diff --git a/apparmor.d/groups/gnome/gdm-xsession b/apparmor.d/groups/gnome/gdm-xsession
index af4cbad9..b12a5e04 100644
--- a/apparmor.d/groups/gnome/gdm-xsession
+++ b/apparmor.d/groups/gnome/gdm-xsession
@@ -9,7 +9,7 @@ include <tunables/global>
 @{exec_path} = @{etc_ro}/gdm{3,}/Xsession
 profile gdm-xsession @{exec_path} {
   include <abstractions/base>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/nameservice-strict>
diff --git a/apparmor.d/groups/gnome/gnome-session b/apparmor.d/groups/gnome/gnome-session
index b208aa2e..5107a962 100644
--- a/apparmor.d/groups/gnome/gnome-session
+++ b/apparmor.d/groups/gnome/gnome-session
@@ -9,7 +9,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/gnome-session
 profile gnome-session @{exec_path} {
   include <abstractions/base>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
   include <abstractions/zsh>
diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm
index 3d3e3dac..79aafd3c 100644
--- a/apparmor.d/groups/kde/sddm
+++ b/apparmor.d/groups/kde/sddm
@@ -11,7 +11,7 @@ include <tunables/global>
 profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   include <abstractions/base>
   include <abstractions/authentication>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.login1>
diff --git a/apparmor.d/groups/kde/sddm-xsession b/apparmor.d/groups/kde/sddm-xsession
index 35c94f61..c63a441e 100644
--- a/apparmor.d/groups/kde/sddm-xsession
+++ b/apparmor.d/groups/kde/sddm-xsession
@@ -12,7 +12,7 @@ profile sddm-xsession @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/zsh>
 
   @{exec_path} r,
diff --git a/apparmor.d/groups/kde/xdm-xsession b/apparmor.d/groups/kde/xdm-xsession
index 498420a9..2a8184e5 100644
--- a/apparmor.d/groups/kde/xdm-xsession
+++ b/apparmor.d/groups/kde/xdm-xsession
@@ -9,7 +9,7 @@ include <tunables/global>
 @{exec_path} = @{etc_ro}/X11/xdm/Xsession
 profile xdm-xsession @{exec_path} {
   include <abstractions/base>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/dconf-write>
   include <abstractions/nameservice-strict>
   include <abstractions/X-strict>
diff --git a/apparmor.d/groups/virt/cockpit-session b/apparmor.d/groups/virt/cockpit-session
index a4c1adb0..774a6b7a 100644
--- a/apparmor.d/groups/virt/cockpit-session
+++ b/apparmor.d/groups/virt/cockpit-session
@@ -10,7 +10,7 @@ include <tunables/global>
 profile cockpit-session @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/authentication>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/nameservice-strict>
   include <abstractions/zsh>
 
diff --git a/apparmor.d/profiles-m-r/pam_roles b/apparmor.d/profiles-m-r/pam_roles
index d73a0e62..f2b37b14 100644
--- a/apparmor.d/profiles-m-r/pam_roles
+++ b/apparmor.d/profiles-m-r/pam_roles
@@ -18,7 +18,7 @@ include <tunables/global>
 # of files.
 profile default_user flags=(complain) {
   include <abstractions/base>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/consoles>
   include <abstractions/nameservice>
 
@@ -38,7 +38,7 @@ profile default_user flags=(complain) {
 # anywhere, and execute from some places.
 profile confined_user flags=(complain) {
   include <abstractions/base>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/consoles>
   include <abstractions/nameservice>