diff --git a/pkgs/applications/emulators/citra/update.sh b/pkgs/applications/emulators/citra/update.sh
index eec36818fede..6b68e3327a2e 100755
--- a/pkgs/applications/emulators/citra/update.sh
+++ b/pkgs/applications/emulators/citra/update.sh
@@ -27,7 +27,7 @@ updateNightly() {
     OLD_NIGHTLY_VERSION="$(getLocalVersion "citra-nightly")"
     OLD_NIGHTLY_HASH="$(getLocalHash "citra-nightly")"
 
-    NEW_NIGHTLY_VERSION="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+    NEW_NIGHTLY_VERSION="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
         "https://api.github.com/repos/citra-emu/citra-nightly/releases?per_page=1" | jq -r '.[0].name' | cut -d"-" -f2 | cut -d" " -f2)"
 
     if [[ "${OLD_NIGHTLY_VERSION}" = "${NEW_NIGHTLY_VERSION}" ]]; then
@@ -52,7 +52,7 @@ updateCanary() {
     OLD_CANARY_VERSION="$(getLocalVersion "citra-canary")"
     OLD_CANARY_HASH="$(getLocalHash "citra-canary")"
 
-    NEW_CANARY_VERSION="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+    NEW_CANARY_VERSION="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
         "https://api.github.com/repos/citra-emu/citra-canary/releases?per_page=1" | jq -r '.[0].name' | cut -d"-" -f2 | cut -d" " -f1)"
 
     if [[ "${OLD_CANARY_VERSION}" = "${NEW_CANARY_VERSION}" ]]; then
diff --git a/pkgs/applications/emulators/yuzu/update.sh b/pkgs/applications/emulators/yuzu/update.sh
index 074d5b155fbf..bfabd6a20694 100755
--- a/pkgs/applications/emulators/yuzu/update.sh
+++ b/pkgs/applications/emulators/yuzu/update.sh
@@ -21,10 +21,10 @@ updateBranch() {
     oldHash="$(nix eval --raw -f "./default.nix" "$attribute".src.drvAttrs.outputHash)"
 
     if [[ "$branch" = "mainline" ]]; then
-        newVersion="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/yuzu-emu/yuzu-mainline/releases?per_page=1" \
+        newVersion="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/yuzu-emu/yuzu-mainline/releases?per_page=1" \
             | jq -r '.[0].name' | cut -d" " -f2)"
     elif [[ "$branch" = "early-access" ]]; then
-        newVersion="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=2" \
+        newVersion="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=2" \
             | jq -r '.[].tag_name' | grep '^EA-[0-9]*' | head -n1 | cut -d"-" -f2 | cut -d" " -f1)"
     fi
 
@@ -50,13 +50,13 @@ updateBranch() {
 
 updateCompatibilityList() {
     local latestRevision oldUrl newUrl oldHash newHash oldDate newDate
-    latestRevision="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/flathub/org.yuzu_emu.yuzu/commits/master" | jq -r '.sha')"
+    latestRevision="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/flathub/org.yuzu_emu.yuzu/commits/master" | jq -r '.sha')"
 
     oldUrl="$(sed -n '/yuzu-compat-list/,/url/p' "$DEFAULT_NIX" | tail -n1 | cut -d'"' -f2)"
     newUrl="https://raw.githubusercontent.com/flathub/org.yuzu_emu.yuzu/${latestRevision}/compatibility_list.json"
 
     oldDate="$(sed -n '/last updated.*/p' "$DEFAULT_NIX" | rev | cut -d' ' -f1 | rev)"
-    newDate="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/flathub/org.yuzu_emu.yuzu/commits/${latestRevision}" \
+    newDate="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/flathub/org.yuzu_emu.yuzu/commits/${latestRevision}" \
         | jq -r '.commit.committer.date' | cut -d'T' -f1)"
 
     oldHash="$(sed -n '/yuzu-compat-list/,/sha256/p' "$DEFAULT_NIX" | tail -n1 | cut -d'"' -f2)"
diff --git a/pkgs/applications/networking/cluster/cmctl/update.sh b/pkgs/applications/networking/cluster/cmctl/update.sh
index 70b088a6880a..16a20edb577b 100755
--- a/pkgs/applications/networking/cluster/cmctl/update.sh
+++ b/pkgs/applications/networking/cluster/cmctl/update.sh
@@ -7,13 +7,13 @@ NIXPKGS_PATH="$(git rev-parse --show-toplevel)"
 CMCTL_PATH="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
 
