diff --git a/pkgs/clan-cli/clan_cli/conftest.py b/pkgs/clan-cli/clan_cli/conftest.py
index 12d1b89ff..dd1238802 100644
--- a/pkgs/clan-cli/clan_cli/conftest.py
+++ b/pkgs/clan-cli/clan_cli/conftest.py
@@ -28,4 +28,4 @@ def pytest_sessionstart(session: pytest.Session) -> None:
     # You can access the session config, items, testsfailed, etc.
     print(f"Session config: {session.config}")
 
-    setup_logging(level="DEBUG")
+    setup_logging(level="INFO")
diff --git a/pkgs/clan-cli/clan_cli/nix/allowed-programs.json b/pkgs/clan-cli/clan_cli/nix/allowed-programs.json
index 128be9a3a..441e9e3f5 100644
--- a/pkgs/clan-cli/clan_cli/nix/allowed-programs.json
+++ b/pkgs/clan-cli/clan_cli/nix/allowed-programs.json
@@ -15,7 +15,7 @@
   "tor",
   "virtiofsd",
   "zbar",
-  "shellcheck",
+  "shellcheck-minimal",
   "util-linux",
   "avahi",
   "gnupg"
diff --git a/pkgs/clan-cli/clan_cli/tests/test_vars.py b/pkgs/clan-cli/clan_cli/tests/test_vars.py
index 9c0789338..b007c14f4 100644
--- a/pkgs/clan-cli/clan_cli/tests/test_vars.py
+++ b/pkgs/clan-cli/clan_cli/tests/test_vars.py
@@ -782,17 +782,17 @@ def test_migration(
     my_service["public"]["my_value"] = {}
     my_service["secret"]["my_secret"] = {}
     my_service["generator"]["script"] = (
-        "echo -n hello > $facts/my_value && echo -n hello > $secrets/my_secret"
+        'echo -n hello > "$facts"/my_value && echo -n hello > "$secrets"/my_secret'
     )
     my_generator = config["clan"]["core"]["vars"]["generators"]["my_generator"]
     my_generator["files"]["my_value"]["secret"] = False
     my_generator["files"]["my_secret"]["secret"] = True
     my_generator["migrateFact"] = "my_service"
-    my_generator["script"] = "echo -n other > $out/my_value"
+    my_generator["script"] = 'echo -n other > "$out"/my_value'
 
     other_service = config["clan"]["core"]["facts"]["services"]["other_service"]
     other_service["secret"]["other_value"] = {}
-    other_service["generator"]["script"] = "echo -n hello > $secrets/other_value"
+    other_service["generator"]["script"] = 'echo -n hello > "$secrets"/other_value'
     other_generator = config["clan"]["core"]["vars"]["generators"]["other_generator"]
     # the var to migrate to is mistakenly marked as not secret (migration should fail)
     other_generator["files"]["other_value"]["secret"] = False
@@ -804,6 +804,7 @@ def test_migration(
     cli.run(["facts", "generate", "--flake", str(flake.path), "my_machine"])
     with caplog.at_level(logging.INFO):
         cli.run(["vars", "generate", "--flake", str(flake.path), "my_machine"])
+
     assert "Migrated var my_generator/my_value" in caplog.text
     assert "Migrated secret var my_generator/my_secret" in caplog.text
     in_repo_store = in_repo.FactStore(
diff --git a/pkgs/clan-cli/default.nix b/pkgs/clan-cli/default.nix
index c884afe3f..4f771e35b 100644
--- a/pkgs/clan-cli/default.nix
+++ b/pkgs/clan-cli/default.nix
@@ -16,7 +16,6 @@
   classgen,
   pythonRuntime,
   templateDerivation,
-  shellcheck,
 }:
 let
   pyDeps = ps: [
@@ -52,7 +51,6 @@ let
   testDependencies = testRuntimeDependencies ++ [
     gnupg
     stdenv.cc # Compiler used for certain native extensions
-    shellcheck
     (pythonRuntime.withPackages pyTestDeps)
   ];
 
@@ -143,7 +141,6 @@ pythonRuntime.pkgs.buildPythonApplication {
                 templateDerivation
               ];
             };
-
           }
           ''
             set -u -o pipefail
@@ -190,6 +187,7 @@ pythonRuntime.pkgs.buildPythonApplication {
                 pkgs.jq.dev
                 pkgs.stdenv
                 pkgs.stdenvNoCC
+                pkgs.shellcheck-minimal
               ];
             };
           }
diff --git a/pkgs/clan-cli/flake-module.nix b/pkgs/clan-cli/flake-module.nix
index 756e3eb17..c3da9b750 100644
--- a/pkgs/clan-cli/flake-module.nix
+++ b/pkgs/clan-cli/flake-module.nix
@@ -88,12 +88,6 @@
         rootPaths =
           builtins.attrValues (self.clanLib.select "clan.templates.clan.*.path" self)
           ++ builtins.attrValues (self.clanLib.select "clan.templates.machine.*.path" self);
-
-        # FIXME: As the templates get modified in clanCoreWithVendoredDeps below, we need to add the modified version to the nix store too
-        # However it is not possible (or I don't know how) to add a nix path from a built derivation to the nix store
-        # rootPaths = [
-        #   clanCoreWithVendoredDeps.clan.templates.clan.minimal.path
-        # ];
       };
 
       clanCoreWithVendoredDeps =