diff --git a/meta-refkit-computervision/recipes-image/images/refkit-image-computervision.bb b/meta-refkit-computervision/recipes-image/images/refkit-image-computervision.bb
index 76223a809b..66829eda27 100644
--- a/meta-refkit-computervision/recipes-image/images/refkit-image-computervision.bb
+++ b/meta-refkit-computervision/recipes-image/images/refkit-image-computervision.bb
@@ -15,7 +15,7 @@ REFKIT_IMAGE_COMPUTERVISION_EXTRA_FEATURES += "${@ '' if (d.getVar('IMAGE_MODE')
 # Example for customization in local.conf when building
 # refkit-image-computervision.bb:
 # IMAGE_BASENAME_pn-refkit-image-computervision = "my-refkit-image-reference"
-# REFKIT_IMAGE_COMPUTERVISION_EXTRA_INSTALL_append = "my-own-package"
-# REFKIT_IMAGE_COMPUTERVISION_EXTRA_FEATURES_append = "dev-pkgs"
+# REFKIT_IMAGE_COMPUTERVISION_EXTRA_INSTALL_append = " my-own-package"
+# REFKIT_IMAGE_COMPUTERVISION_EXTRA_FEATURES_append = " dev-pkgs"
 
 inherit refkit-image
diff --git a/meta-refkit-core/classes/image-dsk.bbclass b/meta-refkit-core/classes/image-dsk.bbclass
index 7eae234d24..24dc7e5181 100644
--- a/meta-refkit-core/classes/image-dsk.bbclass
+++ b/meta-refkit-core/classes/image-dsk.bbclass
@@ -66,7 +66,7 @@ IMAGE_DEPENDS_dsk += " \
 # when adding swupd bundle support, because there virtual images
 # without active .dsk are used to generate the rootfs for other
 # images with .dsk format.
-INITRD_LIVE_append = "${@ ('${DEPLOY_DIR_IMAGE}/' + d.getVar('INITRD_IMAGE', expand=True) + '-${MACHINE}.cpio.gz') if d.getVar('INITRD_IMAGE', True) else ''}"
+INITRD_LIVE_append = " ${@ ('${DEPLOY_DIR_IMAGE}/' + d.getVar('INITRD_IMAGE', expand=True) + '-${MACHINE}.cpio.gz') if d.getVar('INITRD_IMAGE', True) else ''}"
 
 PACKAGES = " "
 EXCLUDE_FROM_WORLD = "1"
diff --git a/meta-refkit-core/classes/refkit-image.bbclass b/meta-refkit-core/classes/refkit-image.bbclass
index da59c0bd67..7720fdf8db 100644
--- a/meta-refkit-core/classes/refkit-image.bbclass
+++ b/meta-refkit-core/classes/refkit-image.bbclass
@@ -123,8 +123,8 @@ REFKIT_DM_VERITY_PARTITION () {
 part --source dm-verity --uuid ${REFKIT_DM_VERITY_PARTUUID} --label rootfs
 }
 REFKIT_EXTRA_PARTITION .= "${@ bb.utils.contains('IMAGE_FEATURES', 'dm-verity', d.getVar('REFKIT_DM_VERITY_PARTITION'), '', d) }"
-APPEND_append = "${@ bb.utils.contains('IMAGE_FEATURES', 'dm-verity', ' dmverity=PARTUUID=${REFKIT_DM_VERITY_PARTUUID}', '', d) }"
-WICVARS_append = "${@ bb.utils.contains('IMAGE_FEATURES', 'dm-verity', ' \
+APPEND_append = " ${@ bb.utils.contains('IMAGE_FEATURES', 'dm-verity', ' dmverity=PARTUUID=${REFKIT_DM_VERITY_PARTUUID}', '', d) }"
+WICVARS_append = " ${@ bb.utils.contains('IMAGE_FEATURES', 'dm-verity', ' \
     REFKIT_DMVERITY_PRIVATE_KEY \
     REFKIT_DMVERITY_PRIVATE_KEY_HASH \
     REFKIT_DMVERITY_PASSWORD \
@@ -273,7 +273,7 @@ INITRD_IMAGE_intel-corei7-64 = "${REFKIT_INITRAMFS}"
 INITRD_IMAGE_intel-quark = "${REFKIT_INITRAMFS}"
 
 # Enable emergency shell in initramfs-framework.
-APPEND_append = "${@ ' init_fatal_sh' if (d.getVar('IMAGE_MODE') or '') == 'development' else ''}"
+APPEND_append = " ${@ ' init_fatal_sh' if (d.getVar('IMAGE_MODE') or '') == 'development' else ''}"
 
 # The expected disk layout is not compatible with the HDD format:
 # HDD places the rootfs as loop file in a VFAT partition (UEFI),
@@ -290,7 +290,7 @@ REMOVABLE_MEDIA_ROOTFS_PARTUUID_VALUE = "12345678-9abc-def0-0fed-cba987654321"
 INT_STORAGE_ROOTFS_PARTUUID_VALUE = "12345678-9abc-def0-0fed-cba987654320"
 
