diff --git a/home/.chezmoitemplates/universal/logg b/home/.chezmoitemplates/universal/logg
index 5b516986..c32b50c4 100644
--- a/home/.chezmoitemplates/universal/logg
+++ b/home/.chezmoitemplates/universal/logg
@@ -84,13 +84,13 @@ if [ "${container:=}" != 'docker' ]; then
   # If gum's path was set, then turn on enhanced logging
   if [ -n "$GUM_PATH" ]; then
     chmod +x "$GUM_PATH"
-    ENHANCED_LOGGING=true
   fi
 fi
 
 format() {
   # shellcheck disable=SC2001,SC2016
   ANSI_STR_FORMATTED="$(echo "$1" | sed 's/^\([^`]*\)`\([^`]*\)`.*/\1\\u001b[47;30m \2 \\e[49;m/')"
+  # shellcheck disable=SC2001,SC2016
   ANSI_STR="$(echo "$1" | sed 's/^\([^`]*\)`\([^`]*\)`\(.*\)$/\3/')"
   if [ "$ANSI_STR_FORMATTED" != "$ANSI_STR" ]; then
     if [[ $ANSI_STR == *'`'*'`'* ]]; then
@@ -105,6 +105,7 @@ format() {
 formatFaint() {
   # shellcheck disable=SC2001,SC2016
   ANSI_STR_FORMATTED="$(echo "$1" | sed 's/^\([^`]*\)`\([^`]*\)`.*/\1\\u001b[47;30m \2 \\e[49;m/')"
+  # shellcheck disable=SC2001,SC2016
   ANSI_STR="$(echo "$1" | sed 's/^\([^`]*\)`\([^`]*\)`\(.*\)$/\3/')"
   if [ "$ANSI_STR_FORMATTED" != "$ANSI_STR" ]; then
     if [[ $ANSI_STR == *'`'*'`'* ]]; then
@@ -146,7 +147,6 @@ logg() {
 
       if [ -n "$GLOW_PATH" ]; then
         chmod +x "$GLOW_PATH"
-        ENHANCED_LOGGING=true
       fi
     fi
     "$GLOW_PATH" "$MSG"
diff --git a/home/dot_local/bin/executable_provision.tmpl b/home/dot_local/bin/executable_provision.tmpl
index f77f3b0b..93848b4f 100644
--- a/home/dot_local/bin/executable_provision.tmpl
+++ b/home/dot_local/bin/executable_provision.tmpl
@@ -9,7 +9,6 @@ if command -v qubesctl > /dev/null; then
 
   # Ensure sys-whonix is configured (for Qubes dom0)
   CONFIG_WIZARD_COUNT=0
-  ENABLE_OBFSC='false'
   function configureWizard() {
     if xwininfo -root -tree | grep "Anon Connection Wizard"; then
       WINDOW_ID="$(xwininfo -root -tree | grep "Anon Connection Wizard" | sed 's/^ *\([^ ]*\) .*/\1/')"
@@ -18,7 +17,7 @@ if command -v qubesctl > /dev/null; then
       sleep 3
       qvm-start sys-whonix
       if xwininfo -root -tree | grep "systemcheck | Whonix" > /dev/null; then
-        WINDOW_ID_SYSCHECK="$(xwininfo -root -tree | grep "systemcheck | Whonix" | sed 's/^ *\([^ ]*\) .*/\1/')"
+        WINDOW_ID_SYS_CHECK="$(xwininfo -root -tree | grep "systemcheck | Whonix" | sed 's/^ *\([^ ]*\) .*/\1/')"
         if xdotool windowactivate "$WINDOW_ID_SYS_CHECK"; then
           sleep 1
           xdotool key 'Enter'
@@ -53,8 +52,8 @@ if command -v qubesctl > /dev/null; then
   if [ ! -f /root/templatevms-updated ]; then
     # timeout of 10 minutes is added here because the whonix-gw VM does not like to get updated
     # with this method. Anyone know how to fix this?
-    sudo timeout 600 qubesctl --show-output --skip-dom0 --templates state.sls update.qubes-vm &> /dev/null || EXIT_CODE=$?
-    while read RESTART_VM; do
+    sudo timeout 600 qubesctl --show-output --skip-dom0 --templates state.sls update.qubes-vm &> /dev/null || true
+    while read -r RESTART_VM; do
       qvm-shutdown --wait "$RESTART_VM"
     done< <(qvm-ls --all --no-spinner --fields=name,state | grep Running | grep -v sys-net | grep -v sys-firewall | grep -v sys-whonix | grep -v dom0 | awk '{print $1}')
     sudo touch /root/templatevms-updated
@@ -64,13 +63,14 @@ if command -v qubesctl > /dev/null; then
   echo "/bin/bash" | sudo tee /etc/qubes-rpc/qubes.VMShell
   sudo chmod 755 /etc/qubes-rpc/qubes.VMShell
   echo "$ANSIBLE_PROVISION_VM"' dom0 allow' | sudo tee /etc/qubes-rpc/policy/qubes.VMShell
+  # shellcheck disable=SC2016
   echo "$ANSIBLE_PROVISION_VM"' $anyvm allow' | sudo tee -a /etc/qubes-rpc/policy/qubes.VMShell
   sudo chown "$(whoami):$(whoami)" /etc/qubes-rpc/policy/qubes.VMShell
   sudo chmod 644 /etc/qubes-rpc/policy/qubes.VMShell
 
