diff --git a/py/common/util.py b/py/common/util.py
index a32004b..6546937 100644
--- a/py/common/util.py
+++ b/py/common/util.py
@@ -139,7 +139,9 @@ def dirs_to_scan_by_args(parser, args, props, tool):
         dirs_to_scan += ["/builddir/build/BUILD"]
 
     if scan_install:
-        dirs_to_scan += ["/builddir/build/BUILDROOT"]
+        # the second variant was introduced by a backward-incompatible change in `rpm`
+        # https://github.com/rpm-software-management/rpm/commit/9d35c8df497534e1fbd806a4dc78802bcf35d7cb
+        dirs_to_scan += ["/builddir/build/BUILDROOT", "/builddir/build/BUILD/*/BUILDROOT"]
         props.need_rpm_bi = True
 
     return ' '.join(dirs_to_scan)
diff --git a/py/csmock b/py/csmock
index 733ae1e..83d305f 100755
--- a/py/csmock
+++ b/py/csmock
@@ -94,7 +94,10 @@ DEFAULT_RESULT_FILTERS = [
 
 # path filter needed with `rpmbuild -bi`
 # TODO: introduce a csgrep option for this
-RPM_BI_FILTER = "sed 's|/builddir/build/BUILDROOT/[^/]*/|/builddir/build/BUILD//|'"
+# `/builddir/build/BUILDROOT/${NVR}/...` was used by old versions of `rpm`
+# `/builddir/build/BUILD/${NVR}/BUILDROOT/...` was later introduced by a backward-incompatible change in `rpm`
+# https://github.com/rpm-software-management/rpm/commit/9d35c8df497534e1fbd806a4dc78802bcf35d7cb
+RPM_BI_FILTER = "sed -r 's;/builddir/build/BUILD(ROOT/[^/]+|/[^/]+/BUILDROOT)/;/builddir/build/BUILD//;'"
 
 # path to csexec-loader is hard-coded for now
 CSEXEC_ENABLE_FLAG = "-Wl,--dynamic-linker,/usr/bin/csexec-loader"
diff --git a/py/plugins/bandit.py b/py/plugins/bandit.py
index 9714cb4..fb27dd4 100644
--- a/py/plugins/bandit.py
+++ b/py/plugins/bandit.py
@@ -63,7 +63,7 @@ def handle_args(self, parser, args, props):
         props.install_pkgs += ["bandit"]
 
         severity_filter = dict(zip(self._severity_levels, ['-l', '-ll', '-lll']))[args.bandit_severity_filter.upper()]
-        run_cmd = "%s %s %s > %s" % (RUN_BANDIT_SH, severity_filter, dirs_to_scan, BANDIT_CAPTURE)
+        run_cmd = f"shopt -s nullglob && {RUN_BANDIT_SH} {severity_filter} {dirs_to_scan} > {BANDIT_CAPTURE}"
         props.post_build_chroot_cmds += [run_cmd]
         props.copy_out_files += [BANDIT_CAPTURE]
 
diff --git a/py/plugins/pylint.py b/py/plugins/pylint.py
index 5ea8ac6..99a13ae 100644
--- a/py/plugins/pylint.py
+++ b/py/plugins/pylint.py
@@ -58,7 +58,7 @@ def handle_args(self, parser, args, props):
             parser, args, props, "pylint")
 
         props.install_pkgs += ["pylint"]
-        cmd = "%s %s > %s" % (RUN_PYLINT_SH, dirs_to_scan, PYLINT_CAPTURE)
+        cmd = f"shopt -s nullglob && {RUN_PYLINT_SH} {dirs_to_scan} > {PYLINT_CAPTURE}"
         props.post_build_chroot_cmds += [cmd]
         props.copy_out_files += [PYLINT_CAPTURE]
 
diff --git a/py/plugins/shellcheck.py b/py/plugins/shellcheck.py
index 146ff26..feb2cf7 100644
--- a/py/plugins/shellcheck.py
+++ b/py/plugins/shellcheck.py
@@ -75,7 +75,8 @@ def handle_args(self, parser, args, props):
         dirs_to_scan = " ".join([dir + "/*" for dir in dirs_to_scan.split()])
 
         props.install_pkgs += ["ShellCheck"]
-        cmd = f"SC_RESULTS_DIR={SHELLCHECK_CAP_DIR} "
+        cmd = "shopt -s nullglob && "
+        cmd += f"SC_RESULTS_DIR={SHELLCHECK_CAP_DIR} "
         cmd += f"SC_BATCH={args.shellcheck_batch} "
         cmd += f"SC_TIMEOUT={args.shellcheck_timeout} "
         cmd += f"{RUN_SHELLCHECK_SH} {dirs_to_scan}"