diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2bd2448d13..a2f1ed9fa6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ### Bug Fixes
 
+- **core:** Using `Invoke-Command` instead of `Invoke-Expression` ([#4941](https://github.com/ScoopInstaller/Scoop/issues/4941))
 - **core:** Load config file before initialization ([#4932](https://github.com/ScoopInstaller/Scoop/issues/4932))
 - **depends:** Avoid digits in archive file extension (except for .7z and .001) ([#4915](https://github.com/ScoopInstaller/Scoop/issues/4915))
 - **bucket:** Don't check remote URL of non-git buckets ([#4923](https://github.com/ScoopInstaller/Scoop/issues/4923))
diff --git a/bin/auto-pr.ps1 b/bin/auto-pr.ps1
index aa70d37258..147f635bfe 100644
--- a/bin/auto-pr.ps1
+++ b/bin/auto-pr.ps1
@@ -96,7 +96,7 @@ if (is_unix) {
 
 function execute($cmd) {
     Write-Host $cmd -ForegroundColor Green
-    $output = Invoke-Expression $cmd
+    $output = Invoke-Command ([scriptblock]::Create($cmd))
 
     if ($LASTEXITCODE -gt 0) {
         abort "^^^ Error! See above ^^^ (last command: $cmd)"
diff --git a/bin/checkver.ps1 b/bin/checkver.ps1
index 2850c7cc73..7e089da94e 100644
--- a/bin/checkver.ps1
+++ b/bin/checkver.ps1
@@ -221,7 +221,7 @@ while ($in_progress -gt 0) {
         $page = $ev.SourceEventArgs.Result
         $err = $ev.SourceEventArgs.Error
         if ($json.checkver.script) {
-            $page = $json.checkver.script -join "`r`n" | Invoke-Expression
+            $page = Invoke-Command ([scriptblock]::Create($json.checkver.script -join "`r`n"))
         }
 
         if ($err) {
diff --git a/bin/scoop.ps1 b/bin/scoop.ps1
index 3eabb4327b..b7a29c1c53 100644
--- a/bin/scoop.ps1
+++ b/bin/scoop.ps1
@@ -21,7 +21,7 @@ switch ($subCommand) {
     ({ $subCommand -in @('-v', '--version') }) {
         Write-Host 'Current Scoop version:'
         if ((Test-CommandAvailable git) -and (Test-Path "$PSScriptRoot\..\.git") -and (get_config SCOOP_BRANCH 'master') -ne 'master') {
-            Invoke-Expression "git -C '$PSScriptRoot\..' --no-pager log --oneline HEAD -n 1"
+            git -C "$PSScriptRoot\.." --no-pager log --oneline HEAD -n 1
         } else {
             $version = Select-String -Pattern '^## \[(v[\d.]+)\].*?([\d-]+)$' -Path "$PSScriptRoot\..\CHANGELOG.md"
             Write-Host $version.Matches.Groups[1].Value -ForegroundColor Cyan -NoNewline
@@ -33,7 +33,7 @@ switch ($subCommand) {
             $bucketLoc = Find-BucketDirectory $_ -Root
             if ((Test-Path "$bucketLoc\.git") -and (Test-CommandAvailable git)) {
                 Write-Host "'$_' bucket:"
-                Invoke-Expression "git -C '$bucketLoc' --no-pager log --oneline HEAD -n 1"
+                git -C "$bucketLoc" --no-pager log --oneline HEAD -n 1
                 Write-Host ''
             }
         }
diff --git a/lib/buckets.ps1 b/lib/buckets.ps1
index 1bd6d53f0a..3314761b99 100644
--- a/lib/buckets.ps1
+++ b/lib/buckets.ps1
@@ -202,7 +202,7 @@ function new_issue_msg($app, $bucket, $title, $body) {
     $bucket_path = "$bucketsdir\$bucket"
 
