diff --git a/src/freedombone-app-jitsi b/src/freedombone-app-jitsi
index 3b4587bfe3a684bf9bbf108dc172c69a29e3e73d..e209906915e0620f539dbee7bc563d00e06ed585 100755
--- a/src/freedombone-app-jitsi
+++ b/src/freedombone-app-jitsi
@@ -202,7 +202,7 @@ function remove_jitsi {
     fi
     sed -i "/jitsi/d" /etc/apt/sources.list
     rm /etc/apt/sources.list.d/jitsi*
-    apt-get update
+    $UPDATE_PACKAGES
 
     remove_app jitsi
     remove_completion_param install_jitsi
@@ -245,7 +245,7 @@ function install_jitsi {
         echo "deb http://download.jitsi.org/nightly/deb ${jitsi_deb_repo}/" >> /etc/apt/sources.list
     fi
     wget -qO - https://download.jitsi.org/nightly/deb/${jitsi_deb_repo}/archive.key | apt-key add -
-    apt-get update
+    $UPDATE_PACKAGES
 
     JITSI_ONION_HOSTNAME=$(add_onion_service jitsi 80 ${JITSI_ONION_PORT})
 
diff --git a/src/freedombone-app-syncthing b/src/freedombone-app-syncthing
index 8950bc6ccfcf677a5660c27b3eb9a56c87bab2a4..d6126b842fec066ca1028832bbd30705bcf42bf8 100755
--- a/src/freedombone-app-syncthing
+++ b/src/freedombone-app-syncthing
@@ -530,7 +530,7 @@ function install_syncthing_repo {
     $INSTALL_PACKAGES curl
     curl -s https://syncthing.net/release-key.txt | apt-key add -
     echo "deb http://apt.syncthing.net/ syncthing release" | tee /etc/apt/sources.list.d/syncthing.list
-    apt-get update
+    $UPDATE_PACKAGES
 }
 
 function install_syncthing {
diff --git a/src/freedombone-app-tox b/src/freedombone-app-tox
index 9bce0ccf0e693df43cdb89c3c264542fe7421d2a..100d81b0a2459457a87039d585fe10a4b94d3f09 100755
--- a/src/freedombone-app-tox
+++ b/src/freedombone-app-tox
@@ -786,7 +786,8 @@ rm /root/tox.key
 EOF
     chroot "$rootdir" chmod +x /root/gettoxkey.sh
     chroot "$rootdir" /root/gettoxkey.sh
-    chroot "$rootdir" apt-get update
+    # shellcheck disable=SC2086
+    chroot "$rootdir" $UPDATE_PACKAGES
     echo "Tox Repository Installed."
 }
 
diff --git a/src/freedombone-app-xmpp b/src/freedombone-app-xmpp
index 3727bad55d3ecfea37c361f4a35c1b4febd9c1d6..4d4e5415e0eddcbd7c150d6f0c77f85bc3281a86 100755
--- a/src/freedombone-app-xmpp
+++ b/src/freedombone-app-xmpp
@@ -658,7 +658,7 @@ function remove_xmpp {
     function_check remove_onion_service
     remove_onion_service xmpp 5222 5223 5269
 
-    apt-mark -q unhold prosody
+    $PACKAGE_UNHOLD prosody
     $REMOVE_PACKAGES_PURGE prosody
     rm /etc/cron.daily/prosody
     if [ -f "$INSTALL_DIR/$prosody_modules_filename" ]; then
@@ -1214,7 +1214,7 @@ function install_xmpp {
         sed -i 's|/etc/ssl/certs/xmpp.dhparam|/etc/prosody/xmpp.dhparam|g' /etc/prosody/conf.avail/xmpp.cfg.lua
     fi
 
