diff --git a/update-keys b/update-keys
index cf68633..a6e7aa9 100755
--- a/update-keys
+++ b/update-keys
@@ -8,11 +8,11 @@ TMPDIR=$(mktemp -d)
 trap "rm -rf '${TMPDIR}'" EXIT
 
 KEYSERVER='hkp://pool.sks-keyservers.net'
-GPG="gpg --quiet --batch --no-tty --no-permission-warning --export-options no-export-attributes --keyserver "${KEYSERVER}" --homedir ${TMPDIR}"
+GPG=(gpg --quiet --batch --no-tty --no-permission-warning --export-options no-export-attributes --keyserver "${KEYSERVER}" --homedir "${TMPDIR}")
 
 pushd "$(dirname "$0")" >/dev/null
 
-$GPG --gen-key <<EOF
+"${GPG[@]}" --gen-key <<EOF
 %echo Generating Arch Linux keyring temporary master key...
 Key-Type: RSA
 Key-Length: 2048
@@ -25,7 +25,7 @@ Expire-Date: 0
 %echo Done
 EOF
 
-${GPG} --import < archlinux.gpg
+"${GPG[@]}" --import < archlinux.gpg
 
 rm -rf master{,-revoked} packager{,-revoked} archlinux-{trusted,revoked}
 mkdir master packager master-revoked packager-revoked
@@ -34,10 +34,10 @@ mkdir master packager master-revoked packager-revoked
 while read -ra data; do
 	keyid="${data[0]}"
 	username="${data[@]:1}"
-	if ${GPG} --list-keys ${keyid} >/dev/null &>/dev/null; then
-		${GPG} --refresh-keys ${keyid} &>/dev/null
+	if "${GPG[@]}" --list-keys ${keyid} >/dev/null &>/dev/null; then
+		"${GPG[@]}" --refresh-keys ${keyid} &>/dev/null
 	else
-		${GPG} --recv-keys ${keyid} &>/dev/null
+		"${GPG[@]}" --recv-keys ${keyid} &>/dev/null
 	fi
 done < <(cat master-keyids master-revoked-keyids packager-keyids packager-revoked-keyids)
 
@@ -45,19 +45,19 @@ done < <(cat master-keyids master-revoked-keyids packager-keyids packager-revoke
 while read -ra data; do
 	keyid="${data[0]}"
 	username="${data[@]:1}"
-	printf 'minimize\nquit\ny\n' | ${GPG} --command-fd 0 --edit-key ${keyid}
-	${GPG} --yes --lsign-key ${keyid} &>/dev/null
-	${GPG} --armor --no-emit-version --export ${keyid} >> master/${username}.asc
+	printf 'minimize\nquit\ny\n' | "${GPG[@]}" --command-fd 0 --edit-key ${keyid}
+	"${GPG[@]}" --yes --lsign-key ${keyid} &>/dev/null
+	"${GPG[@]}" --armor --no-emit-version --export ${keyid} >> master/${username}.asc
 	echo "${keyid}:4:" >> archlinux-trusted
 done < master-keyids
-${GPG} --import-ownertrust < archlinux-trusted 2>/dev/null
+"${GPG[@]}" --import-ownertrust < archlinux-trusted 2>/dev/null
 
 # master-revoked-keyids
 while read -ra data; do
 	keyid="${data[0]}"
 	username="${data[1]}"
-	printf 'clean\nquit\ny\n' | ${GPG} --command-fd 0 --edit-key ${keyid}
-	${GPG} --armor --no-emit-version --export-options export-minimal --export ${keyid} >> master-revoked/${username}.asc
+	printf 'clean\nquit\ny\n' | "${GPG[@]}" --command-fd 0 --edit-key ${keyid}
+	"${GPG[@]}" --armor --no-emit-version --export-options export-minimal --export ${keyid} >> master-revoked/${username}.asc
 	echo "${keyid}" >> archlinux-revoked
 done < master-revoked-keyids
 
@@ -65,11 +65,11 @@ done < master-revoked-keyids
 while read -ra data; do
 	keyid="${data[0]}"
 	username="${data[@]:1}"
-	printf 'clean\nquit\ny\n' | ${GPG} --command-fd 0 --edit-key ${keyid}
-	if ! ${GPG} --list-keys --with-colons ${keyid} 2>/dev/null | grep -q '^pub:f:'; then
+	printf 'clean\nquit\ny\n' | "${GPG[@]}" --command-fd 0 --edit-key ${keyid}
+	if ! "${GPG[@]}" --list-keys --with-colons ${keyid} 2>/dev/null | grep -q '^pub:f:'; then
 		echo "key is not fully trusted: ${keyid} ${username}"
 	else
-		${GPG} --armor --no-emit-version --export ${keyid} >> packager/${username}.asc
+		"${GPG[@]}" --armor --no-emit-version --export ${keyid} >> packager/${username}.asc
 	fi
 done < packager-keyids
 
@@ -77,8 +77,8 @@ done < packager-keyids
 while read -ra data; do
 	keyid="${data[0]}"
 	username="${data[1]}"
-	printf 'clean\nquit\ny\n' | ${GPG} --command-fd 0 --edit-key ${keyid}
-	${GPG} --armor --no-emit-version --export-options export-minimal --export ${keyid} >> packager-revoked/${username}.asc
+	printf 'clean\nquit\ny\n' | "${GPG[@]}" --command-fd 0 --edit-key ${keyid}
+	"${GPG[@]}" --armor --no-emit-version --export-options export-minimal --export ${keyid} >> packager-revoked/${username}.asc
 	echo "${keyid}" >> archlinux-revoked
 done < packager-revoked-keyids