     if (Test-Path $bucket_path) {
-        $remote = Invoke-Expression "git -C '$bucket_path' config --get remote.origin.url"
+        $remote = git -C "$bucket_path" config --get remote.origin.url
         # Support ssh and http syntax
         # git@PROVIDER:USER/REPO.git
         # https://PROVIDER/USER/REPO.git
diff --git a/lib/commands.ps1 b/lib/commands.ps1
index 02b55ab908..1aa6be1591 100644
--- a/lib/commands.ps1
+++ b/lib/commands.ps1
@@ -20,7 +20,7 @@ function command_path($cmd) {
         $shim_path = "$scoopdir\shims\scoop-$cmd.ps1"
         $line = ((Get-Content $shim_path) | Where-Object { $_.startswith('$path') })
         if($line) {
-            Invoke-Expression -command "$line"
+            Invoke-Command ([scriptblock]::Create($line)) -NoNewScope
             $cmd_path = $path
         }
         else { $cmd_path = $shim_path }
diff --git a/lib/install.ps1 b/lib/install.ps1
index 5859af4e13..21670ab742 100644
--- a/lib/install.ps1
+++ b/lib/install.ps1
@@ -269,7 +269,7 @@ function dl_with_cache_aria2($app, $version, $manifest, $architecture, $dir, $co
         $oriConsoleEncoding = [Console]::OutputEncoding
         [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding
 
-        Invoke-Expression $aria2 | ForEach-Object {
+        Invoke-Command ([scriptblock]::Create($aria2)) | ForEach-Object {
             # Skip blank lines
             if ([String]::IsNullOrWhiteSpace($_)) { return }
 
@@ -718,7 +718,7 @@ function run_installer($fname, $manifest, $architecture, $dir, $global) {
     $installer = installer $manifest $architecture
     if($installer.script) {
         write-output "Running installer script..."
-        Invoke-Expression (@($installer.script) -join "`r`n")
+        Invoke-Command ([scriptblock]::Create($installer.script -join "`r`n"))
         return
     }
 
@@ -798,7 +798,7 @@ function run_uninstaller($manifest, $architecture, $dir) {
     $version = $manifest.version
     if($uninstaller.script) {
         write-output "Running uninstaller script..."
-        Invoke-Expression (@($uninstaller.script) -join "`r`n")
+        Invoke-Command ([scriptblock]::Create($uninstaller.script -join "`r`n"))
         return
     }
 
@@ -1035,7 +1035,7 @@ function pre_install($manifest, $arch) {
     $pre_install = arch_specific 'pre_install' $manifest $arch
     if($pre_install) {
         write-output "Running pre-install script..."
-        Invoke-Expression (@($pre_install) -join "`r`n")
+        Invoke-Command ([scriptblock]::Create($pre_install -join "`r`n"))
     }
 }
 
@@ -1043,7 +1043,7 @@ function post_install($manifest, $arch) {
     $post_install = arch_specific 'post_install' $manifest $arch
     if($post_install) {
         write-output "Running post-install script..."
-        Invoke-Expression (@($post_install) -join "`r`n")
+        Invoke-Command ([scriptblock]::Create($post_install -join "`r`n"))
     }
 }
 
diff --git a/libexec/scoop-update.ps1 b/libexec/scoop-update.ps1
index 3d727557d1..17933df278 100644
--- a/libexec/scoop-update.ps1
+++ b/libexec/scoop-update.ps1
@@ -80,35 +80,35 @@ function update_scoop() {
         Remove-Item -r -force $currentdir -ea stop
         Move-Item $newdir $currentdir
     } else {
-        $previousCommit = Invoke-Expression "git -C '$currentdir' rev-parse HEAD"
-        $currentRepo = Invoke-Expression "git -C '$currentdir' config remote.origin.url"
-        $currentBranch = Invoke-Expression "git -C '$currentdir' branch"
+        $previousCommit = git -C "$currentdir" rev-parse HEAD
+        $currentRepo = git -C "$currentdir" config remote.origin.url
+        $currentBranch = git -C "$currentdir" branch
 
         $isRepoChanged = !($currentRepo -match $configRepo)
         $isBranchChanged = !($currentBranch -match "\*\s+$configBranch")
 
         # Change remote url if the repo is changed
         if ($isRepoChanged) {
-            Invoke-Expression "git -C '$currentdir' config remote.origin.url '$configRepo'"
+            git -C "$currentdir" config remote.origin.url "$configRepo"
         }
 