 # Enable/disable IMA also in per-image boot parameters.
-APPEND_append = "${@bb.utils.contains('IMAGE_FEATURES', 'ima', ' rootflags=i_version', ' no-ima', d)}"
+APPEND_append = " ${@bb.utils.contains('IMAGE_FEATURES', 'ima', ' rootflags=i_version', ' no-ima', d)}"
 
 # Conditionally include the class only if distro features indicate that
 # integrity support is enabled. We cannot include unconditionally
@@ -318,7 +318,7 @@ ima_evm_sign_rootfs_prepend () {
 #
 # The Edison BSP does not support APPEND, some other solution is needed
 # for that machine.
-APPEND_append = "${@bb.utils.contains('IMAGE_FEATURES', 'smack', '', ' security=none', d)}"
+APPEND_append = " ${@bb.utils.contains('IMAGE_FEATURES', 'smack', '', ' security=none', d)}"
 
 # Use what RMC gives, not the defaults in meta-intel machine configs
 APPEND_remove_intel-corei7-64 = "console=ttyS0,115200"
diff --git a/meta-refkit-core/classes/refkit-swupd-image.bbclass b/meta-refkit-core/classes/refkit-swupd-image.bbclass
index a34ae13f06..83696d4899 100644
--- a/meta-refkit-core/classes/refkit-swupd-image.bbclass
+++ b/meta-refkit-core/classes/refkit-swupd-image.bbclass
@@ -6,7 +6,7 @@ inherit swupd-image
 
 # Activate support for updating EFI system partition when using
 # both meta-swupd and the EFI kernel+initramfs combo.
-IMAGE_INSTALL_append = "${@ ' efi-combo-trigger' if oe.types.boolean(d.getVar('REFKIT_USE_DSK_IMAGES') or '0') else '' }"
+IMAGE_INSTALL_append = " ${@ ' efi-combo-trigger' if oe.types.boolean(d.getVar('REFKIT_USE_DSK_IMAGES') or '0') else '' }"
 
 # Workaround when both Smack and swupd are used:
 # Setting a label explicitly on the directory prevents it
diff --git a/meta-refkit-core/classes/stateless.bbclass b/meta-refkit-core/classes/stateless.bbclass
index 8424506252..a31848deed 100644
--- a/meta-refkit-core/classes/stateless.bbclass
+++ b/meta-refkit-core/classes/stateless.bbclass
@@ -252,7 +252,7 @@ python () {
 # all /etc files are marked as CONFFILES (perhaps by adding that as
 # default for all packages), then we can use ROOTFS_POSTINSTALL_COMMAND
 # again.
-ROOTFS_POSTUNINSTALL_COMMAND_append = "stateless_mangle_rootfs;"
+ROOTFS_POSTUNINSTALL_COMMAND_append = " stateless_mangle_rootfs;"
 
 python stateless_mangle_rootfs () {
     pn = d.getVar('PN', True)
diff --git a/meta-refkit-core/conf/distro/include/refkit-config.inc b/meta-refkit-core/conf/distro/include/refkit-config.inc
index bca8fdbee8..9653ad6256 100644
--- a/meta-refkit-core/conf/distro/include/refkit-config.inc
+++ b/meta-refkit-core/conf/distro/include/refkit-config.inc
@@ -107,7 +107,7 @@ BAD_RECOMMENDATIONS_append_refkit-config = " bluez5-client"
 # Prefer systemd way of creating getty@.service symlinks using
 # systemd-getty-generator (instead of the Yocto default
 # systemd-serialgetty that creates everything in do_install).
-PACKAGECONFIG_append_pn-systemd_refkit-config = "serial-getty-generator"
+PACKAGECONFIG_append_pn-systemd_refkit-config = " serial-getty-generator"
 
 # OE-core 7355a3c4f665e066925ea6327ac72365ab1f2f39 added a PACKAGECONFIG
 # to configure cairo/python3-cairo and enabled it by default. It used to
diff --git a/meta-refkit-core/recipes-connectivity/avahi/avahi_%.bbappend b/meta-refkit-core/recipes-connectivity/avahi/avahi_%.bbappend
index 4b2af2141b..38773997c9 100644
--- a/meta-refkit-core/recipes-connectivity/avahi/avahi_%.bbappend
+++ b/meta-refkit-core/recipes-connectivity/avahi/avahi_%.bbappend
@@ -5,7 +5,7 @@ RRECOMMENDS_avahi-daemon_remove_libc-glibc_refkit-config = " libnss-mdns"
 RRECOMMENDS_${PN}_remove_libc-glibc_refkit-config = " libnss-mdns"
 
 # provide libdns_sd.so and dns_sd.h header
-EXTRA_OECONF_append_refkit-config = "--enable-compat-libdns_sd"
+EXTRA_OECONF_append_refkit-config = " --enable-compat-libdns_sd"
 
