diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6641e8b..82c5bee 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
         run: |
           bash -n mcserver-kit new-minecraft-server.sh setup.sh install.sh uninstall.sh tests/run-tests.sh
           python3 -m py_compile scripts/detect-world-version.py
-          shellcheck mcserver-kit new-minecraft-server.sh setup.sh install.sh uninstall.sh tests/run-tests.sh
+          shellcheck -x mcserver-kit new-minecraft-server.sh setup.sh install.sh uninstall.sh tests/run-tests.sh
           bash tests/run-tests.sh
 
       - name: Build release archive
diff --git a/.github/workflows/shell-tests.yml b/.github/workflows/shell-tests.yml
index 335fe00..e6aa207 100644
--- a/.github/workflows/shell-tests.yml
+++ b/.github/workflows/shell-tests.yml
@@ -30,7 +30,7 @@ jobs:
         run: python3 -m py_compile scripts/detect-world-version.py
 
       - name: Run ShellCheck
-        run: shellcheck mcserver-kit new-minecraft-server.sh setup.sh install.sh uninstall.sh tests/run-tests.sh
+        run: shellcheck -x mcserver-kit new-minecraft-server.sh setup.sh install.sh uninstall.sh tests/run-tests.sh
 
       - name: Run specification tests
         run: bash tests/run-tests.sh
diff --git a/install.sh b/install.sh
index e78cf9f..501327e 100755
--- a/install.sh
+++ b/install.sh
@@ -5,7 +5,9 @@ REPOSITORY='cotore-game/mcserver-compose-kit'
 INSTALL_DIR="${MCSERVER_KIT_INSTALL_DIR:-${HOME}/.local/share/mcserver-compose-kit}"
 CONFIG_DIR="${MCSERVER_KIT_CONFIG_DIR:-${HOME}/.config/mcserver-compose-kit}"
 BIN_DIR="${MCSERVER_KIT_BIN_DIR:-${HOME}/.local/bin}"
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" 2>/dev/null && pwd || true)"
+if ! SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"; then
+  SCRIPT_DIR=''
+fi
 TEMP_DIR=''
 
 cleanup() {
@@ -122,7 +124,7 @@ LAUNCHER
   printf '起動コマンド: mcserver-kit\n'
   if [[ ":$PATH:" != *":${BIN_DIR}:"* ]]; then
     printf '\n%s がPATHにありません。次をシェル設定へ追加してください:\n' "$BIN_DIR"
-    printf '  export PATH="$HOME/.local/bin:$PATH"\n'
+    printf '%s\n' "  export PATH=\"\$HOME/.local/bin:\$PATH\""
   fi
   printf '\n初回起動前に、設定ファイルのEULA同意とMinecraft IDを編集してください。\n'
 
diff --git a/new-minecraft-server.sh b/new-minecraft-server.sh
index 44b8853..b03f2ea 100755
--- a/new-minecraft-server.sh
+++ b/new-minecraft-server.sh
@@ -188,8 +188,11 @@ yaml_get() {
 
 expand_path() {
   local value="$1"
+  # This is a literal input prefix, not shell tilde expansion.
+  # shellcheck disable=SC2088
+  local tilde_prefix='~/'
   value="${value//\$\{HOME\}/$HOME}"
-  if [[ "$value" == "~/"* ]]; then
+  if [[ "${value:0:2}" == "$tilde_prefix" ]]; then
     value="${HOME}/${value#\~/}"
   fi
   printf '%s' "$value"
@@ -352,7 +355,7 @@ load_mcid_template() {
     line="$(trim "$line")"
     [[ -z "$line" ]] && continue
 
-    if [[ "$line" == '${OWNER}' ]]; then
+    if [[ "$line" == "\${OWNER}" ]]; then
       line="$owner_mcid"
     fi
 
@@ -436,7 +439,7 @@ accept_eula="$(yaml_get 'minecraft.accept_eula' 'false')"
 is_true "$accept_eula" ||
   die "Minecraft EULAを確認し、同意する場合はconfig.ymlのminecraft.accept_eulaをtrueにしてください"
 
-server_root="$(expand_path "$(yaml_get 'paths.server_root' '${HOME}/minecraftServer')")"
+server_root="$(expand_path "$(yaml_get 'paths.server_root' "\${HOME}/minecraftServer")")"
 default_version="$(yaml_get 'defaults.minecraft_version' '26.2')"
 default_memory="$(yaml_get 'defaults.java_memory' '8G')"
 default_start_after_creation="$(yaml_get 'defaults.start_after_creation' 'false')"
diff --git a/setup.sh b/setup.sh
index 2aeb388..b6ecd60 100755
--- a/setup.sh
+++ b/setup.sh
@@ -123,15 +123,15 @@ main() {
   default_memory="$(prompt 'Javaメモリ' '8G')"
   start_after_creation="$(prompt_bool '作成後すぐ起動する設定をデフォルトにしますか？' false)"
   windows_dialogs="$(prompt_bool 'Windowsのファイル選択・MOTD入力画面を使いますか？' true)"
-  server_root="$(prompt 'サーバー作成先' '${HOME}/minecraftServer')"
+  server_root="$(prompt 'サーバー作成先' "\${HOME}/minecraftServer")"
 
   mkdir -p "$TEMPLATE_DIR" "$(dirname -- "$CONFIG_FILE")"
   {
-    printf '${OWNER}\n'
+    printf '%s\n' "\${OWNER}"
     printf '%s' "$additional_ops"
   } >"${TEMPLATE_DIR}/owner.txt"
   {
-    printf '${OWNER}\n'
+    printf '%s\n' "\${OWNER}"
     printf '%s' "$whitelist_ids"
   } >"${TEMPLATE_DIR}/default.txt"
 
diff --git a/tests/run-tests.sh b/tests/run-tests.sh
index e79959f..b3bf3f3 100755
--- a/tests/run-tests.sh
+++ b/tests/run-tests.sh
@@ -3,6 +3,8 @@ set -Eeuo pipefail
 
 REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
 # shellcheck source=../new-minecraft-server.sh
+# The computed repository path is intentional.
+# shellcheck disable=SC1091
 source "${REPO_ROOT}/new-minecraft-server.sh"
 
 tests_run=0
@@ -48,6 +50,8 @@ test_version_resolution() {
   assert_equal 'itzg/minecraft-server:java25' "$(resolve_minecraft_image '26.2' auto)" '26.2 uses Java 25'
   assert_equal 'itzg/minecraft-server:java25' "$(resolve_minecraft_image 'LATEST' auto)" 'LATEST uses Java 25'
   assert_equal 'itzg/minecraft-server:java-custom' "$(resolve_minecraft_image '1.21' java-custom)" 'configured image tag overrides auto detection'
+  # The single-quoted script is intentional so the child shell expands $1.
+  # shellcheck disable=SC2016
   assert_fails 'unknown versions are rejected in auto mode' \
     bash -c 'source "$1"; resolve_minecraft_image "1.17.1" auto' _ "${REPO_ROOT}/new-minecraft-server.sh"
 }