diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index ffb55b767..cf13e1e80 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -106,7 +106,6 @@
             enable = true;
             excludes = [
               # We haven't linted these files yet
-              ''^tests/functional/nested-sandboxing/command\.sh$''
               ''^tests/functional/nix-build\.sh$''
               ''^tests/functional/nix-channel\.sh$''
               ''^tests/functional/nix-collect-garbage-d\.sh$''
diff --git a/tests/functional/nested-sandboxing/command.sh b/tests/functional/nested-sandboxing/command.sh
index 7c04e82f5..c01133d93 100644
--- a/tests/functional/nested-sandboxing/command.sh
+++ b/tests/functional/nested-sandboxing/command.sh
@@ -1,17 +1,20 @@
+# shellcheck shell=bash
 set -eu -o pipefail
 
-export NIX_BIN_DIR=$(dirname $(type -p nix))
+NIX_BIN_DIR=$(dirname "$(type -p nix)")
+export NIX_BIN_DIR
 # TODO Get Nix and its closure more flexibly
-export EXTRA_SANDBOX="/nix/store $(dirname $NIX_BIN_DIR)"
+EXTRA_SANDBOX="/nix/store $(dirname "$NIX_BIN_DIR")"
+export EXTRA_SANDBOX
 
 badStoreUrl () {
     local altitude=$1
-    echo $TEST_ROOT/store-$altitude
+    echo "$TEST_ROOT"/store-"$altitude"
 }
 
 goodStoreUrl () {
     local altitude=$1
-    echo $("badStoreUrl" "$altitude")?store=/foo-$altitude
+    echo "$("badStoreUrl" "$altitude")"?store=/foo-"$altitude"
 }
 
 # The non-standard sandbox-build-dir helps ensure that we get the same behavior