diff --git a/pkg/fedora/kernel-surface/files/linux-surface-default-watchdog.sh b/pkg/fedora/kernel-surface/files/linux-surface-default-watchdog.sh
index e39978893..376c8c31f 100755
--- a/pkg/fedora/kernel-surface/files/linux-surface-default-watchdog.sh
+++ b/pkg/fedora/kernel-surface/files/linux-surface-default-watchdog.sh
@@ -1,20 +1,23 @@
 #!/bin/bash
 set -euo pipefail
 
-# get list of surface kernels with timestamp
-kernels=$(find /boot -maxdepth 1 -name "vmlinuz-*.surface.*" -exec sh -c 'stat -c "%W %n" {}' \;)
+# Get list of surface kernels with timestamp
+KERNELS="$(
+    find /boot -maxdepth 1 -name 'vmlinuz-*.surface.*' -print0 | xargs -0 -I '{}' \
+        stat -c "%W %n" {}
+)"
 
-# sort by timestamp
-kernels=$(echo "${kernels}" | sort -n)
+# Sort by timestamp
+KERNELS="$(echo "${KERNELS}" | sort -n)"
 
-# get latest kernel (last line) and extract path
-kernel=$(echo "${kernels}" | tail -n1 | cut -d' ' -f2)
+# Get latest kernel (last line) and extract the path
+VMLINUX="$(echo "${KERNELS}" | tail -n1 | cut -d' ' -f2)"
 
-echo $kernel
+echo "${VMLINUX}"
 
 # update GRUB config
-grubby --set-default "${kernel}"
+grubby --set-default "${VMLINUX}"
 
-# update timestamp for rEFInd (ensure it's marked as latest across all kernels,
-# not just surface ones)
-touch "${kernel}"
+# Update timestamp for rEFInd
+# Ensure it's marked as latest across all kernels, not just surface ones
+touch "${VMLINUX}"