diff --git a/cmd/fpkg/main.go b/cmd/fpkg/main.go
index e95a36c..c9e68c2 100644
--- a/cmd/fpkg/main.go
+++ b/cmd/fpkg/main.go
@@ -9,10 +9,10 @@ import (
 	"git.gensokyo.uk/security/fortify/internal/fmsg"
 )
 
-const shell = "/run/current-system/sw/bin/bash"
+const shellPath = "/run/current-system/sw/bin/bash"
 
 func init() {
-	if err := os.Setenv("SHELL", shell); err != nil {
+	if err := os.Setenv("SHELL", shellPath); err != nil {
 		log.Fatalf("cannot set $SHELL: %v", err)
 	}
 }
diff --git a/cmd/fpkg/start.go b/cmd/fpkg/start.go
index 71e0028..29f14b4 100644
--- a/cmd/fpkg/start.go
+++ b/cmd/fpkg/start.go
@@ -80,7 +80,7 @@ func actionStart(args []string) {
 	if !dropShell {
 		command[0] = app.Launcher
 	} else {
-		command[0] = shell
+		command[0] = shellPath
 	}
 	command = append(command, args[1:]...)
 
diff --git a/cmd/fpkg/with.go b/cmd/fpkg/with.go
index 6f5b225..b6928bd 100644
--- a/cmd/fpkg/with.go
+++ b/cmd/fpkg/with.go
@@ -15,7 +15,7 @@ func withNixDaemon(
 ) {
 	fortifyAppDropShell(updateConfig(&fst.Config{
 		ID: app.ID,
-		Command: []string{shell, "-lc", "rm -f /nix/var/nix/daemon-socket/socket && " +
+		Command: []string{shellPath, "-lc", "rm -f /nix/var/nix/daemon-socket/socket && " +
 			// start nix-daemon
 			"nix-daemon --store / & " +
 			// wait for socket to appear
@@ -59,7 +59,7 @@ func withNixDaemon(
 func withCacheDir(action string, command []string, workDir string, app *bundleInfo, pathSet *appPathSet, dropShell bool, beforeFail func()) {
 	fortifyAppDropShell(&fst.Config{
 		ID:      app.ID,
-		Command: []string{shell, "-lc", strings.Join(command, " && ")},
+		Command: []string{shellPath, "-lc", strings.Join(command, " && ")},
 		Confinement: fst.ConfinementConfig{
 			AppID:    app.AppID,
 			Username: "nixos",
@@ -92,7 +92,7 @@ func withCacheDir(action string, command []string, workDir string, app *bundleIn
 
 func fortifyAppDropShell(config *fst.Config, dropShell bool, beforeFail func()) {
 	if dropShell {
-		config.Command = []string{shell, "-l"}
+		config.Command = []string{shellPath, "-l"}
 		fortifyApp(config, beforeFail)
 		beforeFail()
 		internal.Exit(0)