diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index 3ed7122401..4ab190e06e 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -55,7 +55,6 @@
 ./hack/update-translations.sh
 ./hack/update-vendor-licenses.sh
 ./hack/update-vendor.sh
-./hack/update-workspace-mirror.sh
 ./hack/verify-api-groups.sh
 ./hack/verify-boilerplate.sh
 ./hack/verify-cli-conventions.sh
diff --git a/hack/update-workspace-mirror.sh b/hack/update-workspace-mirror.sh
index 98380974cd..c4ff61707c 100755
--- a/hack/update-workspace-mirror.sh
+++ b/hack/update-workspace-mirror.sh
@@ -29,8 +29,8 @@ BUCKET="gs://k8s-bazel-cache"
 gsutil acl get "${BUCKET}" > /dev/null
 
 tmpfile=$(mktemp bazel_workspace_mirror.XXXXXX)
-trap "rm ${tmpfile}" EXIT
-cat "$1" | while read url; do
+trap 'rm ${tmpfile}' EXIT
+while read -r url; do
   echo "${url}"
   if gsutil ls "${BUCKET}/${url}" &> /dev/null; then
     echo present
@@ -40,4 +40,4 @@ cat "$1" | while read url; do
         gsutil cp -a public-read "${tmpfile}" "${BUCKET}/${url}"
     fi
   fi
-done
+done < "$1"