diff --git a/debian/security-misc-shared.postinst b/debian/security-misc-shared.postinst
index 1ea1633e..19e4ab9f 100755
--- a/debian/security-misc-shared.postinst
+++ b/debian/security-misc-shared.postinst
@@ -3,8 +3,9 @@
 ## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
 ## See the file COPYING for copying conditions.
 
-## style-ok: no-has - has.sh isn't reliably available in maintainer scripts
-## style-ok: no-strict - full strict block could leak into APT/debconf
+## style-ok: allow-echo  (Debian maintainer-script convention)
+## style-ok: no-has  (has.bsh not reliably available this early in maintainer scripts)
+## style-ok: no-strict  (debconf maintainer script; full strict block would leak into APT/debconf)
 
 if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
    source /usr/libexec/helper-scripts/pre.bsh
diff --git a/usr/bin/permission-hardener#security-misc-shared b/usr/bin/permission-hardener#security-misc-shared
index 6d061dfd..ec71c610 100755
--- a/usr/bin/permission-hardener#security-misc-shared
+++ b/usr/bin/permission-hardener#security-misc-shared
@@ -472,20 +472,21 @@ load_state() {
       processed_config_line="${line}"
 
       ## We can handle filenames with spaces. This is because the first item
-      ## after a filename is an octal file mode, and we only support user/group
-      ## names, not UIDs and GIDs, as owner identifiers. This means that we can
-      ## scan from right to left for the furthest-right octal integer field and
-      ## use it to separate the filename from the rest of the options. (If
-      ## usernames could themselves be octal integers, this would break, but
-      ## adduser.conf's default NAME_REGEX forbids this. This is definitely a
-      ## hack, but the alternative is to change the format of the policy files,
-      ## which would break custom config for users.
+      ## after a filename is either an octal file mode or a keyword, and we
+      ## only support user/group names, not UIDs and GIDs, as owner
+      ## identifiers. This means that we can scan from right to left for the
+      ## furthest-right octal integer or keyword field and use it to separate
+      ## the filename from the rest of the options. (If usernames could
+      ## themselves be octal integers, this would break, but adduser.conf's
+      ## default NAME_REGEX forbids this. This is definitely a hack, but the
+      ## alternative is to change the format of the policy files, which would
+      ## break custom config for users.
       ##
       ## 'read' will collapse consecutive spaces when splitting on spaces.
       ## Convert spaces into newlines first, then split on newlines with a
       ## loop.
       field_list=()
-      while read IFS= -r one_field; do
+      while IFS= read -r one_field; do
          field_list+=( "${one_field}" )
       done < <(printf '%s\n' "${line}" | tr ' ' '\n')
       field_count="${#field_list[@]}"
@@ -493,10 +494,11 @@ load_state() {
       hit_barrier='false'
       fso_name=""
       meta_list=()
-      for (( field_index = field_count - 1; field_index <= 0; \
+      for (( field_index = field_count - 1; field_index >= 0; \
          field_index-- )); do
          if [ "${hit_barrier}" = 'false' ]; then
-            if [[ "${field_list[field_index]}" =~ ^[0-7]{3,4}$ ]]; then
+            if [[ "${field_list[field_index]}" =~ ^[0-7]{3,4}$ ]] \
+               || [[ "${field_list[field_index]}" =~ ^(nosuid|exactwhitelist|matchwhitelist|disablewhitelist)$ ]]; then
                hit_barrier='true'
             fi
             meta_list=( "${field_list[field_index]}" "${meta_list[@]}" )
diff --git a/usr/bin/remount-secure#security-misc-shared b/usr/bin/remount-secure#security-misc-shared
index 5d1322ab..c5efc9f5 100755
--- a/usr/bin/remount-secure#security-misc-shared
+++ b/usr/bin/remount-secure#security-misc-shared
@@ -26,7 +26,7 @@
 ## https://www.kicksecure.com/wiki/Dev/remount-secure
 ## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707
 
-## style-ok: no-has - may run in dracut without helper-scripts
+## style-ok: no-has  (runs in dracut where helper-scripts has.bsh is unavailable; id itself may be absent)
 
 ## Mount helper functions (_boot, _sys, _usr, ...) are invoked indirectly via
 ## the dispatch in main().
diff --git a/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared b/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared
index a6ede97c..efb7641d 100755
--- a/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared
+++ b/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared
@@ -11,8 +11,9 @@ shopt -s inherit_errexit
 shopt -s shift_verbose
 export LC_ALL=C
 
-# shellcheck source=../../../../helper-scripts/usr/libexec/helper-scripts/has.sh
-source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.sh
+## security-misc-shared Depends on helper-scripts.
+# shellcheck source=../../../../helper-scripts/usr/libexec/helper-scripts/has.bsh
+source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.bsh
 
 ## Package 'pciutils' provides tool 'lspci'.
 has lspci
diff --git a/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared b/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared
index f2da0c97..a64cb9fe 100755
--- a/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared
+++ b/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared
@@ -12,8 +12,9 @@ shopt -s inherit_errexit
 shopt -s shift_verbose
 export LC_ALL=C
 
-# shellcheck source=../../../../../helper-scripts/usr/libexec/helper-scripts/has.sh
-source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.sh
+## security-misc-shared Depends on helper-scripts.
+# shellcheck source=../../../../../helper-scripts/usr/libexec/helper-scripts/has.bsh
+source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.bsh
 
 ## Check if the VirtualBox host software is installed.
 if ! has vboxmanage ; then