 OLD_VERSION="$(nix-instantiate --eval -E "with import $NIXPKGS_PATH {}; cmctl.version or (builtins.parseDrvName cmctl.name).version" | tr -d '"')"
-LATEST_TAG="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/cert-manager/cert-manager/releases" | jq '.[].tag_name' --raw-output | sed '/-/d' | sort --version-sort -r | head -n 1)"
+LATEST_TAG="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/cert-manager/cert-manager/releases" | jq '.[].tag_name' --raw-output | sed '/-/d' | sort --version-sort -r | head -n 1)"
 LATEST_VERSION="${LATEST_TAG:1}"
 
 if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
     SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/cert-manager/cert-manager/archive/refs/tags/${LATEST_TAG}.tar.gz)
-    TAG_SHA=$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""}  "https://api.github.com/repos/cert-manager/cert-manager/git/ref/tags/${LATEST_TAG}" | jq -r '.object.sha')
-    TAG_COMMIT_SHA=$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/cert-manager/cert-manager/git/tags/${TAG_SHA}" | jq '.object.sha' --raw-output)
+    TAG_SHA=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"}  "https://api.github.com/repos/cert-manager/cert-manager/git/ref/tags/${LATEST_TAG}" | jq -r '.object.sha')
+    TAG_COMMIT_SHA=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/cert-manager/cert-manager/git/tags/${TAG_SHA}" | jq '.object.sha' --raw-output)
 
     setKV () {
         sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" "${CMCTL_PATH}/default.nix"
diff --git a/pkgs/applications/networking/cluster/crc/update.sh b/pkgs/applications/networking/cluster/crc/update.sh
index 9d3fcba7d9fd..3ac34c168bac 100755
--- a/pkgs/applications/networking/cluster/crc/update.sh
+++ b/pkgs/applications/networking/cluster/crc/update.sh
@@ -13,7 +13,7 @@ NIXPKGS_CRC_FOLDER=$(
 cd ${NIXPKGS_CRC_FOLDER}
 
 LATEST_TAG_RAWFILE=${WORKDIR}/latest_tag.json
-curl --silent ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
     https://api.github.com/repos/code-ready/crc/releases >${LATEST_TAG_RAWFILE}
 
 LATEST_TAG_NAME=$(jq 'map(.tag_name)' ${LATEST_TAG_RAWFILE} |
@@ -21,7 +21,7 @@ LATEST_TAG_NAME=$(jq 'map(.tag_name)' ${LATEST_TAG_RAWFILE} |
 
 CRC_VERSION=$(echo ${LATEST_TAG_NAME} | sed 's/^v//')
 
-CRC_COMMIT=$(curl --silent ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+CRC_COMMIT=$(curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
     https://api.github.com/repos/code-ready/crc/tags |
     jq -r "map(select(.name == \"${LATEST_TAG_NAME}\")) | .[0] | .commit.sha")
 
diff --git a/pkgs/applications/networking/cluster/k3s/update.sh b/pkgs/applications/networking/cluster/k3s/update.sh
index ac46e7ae51e5..913be71d0dee 100755
--- a/pkgs/applications/networking/cluster/k3s/update.sh
+++ b/pkgs/applications/networking/cluster/k3s/update.sh
@@ -11,7 +11,7 @@ NIXPKGS_K3S_PATH=$(cd $(dirname ${BASH_SOURCE[0]}); pwd -P)/
 cd ${NIXPKGS_K3S_PATH}
 
 LATEST_TAG_RAWFILE=${WORKDIR}/latest_tag.json
-curl --silent ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
     https://api.github.com/repos/k3s-io/k3s/releases > ${LATEST_TAG_RAWFILE}
 