-    apt-mark -q hold prosody
+    $PACKAGE_HOLD prosody
     systemctl restart prosody
 
     if [[ $ONION_ONLY != 'no' ]]; then
diff --git a/src/freedombone-base-email b/src/freedombone-base-email
index 8ce4da0c8037f6dfc2cb98647d92d441e88fb447..d155252cce6ef74cfd5dab6cbbece576a0e352dc 100755
--- a/src/freedombone-base-email
+++ b/src/freedombone-base-email
@@ -156,14 +156,14 @@ function rebuild_exim_with_socks {
         echo "exim4_${exim_version}_all.deb not found"
         exit 63857368
     fi
-    apt-mark -q unhold exim4
+    $PACKAGE_UNHOLD exim4
     dpkg -i exim4_${exim_version}_all.deb
-    apt-mark -q hold exim4
+    $PACKAGE_HOLD exim4
     $REMOVE_PACKAGES_PURGE at
 
     systemctl restart exim4
     if [[ $(systemctl is-active exim4) != 'active' ]]; then
-        apt-mark -q unhold exim4
+        $PACKAGE_UNHOLD exim4
         $INSTALL_PACKAGES exim4 --reinstall
         systemctl restart exim4
     fi
diff --git a/src/freedombone-image-customise b/src/freedombone-image-customise
index 8e357b706b240bb4af80da7397580efc0627e7a3..04f56a103a4ad0a854595824d7ad0be831bb57f0 100755
--- a/src/freedombone-image-customise
+++ b/src/freedombone-image-customise
@@ -914,7 +914,8 @@ initialise_mesh() {
             chroot "$rootdir" /bin/sed -i "s| main| main non-free|g" /etc/apt/sources.list
         fi
 
-        chroot "$rootdir" apt-get update
+        # shellcheck disable=SC2086
+        chroot "$rootdir" $UPDATE_PACKAGES
 
         # install proprietary wifi drivers
         # see https://wiki.debian.org/iwlwifi
@@ -1675,7 +1676,8 @@ EOF
 
         # xmpp client
         chroot "$rootdir" echo "deb ftp://ftp.gajim.org/debian unstable main" > /etc/apt/sources.list.d/gajim.list
-        chroot "$rootdir" apt-get update
+        # shellcheck disable=SC2086
+        chroot "$rootdir" $UPDATE_PACKAGES
         # shellcheck disable=SC2086
         chroot "$rootdir" $INSTALL_PACKAGES gajim-dev-keyring
         # shellcheck disable=SC2086
@@ -2122,7 +2124,9 @@ chroot "$rootdir" apt-get clean
 set_apt_sources "$MIRROR"
 configure_backports
 configure_contrib_repo
-chroot "$rootdir" apt-get update
+# shellcheck disable=SC2086
+chroot "$rootdir" $UPDATE_PACKAGES
+# shellcheck disable=SC2086
 chroot "$rootdir" $INSTALL_PACKAGES apt-utils
 
 cat > "$rootdir/usr/sbin/policy-rc.d" <<EOF
diff --git a/src/freedombone-mesh-install b/src/freedombone-mesh-install
index 483b595e9ba01381061dd3392e345146d03eadd6..fad6cbb55ee1a18dd4af9940b386b6b45e0b6a9f 100755
--- a/src/freedombone-mesh-install
+++ b/src/freedombone-mesh-install
@@ -267,7 +267,8 @@ function enable_tox_repo {
     sudo sh -c "echo 'deb http://download.opensuse.org/repositories/home:/antonbatenev:/tox/Debian_9.0/ /' > /etc/apt/sources.list.d/tox.list"
     wget http://download.opensuse.org/repositories/home:antonbatenev:tox/Debian_9.0/Release.key
     sudo sh -c "apt-key add - < Release.key"
-    sudo apt-get update
+    # shellcheck disable=SC2086
+    sudo $UPDATE_PACKAGES
     echo "Tox Repository Installed."
 }
 
diff --git a/src/freedombone-shortcuts b/src/freedombone-shortcuts
index 374ae1720c0dbc6773407164ab523b16a75ee9e9..f7822918e4a1ed03140e0c6146f1b1c9af457b7f 100755
--- a/src/freedombone-shortcuts
+++ b/src/freedombone-shortcuts
@@ -32,4 +32,9 @@ INSTALL_PACKAGES_BACKPORTS='apt-get -yq -t stretch-backports install'
 REMOVE_PACKAGES='apt-get -yq remove'
 REMOVE_PACKAGES_PURGE='apt-get -yq remove --purge'
 
