diff --git a/Dockerfile b/Dockerfile
index e0b729a22d..edd41b1c86 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -281,8 +281,6 @@ COPY --from=djs55/vpnkit@sha256:e508a17cfacc8fd39261d5b4e397df2b953690da577e2c98
 
 ENV PATH=/usr/local/cli:$PATH
 ENV DOCKER_BUILDTAGS apparmor seccomp selinux
-# Options for hack/validate/gometalinter
-ENV GOMETALINTER_OPTS="--deadline=2m"
 WORKDIR /go/src/github.com/docker/docker
 VOLUME /var/lib/docker
 # Wrap all commands in the "docker-in-docker" script to allow nested containers
diff --git a/hack/validate/gometalinter b/hack/validate/gometalinter
index 0c0ae0d7ee..4300b67a11 100755
--- a/hack/validate/gometalinter
+++ b/hack/validate/gometalinter
@@ -4,10 +4,11 @@ set -e -o pipefail
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 # CI platforms differ, so per-platform GOMETALINTER_OPTS can be set
-# from a platform-specific Dockerfile, otherwise let's just set
+# in the Jenkinsfile, otherwise let's just set a
 # (somewhat pessimistic) default of 10 minutes.
-: ${GOMETALINTER_OPTS=--deadline=10m}
+: "${GOMETALINTER_OPTS=--deadline=10m}"
 
+# shellcheck disable=SC2086
 gometalinter \
 	${GOMETALINTER_OPTS} \
-	--config ${SCRIPTDIR}/gometalinter.json ./...
+	--config "${SCRIPTDIR}/gometalinter.json" ./...