diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 397d28a..284328f 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -8,15 +8,17 @@ jobs:
   test:
     name: Run Unit Tests
     runs-on: ubuntu-latest
+    container:
+      image: busybox
+      options: --user root
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
-
+        uses: actions/checkout@v3
       - name: Set up shell environment
         run: |
-          sudo apt-get update
-          sudo apt-get install -y shellcheck
+          apk update
+          apk add shellcheck
         shell: bash
 
       - name: Run shellcheck
@@ -25,6 +27,5 @@ jobs:
       - name: Run unit tests
         run: |
           cd scripts
-          chmod +x upgrade.sh tests.sh
           ./tests.sh
         shell: bash
diff --git a/scripts/upgrade.sh b/scripts/upgrade.sh
index 24b126c..f943a69 100755
--- a/scripts/upgrade.sh
+++ b/scripts/upgrade.sh
@@ -49,7 +49,7 @@ get_k3s_process_info() {
   if [ "$K3S_PID" = "1" ]; then
     K3S_BIN_PATH="/bin/k3s"
   else
-    K3S_BIN_PATH=$(awk 'NR==1 {print $1}' /host/proc/"${K3S_PID}"/cmdline)
+    K3S_BIN_PATH=$(awk 'NR==1 {print $1}' "/host/proc/${K3S_PID}/cmdline")
   fi
 
   if [ -z "$K3S_BIN_PATH" ]; then
@@ -67,7 +67,7 @@ replace_binary() {
   fi
 
   info "Comparing old and new binaries"
-  BIN_CHECKSUMS="$(sha256sum $NEW_BINARY "$FULL_BIN_PATH")"
+  BIN_CHECKSUMS="$(sha256sum "$NEW_BINARY" "$FULL_BIN_PATH")"
 
   if [ "$?" != "0" ]; then
     fatal "Failed to calculate binary checksums"
@@ -107,7 +107,7 @@ replace_binary() {
 
   K3S_CONTEXT=$(getfilecon "$FULL_BIN_PATH" 2>/dev/null | awk '{print $2}' || true)
   info "Deploying new k3s binary to $K3S_BIN_PATH"
-  cp $NEW_BINARY "$FULL_BIN_PATH"
+  cp "$NEW_BINARY" "$FULL_BIN_PATH"
 
   if [ -n "${K3S_CONTEXT}" ]; then
     info 'Restoring k3s bin context'