diff --git a/addon/clang-format-helper.sh b/addon/clang-format-helper.sh
index 0f7c352..f2708f2 100755
--- a/addon/clang-format-helper.sh
+++ b/addon/clang-format-helper.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 #
 # Helper script to invoke clang-format to re-format all files allowed to be
diff --git a/addon/fips_integrity_checker_elf_generator.sh b/addon/fips_integrity_checker_elf_generator.sh
index 10628f5..2529603 100755
--- a/addon/fips_integrity_checker_elf_generator.sh
+++ b/addon/fips_integrity_checker_elf_generator.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 SOFILE="$1"
 HASHER="$2"
@@ -15,13 +15,13 @@ CUT="cut"
 
 ################################################################################
 
-if [ -z "$SOFILE" -o ! -f "$SOFILE" ]
+if [ -z "$SOFILE" ] || [ ! -f "$SOFILE" ]
 then
 	echo "ERROR: shared library file $SOFILE not found"
 	exit 1
 fi
 
-if [ -z "$HASHER" -o ! -x "$HASHER" ]
+if [ -z "$HASHER" ] || [ ! -x "$HASHER" ]
 then
 	echo "ERROR: hasher executable $HASHER not found"
 	exit 1
diff --git a/addon/fips_integrity_digest.sh b/addon/fips_integrity_digest.sh
index c2a6475..b48f09b 100755
--- a/addon/fips_integrity_digest.sh
+++ b/addon/fips_integrity_digest.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 #
 # Tool to extract the message digest of the FIPS library. This digest provides
@@ -22,7 +22,7 @@ XXD="xxd"
 
 ################################################################################
 
-if [ -z "$SOFILE" -o ! -f "$SOFILE" ]
+if [ -z "$SOFILE" ] || [ ! -f "$SOFILE" ]
 then
 	echo "ERROR: shared library file $SOFILE not found"
 	exit 1
diff --git a/addon/generate_header.sh b/addon/generate_header.sh
index c150391..9bb30b3 100755
--- a/addon/generate_header.sh
+++ b/addon/generate_header.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 OUTFILE=$1
 shift
diff --git a/addon/sanity_checks.sh b/addon/sanity_checks.sh
index fc988b7..8595de7 100755
--- a/addon/sanity_checks.sh
+++ b/addon/sanity_checks.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 CHANGESFILE="CHANGES.md"
 
@@ -102,7 +102,14 @@ check_copyright_date() {
 		newyear="$year"
 	fi
 
-	sed -i "/Copyright/s/$searchyear/$newyear/" $file
+	tmpfile=$(mktemp "${TMPDIR:-/tmp}/leancrypto-copyright.XXXXXX") || exit 1
+	if sed "/Copyright/s/$searchyear/$newyear/" "$file" > "$tmpfile"
+	then
+		mv "$tmpfile" "$file"
+	else
+		rm -f "$tmpfile"
+		exit 1
+	fi
 }
 
 # Cleanup code base
@@ -119,7 +126,7 @@ code_cleanup() {
 
 		for j in $@
 		do
-			if (echo $i | grep -q $j)
+			if printf '%s\n' "$i" | grep -q -- "$j"
 			then
 				skip=1
 				break
@@ -162,7 +169,7 @@ check_reposanity() {
 
 	check_existence ${CHANGESFILE}
 	check_existence README.md
-	if ! $(head -n1 ${CHANGESFILE} | grep -q "$version" )
+	if ! head -n1 "${CHANGESFILE}" | grep -q -- "$version"
 	then
 		#git log --pretty=format"%h %an %s" ${OLDVER}..HEAD
 		echo "Forgot to add $version changes to ${CHANGESFILE}" >&2
@@ -172,7 +179,7 @@ check_reposanity() {
 
 # Check whether we have a preliminary code drop
 check_preliminary() {
-	if $(head -n1 ${CHANGESFILE} | grep -q "prerelease" )
+	if head -n1 "${CHANGESFILE}" | grep -q "prerelease"
 	then
 		echo "Preliminary release - skipping full release validation" >&2
 		exit 0
diff --git a/apps/tests/hasher-test.sh b/apps/tests/hasher-test.sh
index cae5be8..01f2f51 100755
--- a/apps/tests/hasher-test.sh
+++ b/apps/tests/hasher-test.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 #
 # Copyright (C) 2017 - 2025, Stephan Mueller <smueller@chronox.de>
 #
@@ -106,7 +106,7 @@ then
 	echo_fail "Generation of checker file $CHKFILE with hasher $LC_HASHER failed"
 fi
 