 FILES_${PN}_append_refkit-config = " \
     ${libdir}/libdns_sd.* \
diff --git a/meta-refkit-core/recipes-connectivity/bluez5/bluez5_5%.bbappend b/meta-refkit-core/recipes-connectivity/bluez5/bluez5_5%.bbappend
index 75b3daead2..0865d65a96 100644
--- a/meta-refkit-core/recipes-connectivity/bluez5/bluez5_5%.bbappend
+++ b/meta-refkit-core/recipes-connectivity/bluez5/bluez5_5%.bbappend
@@ -4,4 +4,4 @@ DEPENDS_remove_refkit-config = "libusb"
 # split bluetoothctl into a subpackage
 PACKAGES_prepend_refkit-config = "${PN}-client "
 FILES_${PN}-client = "${@bb.utils.contains('PACKAGECONFIG', 'readline', '${bindir}/bluetoothctl', '', d)}"
-RRECOMMENDS_${PN}_append_refkit-config += "${PN}-client"
+RRECOMMENDS_${PN}_append_refkit-config = " ${PN}-client"
diff --git a/meta-refkit-core/recipes-images/images/refkit-image-common.bb b/meta-refkit-core/recipes-images/images/refkit-image-common.bb
index 93d6614251..2aa2eb6e44 100644
--- a/meta-refkit-core/recipes-images/images/refkit-image-common.bb
+++ b/meta-refkit-core/recipes-images/images/refkit-image-common.bb
@@ -26,7 +26,7 @@ REFKIT_IMAGE_EXTRA_INSTALL += "${REFKIT_IMAGE_COMMON_EXTRA_INSTALL}"
 #
 # Example for customization in local.conf when building refkit-image-common.bb:
 # IMAGE_BASENAME_pn-refkit-image-common = "my-refkit-image-reference"
-# REFKIT_IMAGE_COMMON_EXTRA_INSTALL_append = "my-own-package"
-# REFKIT_IMAGE_COMMON_EXTRA_FEATURES_append = "dev-pkgs"
+# REFKIT_IMAGE_COMMON_EXTRA_INSTALL_append = " my-own-package"
+# REFKIT_IMAGE_COMMON_EXTRA_FEATURES_append = " dev-pkgs"
 
 inherit refkit-image
diff --git a/meta-refkit-gateway/recipes-image/images/refkit-image-gateway.bb b/meta-refkit-gateway/recipes-image/images/refkit-image-gateway.bb
index cc452c65ce..831d4a2bb3 100644
--- a/meta-refkit-gateway/recipes-image/images/refkit-image-gateway.bb
+++ b/meta-refkit-gateway/recipes-image/images/refkit-image-gateway.bb
@@ -11,7 +11,7 @@ REFKIT_IMAGE_GATEWAY_EXTRA_FEATURES_append = " iotivity nodejs-runtime bluetooth
 # Example for customization in local.conf when building
 # refkit-image-gateway.bb:
 # IMAGE_BASENAME_pn-refkit-image-gateway = "my-refkit-image-gateway"
-# REFKIT_IMAGE_GATEWAY_EXTRA_INSTALL_append = "my-own-package"
-# REFKIT_IMAGE_GATEWAY_EXTRA_FEATURES_append = "dev-pkgs"
+# REFKIT_IMAGE_GATEWAY_EXTRA_INSTALL_append = " my-own-package"
+# REFKIT_IMAGE_GATEWAY_EXTRA_FEATURES_append = " dev-pkgs"
 
 inherit refkit-image
diff --git a/meta-refkit/lib/oeqa/selftest/refkit-poky.py b/meta-refkit/lib/oeqa/selftest/refkit-poky.py
index 5574694c98..20ba451c6d 100644
--- a/meta-refkit/lib/oeqa/selftest/refkit-poky.py
+++ b/meta-refkit/lib/oeqa/selftest/refkit-poky.py
@@ -236,7 +236,7 @@ def test_common_poky_config(self):
 
         # We need an image that we can log into, so zap the root password.
         self.append_config('''
-REFKIT_IMAGE_EXTRA_FEATURES_append = "empty-root-password"
+REFKIT_IMAGE_EXTRA_FEATURES_append = " empty-root-password"
 ''')
         bitbake('refkit-image-common')
         with runqemu('refkit-image-common',
diff --git a/meta-refkit/recipes-core/ovmf/ovmf-shell-image-enrollkeys.bb b/meta-refkit/recipes-core/ovmf/ovmf-shell-image-enrollkeys.bb
index b20f6e5804..df99690a68 100644
--- a/meta-refkit/recipes-core/ovmf/ovmf-shell-image-enrollkeys.bb
+++ b/meta-refkit/recipes-core/ovmf/ovmf-shell-image-enrollkeys.bb
@@ -1,6 +1,6 @@
 require recipes-core/ovmf/ovmf-shell-image.bb
 
-WKS_SEARCH_PATH_append = ":${COREBASE}/meta/recipes-core/ovmf"
+WKS_SEARCH_PATH_append = " :${COREBASE}/meta/recipes-core/ovmf"
 
 QB_DRIVE_TYPE = "/dev/vd"