then NIX_PATH="$OLD_NIX_PATH"; fi
+# shellcheck disable=SC1090
+if [ -e "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then .  "$HOME/.nix-profile/etc/profile.d/nix.sh"; fi
+if [ -n "$OLD_NIX_PATH" ]; then NIX_PATH="$OLD_NIX_PATH"; fi
 
 if [ -z "$IN_PROOT" ]; then
     export IN_PROOT=1
 
-    if ! [ -d $nixdir ]; then
-        mkdir -p $nixdir
+    if ! [ -d "$nixdir" ]; then
+        mkdir -p "$nixdir"
         s=$(mktemp)
-        curl https://nixos.org/nix/install -o $s
-        $proot -b $nixdir:/nix $0 sh $s
+        curl https://nixos.org/nix/install -o "$s"
+        $proot -b "$nixdir:/nix" "$0" sh "$s"
     fi
 
-    $proot -b $nixdir:/nix $0 $cmd
+    $proot -b "$nixdir:/nix" "$0" "$@"
 
     export IN_PROOT=
     exit
-elif ! [ $# -eq 0 ]; then
-    exec $cmd
+elif [ $# -gt 0 ]; then
+    exec "$@"
 fi
diff --git a/nix-bundle.sh b/nix-bundle.sh
index 8bece2a..dc4a931 100755
--- a/nix-bundle.sh
+++ b/nix-bundle.sh
@@ -8,6 +8,9 @@ Usage: $0 TARGET EXECUTABLE
 Create a single-file bundle from the nixpkgs attribute "TARGET".
 EXECUTABLE should be relative to the TARGET's output path.
 
+The TARGET is either an attribute in nixpkgs, or an absolute path to the
+store.
+
 For example:
 
 $ $0 hello /bin/hello
@@ -19,7 +22,7 @@ EOF
     exit 1
 fi
 
-nix_file=`dirname $0`/default.nix
+nix_file=$(dirname "$0")/default.nix
 
 target="$1"
 shift
@@ -38,21 +41,23 @@ shift
 bootstrap=nix-bootstrap
 if [ "$target" = "nix-bundle" ] || [ "$target" = "nixStable" ] || [ "$target" = "nixUnstable" ] || [ "$target" = "nix" ]; then
     bootstrap=nix-bootstrap-nix
-elif ! [ -z "$extraTargets" ]; then
+elif [ -n "$extraTargets" ]; then
     bootstrap=nix-bootstrap-path
 fi
 
 expr="with import <nixpkgs> {}; with import $nix_file {}; $bootstrap { target = $target; extraTargets = [ $extraTargets ]; run = \"$exec\"; }"
 
-out=$(nix-store --no-gc-warning -r $(nix-instantiate --no-gc-warning -E "$expr"))
+drv=$(nix-instantiate --no-gc-warning -E "$expr")
+
+out=$(nix-store --no-gc-warning --realize "$drv")
 
 if [ -z "$out" ]; then
   >&2 echo "$0 failed. Exiting."
   exit 1
 elif [ -t 1 ]; then
-  filename=$(basename $exec)
+  filename=$(basename "$exec")
   echo "Nix bundle created at $filename."
-  cp -f $out $filename
+  cp -f "$out" "$filename"
 else
-  cat $out
+  cat "$out"
 fi
diff --git a/nix-run.sh b/nix-run.sh
index 2c21daf..41f2084 100755
--- a/nix-run.sh
+++ b/nix-run.sh
@@ -22,7 +22,7 @@ pkg="$1"
 shift
 
 # A second argument will provide a hint to run
-if ! [ -z "$1" ]; then
+if [ -n "$1" ]; then
     name="$1"
     shift
 else
@@ -53,11 +53,11 @@ run_linux_desktop_app () {
     file="$1"
     shift
 
-    cmd=$(grep '^Exec' $file | tail -1 | \
+    cmd=$(grep '^Exec' "$file" | tail -1 | \
               sed 's/Exec=//;s/^"//;s/" *$//')
 
-    if ! [ -z "$@" ]; then
-        cmd=$(echo "$cmd" | sed "s/%[fu]/$1/;s/%[FU]/$@/")
+    if [ "$#" -gt 0 ]; then
+        cmd=$(echo "$cmd" | sed "s/%[fu]/$1/;s/%[FU]/$*/")
     fi
 
     cmd=$(echo "$cmd" | sed "s/%k/$desktop/;s/%.//")
@@ -79,20 +79,20 @@ elif [ -x "$out/bin/run" ]; then
     run_bin "$out/bin/run" "$@"
 elif [ "$(uname)" = Darwin ] && [ -d "$out/Applications/$name.app" ]; then
     run_darwin_app "$out/Applications/$name.app" "$@"
-elif [ "$(uname)" = Darwin ] && [ -d $out/Applications/*.app ]; then
-    for f in $out/Applications/*.app; do
+elif [ "$(uname)" = Darwin ] && [ -d "$out"/Applications/*.app ]; then
+    for f in "$out"/Applications/*.app; do
         run_darwin_app "$f" "$@"
     done
 elif [ -f "$out/share/applications/$name.desktop" ]; then
-    run_linux_desktop_app "$out/share/applications/$name.desktop" $@
-elif [ -d $out/share/applications ]; then
-    for f in $out/share/applications/*.desktop; do
+    run_linux_desktop_app "$out/share/applications/$name.desktop" "$@"
+elif [ -d "$out"/share/applications ]; then
+    for f in "$out"/share/applications/*.desktop; do
         run_linux_desktop_app "$f"
     done
 elif [ -x "$out/bin/$name" ]; then
     run_bin "$out/bin/$name" "$@"
 elif [ -d "$out/bin" ]; then
-    for bin in $out/bin/*; do
+    for bin in "$out"/bin/*; do
         run_bin "$bin" "$@"
     done
 else