diff --git a/type/__pass/gencode-local b/type/__pass/gencode-local
index e1277fa..3346707 100755
--- a/type/__pass/gencode-local
+++ b/type/__pass/gencode-local
@@ -18,6 +18,8 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
+cat <<- EOF
+
 # Length of generated password.
 LENGTH=
 
@@ -30,7 +32,7 @@ command -v pass >/dev/null 2>&1 ||
 		cat <<- EOF >&2
 		__pass: this type requires pass installed.
 		See https://www.passwordstore.org/.
-		EOF
+		EOFF
 		exit 1;
 	}
 
@@ -38,12 +40,14 @@ command -v pass >/dev/null 2>&1 ||
 if [ -f "${__object:?}/parameter/length" ];
 then
 	LENGTH="$(cat "${__object:?}/parameter/length")"
+	export LENGTH
 fi
 
 # Check for optional no symbols parameter.
 if [ -f "${__object:?}/parameter/no-symbols" ];
 then
 	NOSYMB="-n"
+	export NOSYMB
 fi
 
 # Load required password store location parameter.
@@ -53,19 +57,21 @@ export PASSWORD_STORE_DIR
 # Check if the password store is initialized.
 if ! pass ls >/dev/null 2>&1;
 then
-	cat <<- EOF >&2
+	cat <<- EOFF >&2
 	__pass: this type requires the password store to be initialized.
 	See cdist-type__pass_init(7) and pass(1) for more information.
-	EOF
+	EOFF
 	exit 1;
 fi
 
 # Generate a password if it does not already exist.
-if [ ! -f "${PASSWORD_STORE_DIR}/${__object_id:?}.gpg" ];
+if [ ! -f "\${PASSWORD_STORE_DIR}/${__object_id:?}.gpg" ];
 then
 	# shellcheck disable=SC2086
-	pass generate $NOSYMB "${__object_id:?}" $LENGTH >/dev/null
+	pass generate \$NOSYMB "${__object_id:?}" $LENGTH >/dev/null
 fi
 
 # Send it out to the messages.
 pass "${__object_id:?}" >> "${__messages_out:?}"
+
+EOF