 
   ### Create provisioning VM and initialize the provisioning process from there
-  qvm-create --label red --template debian-11 "$ANSIBLE_PROVISION_VM" &> /dev/null || EXIT_CODE=$?
+  qvm-create --label red --template debian-11 "$ANSIBLE_PROVISION_VM" &> /dev/null || true
   qvm-volume extend "$ANSIBLE_PROVISION_VM:private" "40G"
   if [ -f ~/.vaultpass ]; then
     qvm-run "$ANSIBLE_PROVISION_VM" 'rm -f ~/QubesIncoming/dom0/.vaultpass'
@@ -83,6 +83,7 @@ fi
 
 ### System package manager update / Homebrew dependencies
 if ! command -v curl > /dev/null || ! command -v git > /dev/null; then
+  # shellcheck disable=SC2016
   logg info 'Ensuring `curl` and `git` are installed via the system package manager'
   if command -v apt-get > /dev/null; then
     # Debian / Ubuntu
@@ -173,7 +174,7 @@ if [ -d /usr/local/src/hiawatha ] && [ ! -w /usr/local/src/hiawatha ]; then
 fi
 if [ -d /usr/local/src/hiawatha/.git ]; then
   logg info 'Pulling the latest changes from https://gitlab.com/megabyte-labs/dotfiles.git to /usr/local/src/hiawatha'
-  cd /usr/local/src/hiawatha
+  cd /usr/local/src/hiawatha || exit 1
   git config pull.rebase false
   git reset --hard HEAD
   git clean -fxd
@@ -200,7 +201,7 @@ logg success 'Successfully updated the ~/.local/share/chezmoi folder with change
 
 ### Ensure ~/.local/bin files are executable
 logg info 'Ensuring scripts in ~/.local/bin are executable'
-find "$HOME/.local/bin" -maxdepth 1 -mindepth 1 -type f | while read BINFILE; do
+find "$HOME/.local/bin" -maxdepth 1 -mindepth 1 -type f | while read -r BINFILE; do
   chmod +x "$BINFILE"
 done
 
@@ -219,12 +220,13 @@ if [ ! -f "$HOME/.config/chezmoi/chezmoi.yaml" ]; then
       export SOFTWARE_GROUP
     fi
   fi
-
+  # shellcheck disable=SC2016
   logg info 'Running `chezmoi init` since the ~/.config/chezmoi/chezmoi.yaml is not present'
   chezmoi init
 fi
 
 ### Run chezmoi apply
+# shellcheck disable=SC2016
 logg info 'Running `chezmoi apply`'
 if [ -n "$FORCE_CHEZMOI" ]; then
   chezmoi apply --force