         # Fetch and reset local repo if the repo or the branch is changed
         if ($isRepoChanged -or $isBranchChanged) {
             # Reset git fetch refs, so that it can fetch all branches (GH-3368)
-            Invoke-Expression "git -C '$currentdir' config remote.origin.fetch '+refs/heads/*:refs/remotes/origin/*'"
+            git -C "$currentdir" config remote.origin.fetch '+refs/heads/*:refs/remotes/origin/*'
             # fetch remote branch
             git_cmd -C "`"$currentdir`"" fetch --force origin "refs/heads/`"$configBranch`":refs/remotes/origin/$configBranch" -q
             # checkout and track the branch
             git_cmd -C "`"$currentdir`"" checkout -B $configBranch -t origin/$configBranch -q
             # reset branch HEAD
-            Invoke-Expression "git -C '$currentdir' reset --hard origin/$configBranch -q"
+            git -C "$currentdir" reset --hard origin/$configBranch -q
         } else {
             git_cmd -C "`"$currentdir`"" pull -q
         }
 
         $res = $lastexitcode
         if ($show_update_log) {
-            Invoke-Expression "git -C '$currentdir' --no-pager log --no-decorate --grep='^(chore)' --invert-grep --format='tformat: * %C(yellow)%h%Creset %<|(72,trunc)%s %C(cyan)%cr%Creset' '$previousCommit..HEAD'"
+            git -C "$currentdir" --no-pager log --no-decorate --grep='^(chore)' --invert-grep --format='tformat: * %C(yellow)%h%Creset %<|(72,trunc)%s %C(cyan)%cr%Creset' "$previousCommit..HEAD"
         }
 
         if ($res -ne 0) {
@@ -148,10 +148,10 @@ function update_scoop() {
             continue
         }
 
-        $previousCommit = (Invoke-Expression "git -C '$bucketLoc' rev-parse HEAD")
+        $previousCommit = git -C "$bucketLoc" rev-parse HEAD
         git_cmd -C "`"$bucketLoc`"" pull -q
         if ($show_update_log) {
-            Invoke-Expression "git -C '$bucketLoc' --no-pager log --no-decorate --grep='^(chore)' --invert-grep --format='tformat: * %C(yellow)%h%Creset %<|(72,trunc)%s %C(cyan)%cr%Creset' '$previousCommit..HEAD'"
+            git -C "$bucketLoc" --no-pager log --no-decorate --grep='^(chore)' --invert-grep --format='tformat: * %C(yellow)%h%Creset %<|(72,trunc)%s %C(cyan)%cr%Creset' "$previousCommit..HEAD"
         }
     }
 
diff --git a/supporting/shimexe/build.ps1 b/supporting/shimexe/build.ps1
index 48d8bed4aa..54aea9c944 100644
--- a/supporting/shimexe/build.ps1
+++ b/supporting/shimexe/build.ps1
@@ -1,10 +1,11 @@
 Param([Switch]$Fast)
 Push-Location $PSScriptRoot
+. "$PSScriptRoot\..\..\lib\core.ps1"
 . "$PSScriptRoot\..\..\lib\install.ps1"
 
 if (!$Fast) {
     Write-Host "Install dependencies ..."
-    Invoke-Expression "$PSScriptRoot\install.ps1"
+    & "$PSScriptRoot\install.ps1"
 }
 
 $output = "$PSScriptRoot\bin"
diff --git a/supporting/validator/build.ps1 b/supporting/validator/build.ps1
index 23a436643f..1fcf2c1fdc 100644
--- a/supporting/validator/build.ps1
+++ b/supporting/validator/build.ps1
@@ -1,10 +1,11 @@
 Param([Switch]$Fast)
 Push-Location $PSScriptRoot
+. "$PSScriptRoot\..\..\lib\core.ps1"
 . "$PSScriptRoot\..\..\lib\install.ps1"
 
 if (!$Fast) {
     Write-Host "Install dependencies ..."
-    Invoke-Expression "$PSScriptRoot\install.ps1"
+    & "$PSScriptRoot\install.ps1"
 }
 
 $output = "$PSScriptRoot\bin"
diff --git a/test/Scoop-Alias.Tests.ps1 b/test/Scoop-Alias.Tests.ps1
index 7c6c0d842e..1f696f5a89 100644
--- a/test/Scoop-Alias.Tests.ps1
+++ b/test/Scoop-Alias.Tests.ps1
@@ -17,7 +17,7 @@ Describe 'add_alias' -Tag 'Scoop' {
             $alias_file | Should -Not -Exist
 
             add_alias 'rm' '"hello, world!"'
-            Invoke-Expression $alias_file | Should -Be 'hello, world!'
+            & $alias_file | Should -Be 'hello, world!'
         }
     }