diff --git a/setup/start.sh b/setup/start.sh
index 2a977340..bf495c1b 100755
--- a/setup/start.sh
+++ b/setup/start.sh
@@ -35,7 +35,7 @@ if [ -f /etc/mailinabox.conf ]; then
 
 	# Load the old .conf file to get existing configuration options loaded
 	# into variables with a DEFAULT_ prefix.
-	cat /etc/mailinabox.conf | sed s/^/DEFAULT_/ > /tmp/mailinabox.prev.conf
+	sed s/^/DEFAULT_/ /etc/mailinabox.conf > /tmp/mailinabox.prev.conf
 	source /tmp/mailinabox.prev.conf
 	rm -f /tmp/mailinabox.prev.conf
 else
diff --git a/setup/system.sh b/setup/system.sh
index b49f0120..e8a66e81 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -44,7 +44,7 @@ chmod g-w /etc /etc/default /usr
 # See https://www.digitalocean.com/community/tutorials/how-to-add-swap-on-ubuntu-14-04
 # for reference
 
-SWAP_MOUNTED=$(cat /proc/swaps | tail -n+2)
+SWAP_MOUNTED=$(tail -n+2 /proc/swaps)
 SWAP_IN_FSTAB=$(grep "swap" /etc/fstab || /bin/true)
 ROOT_IS_BTRFS=$(grep "\/ .*btrfs" /proc/mounts || /bin/true)
 TOTAL_PHYSICAL_MEM=$(head -n 1 /proc/meminfo | awk '{print $2}' || /bin/true)
@@ -361,8 +361,7 @@ systemctl restart systemd-resolved
 # Configure the Fail2Ban installation to prevent dumb bruce-force attacks against dovecot, postfix, ssh, etc.
 rm -f /etc/fail2ban/jail.local # we used to use this file but don't anymore
 rm -f /etc/fail2ban/jail.d/defaults-debian.conf # removes default config so we can manage all of fail2ban rules in one config
-cat conf/fail2ban/jails.conf \
-    | sed "s/PUBLIC_IPV6/$PUBLIC_IPV6/g" \
+sed "s/PUBLIC_IPV6/$PUBLIC_IPV6/g" conf/fail2ban/jails.conf \
 	| sed "s/PUBLIC_IP/$PUBLIC_IP/g" \
 	| sed "s#STORAGE_ROOT#$STORAGE_ROOT#" \
 	> /etc/fail2ban/jail.d/mailinabox.conf
diff --git a/setup/web.sh b/setup/web.sh
index 6969c6ce..b26ebd0e 100755
--- a/setup/web.sh
+++ b/setup/web.sh
@@ -103,8 +103,7 @@ fi
 # nginx configuration at /mailinabox-mobileconfig.
 mkdir -p /var/lib/mailinabox
 chmod a+rx /var/lib/mailinabox
-cat conf/ios-profile.xml \
-	| sed "s/PRIMARY_HOSTNAME/$PRIMARY_HOSTNAME/" \
+sed "s/PRIMARY_HOSTNAME/$PRIMARY_HOSTNAME/" conf/ios-profile.xml \
 	| sed "s/UUID1/$(cat /proc/sys/kernel/random/uuid)/" \
 	| sed "s/UUID2/$(cat /proc/sys/kernel/random/uuid)/" \
 	| sed "s/UUID3/$(cat /proc/sys/kernel/random/uuid)/" \
@@ -117,8 +116,7 @@ chmod a+r /var/lib/mailinabox/mobileconfig.xml
 # The format of the file is documented at:
 # https://wiki.mozilla.org/Thunderbird:Autoconfiguration:ConfigFileFormat
 # and https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration/FileFormat/HowTo.
-cat conf/mozilla-autoconfig.xml \
-	| sed "s/PRIMARY_HOSTNAME/$PRIMARY_HOSTNAME/" \
+sed "s/PRIMARY_HOSTNAME/$PRIMARY_HOSTNAME/" conf/mozilla-autoconfig.xml \
 	 > /var/lib/mailinabox/mozilla-autoconfig.xml
 chmod a+r /var/lib/mailinabox/mozilla-autoconfig.xml
 
@@ -131,8 +129,7 @@ chmod a+r /var/lib/mailinabox/mozilla-autoconfig.xml
 # as though there was no failure but a report will be sent if
 # TLS-RPT is configured" if you are not sure you want this yet. Or "none".
 PUNY_PRIMARY_HOSTNAME=$(echo "$PRIMARY_HOSTNAME" | idn2)
-cat conf/mta-sts.txt \
-        | sed "s/MODE/${MTA_STS_MODE}/" \
+sed "s/MODE/${MTA_STS_MODE}/" conf/mta-sts.txt \
         | sed "s/PRIMARY_HOSTNAME/$PUNY_PRIMARY_HOSTNAME/" \
          > /var/lib/mailinabox/mta-sts.txt
 chmod a+r /var/lib/mailinabox/mta-sts.txt
diff --git a/setup/webmail.sh b/setup/webmail.sh
index a2351c31..d492eb93 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -61,7 +61,7 @@ fi
 if [ $needs_update == 1 ]; then
   # if upgrading from 1.3.x, clear the temp_dir
   if [ -f /usr/local/lib/roundcubemail/version ]; then
-    if [ "$(cat /usr/local/lib/roundcubemail/version | cut -c1-3)" == '1.3' ]; then
+    if [ "$(cut -c1-3 /usr/local/lib/roundcubemail/version)" == '1.3' ]; then
       find /var/tmp/roundcubemail/ -type f ! -name 'RCMTEMP*' -delete
     fi
   fi