diff --git a/base/univention-server/debug.sh b/base/univention-server/debug.sh
index 29ba3ee9ec..2f1e7e86fe 100644
--- a/base/univention-server/debug.sh
+++ b/base/univention-server/debug.sh
@@ -28,29 +28,26 @@
 # /usr/share/common-licenses/AGPL-3; if not, see
 # <https://www.gnu.org/licenses/>.
 
-function debug_info ()
-{
-    IFS='.,' read ESEC NSEC <<<"$EPOCHREALTIME"
-    printf "[%(%F %T)T.%06.0f]  DEBUG at %s:%s:%s: %s\n" "$ESEC" "$NSEC" "${BASH_SOURCE[1]}" "${BASH_LINENO[0]}" "${FUNCNAME[1]}" "$BASH_COMMAND" >&4
+debug_info () {
+    IFS='.,' read -r ESEC NSEC <<<"$EPOCHREALTIME"
+    printf '[%(%F %T)T.%06.0f]  DEBUG at %s:%s:%s: %s\n' "$ESEC" "$NSEC" "${BASH_SOURCE[1]}" "${BASH_LINENO[0]}" "${FUNCNAME[1]}" "$BASH_COMMAND" >&4
 }
 
 
-PAUSE_DEBUG ()
-{
+PAUSE_DEBUG () {
     set +o functrace
     trap - DEBUG
-    IFS='.,' read ESEC NSEC <<<"$EPOCHREALTIME"
-    printf "[%(%F %T)T.%06.0f]  PAUSE DEBUG\n" "$ESEC" "$NSEC" >&4
+    IFS='.,' read -r ESEC NSEC <<<"$EPOCHREALTIME"
+    printf '[%(%F %T)T.%06.0f]  PAUSE DEBUG\n' "$ESEC" "$NSEC" >&4
 }
 
-RESUME_DEBUG ()
-{
-    IFS='.,' read ESEC NSEC <<<"$EPOCHREALTIME"
-    printf "[%(%F %T)T.%06.0f]  RESUME DEBUG\n" "$ESEC" "$NSEC" >&4
+RESUME_DEBUG () {
+    IFS='.,' read -r ESEC NSEC <<<"$EPOCHREALTIME"
+    printf '[%(%F %T)T.%06.0f]  RESUME DEBUG\n' "$ESEC" "$NSEC" >&4
     set -o functrace
     trap "debug_info" DEBUG
 }
 
 
 set -o functrace
-trap "debug_info" DEBUG
\ No newline at end of file
+trap "debug_info" DEBUG
diff --git a/base/univention-server/server_password_change b/base/univention-server/server_password_change
index c87fe7ee59..af02f9857c 100755
--- a/base/univention-server/server_password_change
+++ b/base/univention-server/server_password_change
@@ -43,9 +43,8 @@ eval "$(/usr/sbin/univention-config-registry shell)"
 create_logfile_if_missing /var/log/univention/server_password_change.log "root:adm" 640
 
 tmpfile=$(mktemp /tmp/server_password_change.debug.XXXXXX)
-exec 4>>$tmpfile
-exec 3>>/var/log/univention/server_password_change.log
-exec 3> >(tee -ia  "/var/log/univention/server_password_change.log" $tmpfile  >/dev/null 2>/dev/null)
+exec 4>"$tmpfile"
+exec 3> >(exec tee -ia /var/log/univention/server_password_change.log >&4 2>/dev/null)
 
 echowithtimestamp "Starting server password change" >&3
 check_exit () {
@@ -55,13 +54,7 @@ check_exit () {
        trap - DEBUG
        exec 4<&-
 
-       if [ -e $new_pass ]; then
-               rm -f '$new_pass'
-       fi
-
-       if [ -e $old_pass ]; then
-               rm -f '$old_pass'
-       fi
+       rm -f "$new_pass" "$old_pass"
 
        if [ $return_code -ne 0 ]; then
                exec 3>>/var/log/univention/server_password_change.log
@@ -148,6 +141,7 @@ fi
 
 echowithtimestamp "Proceeding with regular server password change scheduled for today" >&3
 
+# shellcheck source=debug.sh
 . /usr/lib/univention-server/lib/server_password_change/debug.sh
 
 # Try to use a trivial command just to check that LDAP server is reachable.