diff --git a/server/mdm/maintainedapps/scripts.go b/server/mdm/maintainedapps/scripts.go
index f23ea5847bc5..1a3179b28531 100644
--- a/server/mdm/maintainedapps/scripts.go
+++ b/server/mdm/maintainedapps/scripts.go
@@ -332,9 +332,17 @@ func (s *scriptBuilder) String() string {
 	}
 
 	if len(s.functions) > 0 {
-		for _, fn := range s.functions {
+		// write functions, order them alphabetically to produce deterministic
+		// scripts.
+		script.WriteString("# functions\n")
+		keys := make([]string, 0, len(s.functions))
+		for name := range s.functions {
+			keys = append(keys, name)
+		}
+		sort.Strings(keys)
+		for _, name := range keys {
 			script.WriteString("\n")
-			script.WriteString(fn)
+			script.WriteString(s.functions[name])
 			script.WriteString("\n")
 		}
 	}
diff --git a/server/mdm/maintainedapps/testdata/scripts/1password_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/1password_uninstall.golden.sh
index 99f0a5d0534c..b12d324a6087 100644
--- a/server/mdm/maintainedapps/testdata/scripts/1password_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/1password_uninstall.golden.sh
@@ -3,6 +3,7 @@
 # variables
 APPDIR="/Applications/"
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
 
 trash() {
   local logged_in_user="$1"
diff --git a/server/mdm/maintainedapps/testdata/scripts/adobe-acrobat-reader_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/adobe-acrobat-reader_uninstall.golden.sh
index 8c8ce7408d5d..7a6e702ffe3f 100644
--- a/server/mdm/maintainedapps/testdata/scripts/adobe-acrobat-reader_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/adobe-acrobat-reader_uninstall.golden.sh
@@ -2,6 +2,45 @@
 
 # variables
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
+
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
 
 remove_launchctl_service() {
   local service="$1"
@@ -48,44 +87,6 @@ remove_launchctl_service() {
   done
 }
 
-quit_application() {
-  local bundle_id="$1"
-  local timeout_duration=10
-
-  # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
-    return
-  fi
-
-  local console_user
-  console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
-    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
-    return
-  fi
-
-  echo "Quitting application '$bundle_id'..."
-
-  # try to quit the application within the timeout period
-  local quit_success=false
-  SECONDS=0
-  while (( SECONDS < timeout_duration )); do
-    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
-      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
-        echo "Application '$bundle_id' quit successfully."
-        quit_success=true
-        break
-      fi
-    fi
-    sleep 1
-  done
-
-  if [[ "$quit_success" = false ]]; then
-    echo "Application '$bundle_id' did not quit."
-  fi
-}
-
-
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
diff --git a/server/mdm/maintainedapps/testdata/scripts/box-drive_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/box-drive_uninstall.golden.sh
index 4eceaba05740..11cd1c552deb 100644
--- a/server/mdm/maintainedapps/testdata/scripts/box-drive_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/box-drive_uninstall.golden.sh
@@ -2,6 +2,45 @@
 
 # variables
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
+
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
 
 remove_launchctl_service() {
   local service="$1"
@@ -48,44 +87,6 @@ remove_launchctl_service() {
   done
 }
 
-quit_application() {
-  local bundle_id="$1"
-  local timeout_duration=10
-
-  # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
-    return
-  fi
-
-  local console_user
-  console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
-    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
-    return
-  fi
-
-  echo "Quitting application '$bundle_id'..."
-
-  # try to quit the application within the timeout period
-  local quit_success=false
-  SECONDS=0
-  while (( SECONDS < timeout_duration )); do
-    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
-      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
-        echo "Application '$bundle_id' quit successfully."
-        quit_success=true
-        break
-      fi
-    fi
-    sleep 1
-  done
-
-  if [[ "$quit_success" = false ]]; then
-    echo "Application '$bundle_id' did not quit."
-  fi
-}
-
-
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
diff --git a/server/mdm/maintainedapps/testdata/scripts/brave-browser_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/brave-browser_uninstall.golden.sh
index 626ce922a42e..c31741a1b6d6 100644
--- a/server/mdm/maintainedapps/testdata/scripts/brave-browser_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/brave-browser_uninstall.golden.sh
@@ -3,6 +3,7 @@
 # variables
 APPDIR="/Applications/"
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
 
 trash() {
   local logged_in_user="$1"
diff --git a/server/mdm/maintainedapps/testdata/scripts/cloudflare-warp_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/cloudflare-warp_uninstall.golden.sh
index 84d8d93b4a92..32a20bdb719b 100644
--- a/server/mdm/maintainedapps/testdata/scripts/cloudflare-warp_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/cloudflare-warp_uninstall.golden.sh
@@ -2,6 +2,45 @@
 
 # variables
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
+
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
 
 remove_launchctl_service() {
   local service="$1"
@@ -48,44 +87,6 @@ remove_launchctl_service() {
   done
 }
 