+UPDATE_PACKAGES='apt-get update'
+
+PACKAGE_HOLD='apt-mark -q hold'
+PACKAGE_UNHOLD='apt-mark -q unhold'
+
 # NOTE: deliberately there is no "exit 0"
diff --git a/src/freedombone-utils-config b/src/freedombone-utils-config
index 6d94e192a275d4b5592fc66c4072252a4d9ad342..2b1883c5039b0bef4b5d8029538dc4c68d63f8bc 100755
--- a/src/freedombone-utils-config
+++ b/src/freedombone-utils-config
@@ -307,7 +307,7 @@ function read_configuration_values {
         if grep -q "DEBIAN_REPO" "$CONFIGURATION_FILE"; then
             read_config_param "DEBIAN_REPO"
             # shellcheck disable=SC2034
-            CHECK_MESSAGE=$"Check your internet connection, /etc/network/interfaces and /etc/resolvconf/resolv.conf.d/head, then delete $COMPLETION_FILE, run 'rm -fR /var/lib/apt/lists/* && apt-get update --fix-missing' and run this script again. If hash sum mismatches persist then try setting $DEBIAN_REPO to a different mirror and also change /etc/apt/sources.list."
+            CHECK_MESSAGE=$"Check your internet connection, /etc/network/interfaces and /etc/resolvconf/resolv.conf.d/head, then delete $COMPLETION_FILE, run 'rm -fR /var/lib/apt/lists/* && $UPDATE_PACKAGES --fix-missing' and run this script again. If hash sum mismatches persist then try setting $DEBIAN_REPO to a different mirror and also change /etc/apt/sources.list."
         fi
     fi
 }
diff --git a/src/freedombone-utils-database b/src/freedombone-utils-database
index 80d32e40bce14309f7477f4f6dc2cc1b6a690513..c8bbf9ea4084b79b8002d2ee9c41cb12b4f1af40 100755
--- a/src/freedombone-utils-database
+++ b/src/freedombone-utils-database
@@ -413,7 +413,7 @@ function install_rethinkdb {
     echo "deb http://download.rethinkdb.com/apt $DEBIAN_VERSION main" | tee /etc/apt/sources.list.d/rethinkdb.list
 
     wget -qO- https://download.rethinkdb.com/apt/pubkey.gpg | apt-key add -
-    apt-get update
+    $UPDATE_PACKAGES
     $INSTALL_PACKAGES rethinkdb
 
     { echo 'runuser=rethinkdb';
@@ -449,7 +449,7 @@ function remove_rethinkdb {
     fi
     if [ -f /etc/apt/sources.list.d/rethinkdb.list ]; then
         rm /etc/apt/sources.list.d/rethinkdb.list
-        apt-get update
+        $UPDATE_PACKAGES
     fi
 }
 
diff --git a/src/freedombone-utils-i2p b/src/freedombone-utils-i2p
index 7c674fb01c1b2b61a7fb59ada4900fbc9dfa2980..e426caeacc116473cafa41da1ba5cd9cd7805706 100755
--- a/src/freedombone-utils-i2p
+++ b/src/freedombone-utils-i2p
@@ -55,7 +55,7 @@ function install_i2p {
     sed -i 's|net.ipv6.conf.all.disable_ipv6.*|net.ipv6.conf.all.disable_ipv6 = 0|g' /etc/sysctl.conf
     /sbin/sysctl -p -q
 
