diff --git a/pkgs/by-name/db/dbeaver-bin/update.sh b/pkgs/by-name/db/dbeaver-bin/update.sh
index cda09005e38e..5f34be06e7d5 100755
--- a/pkgs/by-name/db/dbeaver-bin/update.sh
+++ b/pkgs/by-name/db/dbeaver-bin/update.sh
@@ -2,6 +2,8 @@
 #!nix-shell -I nixpkgs=./. -i bash -p curl jq common-updater-scripts
 BASEDIR="$(dirname "$0")/../../../.."
 
+set -euo pipefail
+
 latestVersion=$(curl "https://api.github.com/repos/dbeaver/dbeaver/tags" | jq -r '.[0].name')
 currentVersion=$(nix-instantiate --eval -E "with import ${BASEDIR} {}; lib.getVersion dbeaver-bin" | tr -d '"')
 
@@ -19,9 +21,10 @@ for i in \
     "x86_64-darwin macos-x86_64.dmg" \
     "aarch64-darwin macos-aarch64.dmg"
 do
+    # shellcheck disable=SC2086 # $i is intentionally splitted to $1 and $2
     set -- $i
     prefetch=$(nix-prefetch-url "https://github.com/dbeaver/dbeaver/releases/download/$latestVersion/dbeaver-ce-$latestVersion-$2")
-    hash=$(nix-hash --type sha256 --to-sri $prefetch)
+    hash=$(nix-hash --type sha256 --to-sri "$prefetch")
 
-    (cd "$BASEDIR" && update-source-version dbeaver-bin $latestVersion $hash --system=$1 --ignore-same-version)
+    (cd "$BASEDIR" && update-source-version dbeaver-bin "$latestVersion" "$hash" --system="$1" --ignore-same-version)
 done