 LATEST_TAG_NAME=$(jq 'map(.tag_name)' ${LATEST_TAG_RAWFILE} | \
@@ -19,7 +19,7 @@ LATEST_TAG_NAME=$(jq 'map(.tag_name)' ${LATEST_TAG_RAWFILE} | \
 
 K3S_VERSION=$(echo ${LATEST_TAG_NAME} | sed 's/^v//')
 
-K3S_COMMIT=$(curl --silent ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+K3S_COMMIT=$(curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
     https://api.github.com/repos/k3s-io/k3s/tags \
     | jq -r "map(select(.name == \"${LATEST_TAG_NAME}\")) | .[0] | .commit.sha")
 
diff --git a/pkgs/development/interpreters/clojure/babashka.nix b/pkgs/development/interpreters/clojure/babashka.nix
index 1a1f40e3f9f6..be9ddd9d0b6e 100644
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@@ -30,7 +30,7 @@ buildGraalvmNativeImage rec {
     set -euo pipefail
 
     readonly latest_version="$(curl \
-      ''${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+      ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
       -s "https://api.github.com/repos/babashka/babashka/releases/latest" \
       | jq -r '.tag_name')"
 
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index 406c5bc15ab5..95b7d611fa94 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
 
     # `jq -r '.[0].name'` results in `v0.0`
     readonly latest_version="$(curl \
-      ''${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+      ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
       -s "https://api.github.com/repos/clojure/brew-install/tags" \
       | jq -r '.[1].name')"
 
diff --git a/pkgs/servers/monitoring/uptime-kuma/update.sh b/pkgs/servers/monitoring/uptime-kuma/update.sh
index 84d05639ae23..0eaa47fd11cb 100644
--- a/pkgs/servers/monitoring/uptime-kuma/update.sh
+++ b/pkgs/servers/monitoring/uptime-kuma/update.sh
@@ -3,7 +3,7 @@
 
 set -euo pipefail
 
-latestVersion="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/louislam/uptime-kuma/releases?per_page=1" | jq -r ".[0].tag_name" | sed 's/^v//')"
+latestVersion="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/louislam/uptime-kuma/releases?per_page=1" | jq -r ".[0].tag_name" | sed 's/^v//')"
 currentVersion=$(nix-instantiate --eval -E "with import ./. {}; uptime-kuma.version or (lib.getVersion uptime-kuma)" | tr -d '"')
 
 if [[ "$currentVersion" == "$latestVersion" ]]; then
diff --git a/pkgs/tools/misc/depotdownloader/update.sh b/pkgs/tools/misc/depotdownloader/update.sh
index 44b6200c4c5d..9e6efdfceaa5 100755
--- a/pkgs/tools/misc/depotdownloader/update.sh
+++ b/pkgs/tools/misc/depotdownloader/update.sh
@@ -5,7 +5,7 @@ set -eou pipefail
 
 depsFile="$(realpath "$(dirname "${BASH_SOURCE[0]}")/deps.nix")"
 currentVersion="$(nix eval --raw -f . depotdownloader.version)"
-latestVersion="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/SteamRE/DepotDownloader/releases?per_page=1" \
+latestVersion="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/SteamRE/DepotDownloader/releases?per_page=1" \
     | jq -r '.[].name' | cut -d' ' -f2)"
 
 if [[ "$currentVersion" = "$latestVersion" ]]; then
diff --git a/pkgs/tools/virtualization/linode-cli/update.sh b/pkgs/tools/virtualization/linode-cli/update.sh
index dd37e41c5373..f232dd1e03b0 100755
--- a/pkgs/tools/virtualization/linode-cli/update.sh
+++ b/pkgs/tools/virtualization/linode-cli/update.sh
@@ -9,7 +9,7 @@ SPEC_VERSION=$(curl -s https://www.linode.com/docs/api/openapi.yaml | yq eval '.
 
 SPEC_SHA256=$(nix-prefetch-url --quiet https://raw.githubusercontent.com/linode/linode-api-docs/v${SPEC_VERSION}/openapi.yaml)
 
-VERSION=$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+VERSION=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
     -H "Accept: application/vnd.github.v3+json" \
     "https://api.github.com/repos/linode/linode-cli/tags" \
     | jq 'map(.name)' \