-    apt-get update
+    $UPDATE_PACKAGES
     $INSTALL_PACKAGES i2p i2p-keyring
     systemctl restart i2p
 }
diff --git a/src/freedombone-utils-nodejs b/src/freedombone-utils-nodejs
index 3b610641c3e91e428788c54738ed549ae65b3234..edf3d8cccfb2b22f9ec5be50f5464eb66b16b145 100755
--- a/src/freedombone-utils-nodejs
+++ b/src/freedombone-utils-nodejs
@@ -111,8 +111,10 @@ function mesh_install_nodejs {
     echo "deb https://deb.nodesource.com/node_8.x stretch main" > "$rootdir/etc/apt/sources.list.d/nodesource.list"
     echo "deb-src https://deb.nodesource.com/node_8.x stretch main" >> "$rootdir/etc/apt/sources.list.d/nodesource.list"
 
-    $mesh_install_nodejs_prefix apt-mark -q unhold nodejs
-    $mesh_install_nodejs_prefix apt-get update
+    # shellcheck disable=SC2086
+    $mesh_install_nodejs_prefix $PACKAGE_UNHOLD nodejs
+    # shellcheck disable=SC2086
+    $mesh_install_nodejs_prefix $UPDATE_PACKAGES
     # shellcheck disable=SC2086
     $mesh_install_nodejs_prefix $REMOVE_PACKAGES_PURGE nodejs
 
@@ -143,7 +145,8 @@ function mesh_install_nodejs {
         cp "$rootdir/usr/bin/node" "$rootdir/usr/local/bin/node"
     fi
 
-    $mesh_install_nodejs_prefix apt-mark -q hold nodejs
+    # shellcheck disable=SC2086
+    $mesh_install_nodejs_prefix $PACKAGE_HOLD nodejs
 
     if [ ! -f "${rootdir}/usr/bin/node" ]; then
         if [ ! -f "${rootdir}/usr/local/bin/node" ]; then
diff --git a/src/freedombone-utils-repos b/src/freedombone-utils-repos
index 984c312af9e8ebb0d1be3078234563537378f885..5c3e8ef8626211ba7b006b12ac48ccc9ec0467a6 100755
--- a/src/freedombone-utils-repos
+++ b/src/freedombone-utils-repos
@@ -48,7 +48,7 @@ function create_repo_sources {
       echo "deb http://${DEBIAN_REPO}/debian/ ${DEBIAN_VERSION}-backports main";
       echo "deb-src http://${DEBIAN_REPO}/debian/ ${DEBIAN_VERSION}-backports main"; } > /etc/apt/sources.list
 
-    apt-get update
+    $UPDATE_PACKAGES
     $INSTALL_PACKAGES apt-transport-https
 
     mark_completed "${FUNCNAME[0]}"
diff --git a/src/freedombone-utils-setup b/src/freedombone-utils-setup
index e5a0b8533c5f336e12dbeb723193364667756a76..97936a65efd33ae7a1ed5fc89d437504214641a4 100755
--- a/src/freedombone-utils-setup
+++ b/src/freedombone-utils-setup
@@ -78,7 +78,7 @@ COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt
 REMOTE_BACKUPS_LOG=/var/log/remotebackups.log
 
 # message if something fails to install
-CHECK_MESSAGE="Check your internet connection, /etc/network/interfaces and /etc/resolvconf/resolv.conf.d/head, then delete $COMPLETION_FILE, run 'rm -fR /var/lib/apt/lists/* && apt-get update --fix-missing' and run this script again. If hash sum mismatches persist then try setting $DEBIAN_REPO to a different mirror and also change /etc/apt/sources.list."
+CHECK_MESSAGE="Check your internet connection, /etc/network/interfaces and /etc/resolvconf/resolv.conf.d/head, then delete $COMPLETION_FILE, run 'rm -fR /var/lib/apt/lists/* && $UPDATE_PACKAGES --fix-missing' and run this script again. If hash sum mismatches persist then try setting $DEBIAN_REPO to a different mirror and also change /etc/apt/sources.list."
 
 # Default diffie-hellman key length in bits
 DH_KEYLENGTH=2048