-opensslcmd=$(type -p openssl)
+opensslcmd=$(command -v openssl 2>/dev/null)
 
 if [ -x "$opensslcmd" ]
 then
diff --git a/apps/tests/leancrypto_check_with_ietf.sh b/apps/tests/leancrypto_check_with_ietf.sh
index 9e3f88a..b1c9ac6 100755
--- a/apps/tests/leancrypto_check_with_ietf.sh
+++ b/apps/tests/leancrypto_check_with_ietf.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 #
 # Written by Stephan Mueller <smueller@chronox.de>
 #
@@ -52,8 +52,8 @@ trap "rm -rf $TMPDIR" 0 1 2 3 15
 color()
 {
 	bg=0
-	echo -ne "\033[0m"
-	while [[ $# -gt 0 ]]; do
+	printf '\033[0m'
+	while [ "$#" -gt 0 ]; do
 		code=0
 		case $1 in
 			black) code=30 ;;
@@ -69,7 +69,10 @@ color()
 			reset|off|default) code=0 ;;
 			bold|bright) code=1 ;;
 		esac
-		[[ $code == 0 ]] || echo -ne "\033[$(printf "%02d" $((code+bg)))m"
+		if [ "$code" -ne 0 ]
+		then
+			printf '\033[%02dm' "$((code + bg))"
+		fi
 		shift
 	done
 }
diff --git a/apps/tests/libtest.sh b/apps/tests/libtest.sh
index 46f950b..ab7e36e 100644
--- a/apps/tests/libtest.sh
+++ b/apps/tests/libtest.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 #
 # Copyright (C) 2017 - 2025, Stephan Mueller <smueller@chronox.de>
 #
@@ -34,8 +34,8 @@ KERNVER=$(uname -r)
 color()
 {
 	bg=0
-	echo -ne "\033[0m"
-	while [[ $# -gt 0 ]]; do
+	printf '\033[0m'
+	while [ "$#" -gt 0 ]; do
 		code=0
 		case $1 in
 			black) code=30 ;;
@@ -51,7 +51,10 @@ color()
 			reset|off|default) code=0 ;;
 			bold|bright) code=1 ;;
 		esac
-		[[ $code == 0 ]] || echo -ne "\033[$(printf "%02d" $((code+bg)))m"
+		if [ "$code" -ne 0 ]
+		then
+			printf '\033[%02dm' "$((code + bg))"
+		fi
 		shift
 	done
 }
diff --git a/asn1/tests/testcerts/lc_gen_4way_cert_chain.sh b/asn1/tests/testcerts/lc_gen_4way_cert_chain.sh
index d0f8a72..0a10677 100755
--- a/asn1/tests/testcerts/lc_gen_4way_cert_chain.sh
+++ b/asn1/tests/testcerts/lc_gen_4way_cert_chain.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 #
 # Generate a 4-way certificate chain using leancrypto
 #
diff --git a/build-scripts/aesgcm-only.sh b/build-scripts/aesgcm-only.sh
index 39bb0a3..739cf4f 100755
--- a/build-scripts/aesgcm-only.sh
+++ b/build-scripts/aesgcm-only.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 #
 # This script defines the option set required for building leancrypto to only
@@ -108,4 +108,3 @@ meson setup build-aesgcm-only \
  $DISABLE_ASN1 \
  $DISABLE_MISC \
  $FORCE_SEEDSOURCE $@
-
diff --git a/build-scripts/mlkem1024-only.sh b/build-scripts/mlkem1024-only.sh
index 1b2ff3e..e4ee316 100755
--- a/build-scripts/mlkem1024-only.sh
+++ b/build-scripts/mlkem1024-only.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 #
 # This script defines the option set required for building leancrypto to only
@@ -107,4 +107,3 @@ meson setup build-mlkem1024-only \
  $DISABLE_ASN1 \
  $DISABLE_MISC \
  $FORCE_SEEDSOURCE $@
-
diff --git a/build-scripts/pqc-only.sh b/build-scripts/pqc-only.sh
index e1b70da..10534d0 100755
--- a/build-scripts/pqc-only.sh
+++ b/build-scripts/pqc-only.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 #
 # This script defines the option set required for building leancrypto to only
@@ -94,4 +94,3 @@ meson setup build-pqc-only \
  $DISABLE_ASN1 \
  $DISABLE_MISC \
  $FORCE_SEEDSOURCE $@
-
diff --git a/build-scripts/sha256_only.sh b/build-scripts/sha256_only.sh
index fbe228a..6d43a4f 100755
--- a/build-scripts/sha256_only.sh
+++ b/build-scripts/sha256_only.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 #
 # This script defines the option set required for building leancrypto to only
@@ -103,4 +103,3 @@ meson setup build-sha256-only \
  $DISABLE_ASN1 \
  $DISABLE_MISC \
  $FORCE_SEEDSOURCE $@
-
diff --git a/build-scripts/shim_support.sh b/build-scripts/shim_support.sh
index c97a002..f127423 100755
--- a/build-scripts/shim_support.sh
+++ b/build-scripts/shim_support.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 #
 # This script defines the option set required for building leancrypto to work
@@ -106,4 +106,3 @@ meson setup build-shim \
  $DISABLE_ASN1 \
  $DISABLE_MISC \
  $FORCE_SEEDSOURCE
-