diff --git a/scripts/local_facts.fact b/scripts/local_facts.fact
index 9959a30d8..14f8f7b17 100755
--- a/scripts/local_facts.fact
+++ b/scripts/local_facts.fact
@@ -30,7 +30,7 @@ source /etc/iiab/iiab.env || true    # STAGE var auto-set, so no "if" required.
 # /etc/lsb-release could also be grep'd.  But /etc/upstream-release/lsb-release
 # on Linux Mint 20 caused grep of /etc/*elease to fail (on directory not file)
 if tmp=$(grep ^ID= /etc/os-release); then
-    OS=$(echo $tmp | cut -d= -f2)
+    OS=$(echo "$tmp" | cut -d= -f2)
     OS=${OS//\"/}    # Remove all '"'
 fi
 if [ -f /etc/rpi-issue ]; then
@@ -38,7 +38,7 @@ if [ -f /etc/rpi-issue ]; then
 fi    # of 2020: https://github.com/raspberrypi/Raspberry-Pi-OS-64bit/issues/6
 
 if tmp=$(grep ^VERSION_ID= /etc/os-release); then
-    VERSION_ID=$(echo $tmp | cut -d= -f2)
+    VERSION_ID=$(echo "$tmp" | cut -d= -f2)
     VERSION_ID=${VERSION_ID//\"/}   # Remove all '"'
     VERSION_ID=${VERSION_ID%%.*}    # Remove all '.' & stuff to the right of em
 fi
@@ -85,7 +85,7 @@ tmp=$(cat /proc/device-tree/model) &&
     RPI_MODEL=$tmp
 
 tmp=$(ansible --version) &&
-    ANSIBLE_VERSION=$(echo $tmp | head -n 1 | cut -f 2 -d " ")
+    ANSIBLE_VERSION=$(echo "$tmp" | head -n 1 | cut -f 2 -d " ")
 
 
 # THESE LAST 3 ARE DIFFEENT as "systemctl is-enabled" unhelpfully returns the