-quit_application() {
-  local bundle_id="$1"
-  local timeout_duration=10
-
-  # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
-    return
-  fi
-
-  local console_user
-  console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
-    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
-    return
-  fi
-
-  echo "Quitting application '$bundle_id'..."
-
-  # try to quit the application within the timeout period
-  local quit_success=false
-  SECONDS=0
-  while (( SECONDS < timeout_duration )); do
-    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
-      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
-        echo "Application '$bundle_id' quit successfully."
-        quit_success=true
-        break
-      fi
-    fi
-    sleep 1
-  done
-
-  if [[ "$quit_success" = false ]]; then
-    echo "Application '$bundle_id' did not quit."
-  fi
-}
-
-
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
diff --git a/server/mdm/maintainedapps/testdata/scripts/docker_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/docker_uninstall.golden.sh
index b2da0b8e4b2e..02d6d5d91052 100644
--- a/server/mdm/maintainedapps/testdata/scripts/docker_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/docker_uninstall.golden.sh
@@ -3,6 +3,45 @@
 # variables
 APPDIR="/Applications/"
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
+
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
 
 remove_launchctl_service() {
   local service="$1"
@@ -49,44 +88,6 @@ remove_launchctl_service() {
   done
 }
 
-quit_application() {
-  local bundle_id="$1"
-  local timeout_duration=10
-
-  # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
-    return
-  fi
-
-  local console_user
-  console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
-    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
-    return
-  fi
-
-  echo "Quitting application '$bundle_id'..."
-
-  # try to quit the application within the timeout period
-  local quit_success=false
-  SECONDS=0
-  while (( SECONDS < timeout_duration )); do
-    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
-      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
-        echo "Application '$bundle_id' quit successfully."
-        quit_success=true
-        break
-      fi
-    fi
-    sleep 1
-  done
-
-  if [[ "$quit_success" = false ]]; then
-    echo "Application '$bundle_id' did not quit."
-  fi
-}
-
-
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
diff --git a/server/mdm/maintainedapps/testdata/scripts/figma_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/figma_uninstall.golden.sh
index 59a23d892833..551651b8736c 100644
--- a/server/mdm/maintainedapps/testdata/scripts/figma_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/figma_uninstall.golden.sh
@@ -3,6 +3,7 @@
 # variables
 APPDIR="/Applications/"
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
 
 trash() {
   local logged_in_user="$1"
diff --git a/server/mdm/maintainedapps/testdata/scripts/firefox_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/firefox_uninstall.golden.sh
index f317952a50eb..b082bae00e79 100644
--- a/server/mdm/maintainedapps/testdata/scripts/firefox_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/firefox_uninstall.golden.sh
@@ -3,6 +3,7 @@
 # variables
 APPDIR="/Applications/"
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
 
 quit_application() {
   local bundle_id="$1"
diff --git a/server/mdm/maintainedapps/testdata/scripts/google-chrome_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/google-chrome_uninstall.golden.sh
index c14c7149bba5..0d657a9b8daa 100644
--- a/server/mdm/maintainedapps/testdata/scripts/google-chrome_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/google-chrome_uninstall.golden.sh
@@ -3,6 +3,7 @@
 # variables
 APPDIR="/Applications/"
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
 
 remove_launchctl_service() {
   local service="$1"
diff --git a/server/mdm/maintainedapps/testdata/scripts/microsoft-edge_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/microsoft-edge_uninstall.golden.sh
index f87130f753ae..31592353cc9e 100644
--- a/server/mdm/maintainedapps/testdata/scripts/microsoft-edge_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/microsoft-edge_uninstall.golden.sh
@@ -2,27 +2,7 @@
 
 # variables
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
-
-trash() {
-  local logged_in_user="$1"
-  local target_file="$2"
-  local timestamp="$(date +%Y-%m-%d-%s)"
-
-  # replace ~ with /Users/$logged_in_user
-  if [[ "$target_file" == ~* ]]; then
-    target_file="/Users/$logged_in_user${target_file:1}"
-  fi
-
-  local trash="/Users/$logged_in_user/.Trash"
-  local file_name="$(basename "${target_file}")"
-
-  if [[ -e "$target_file" ]]; then
-    echo "removing $target_file."
-    mv -f "$target_file" "$trash/${file_name}_${timestamp}"
-  else
-    echo "$target_file doesn't exist."
-  fi
-}
+# functions
 
 remove_launchctl_service() {
   local service="$1"
@@ -69,6 +49,27 @@ remove_launchctl_service() {
   done
 }
 
+trash() {
+  local logged_in_user="$1"
+  local target_file="$2"
+  local timestamp="$(date +%Y-%m-%d-%s)"
+
+  # replace ~ with /Users/$logged_in_user
+  if [[ "$target_file" == ~* ]]; then
+    target_file="/Users/$logged_in_user${target_file:1}"
+  fi
+
+  local trash="/Users/$logged_in_user/.Trash"
+  local file_name="$(basename "${target_file}")"
+
+  if [[ -e "$target_file" ]]; then
+    echo "removing $target_file."
+    mv -f "$target_file" "$trash/${file_name}_${timestamp}"
+  else
+    echo "$target_file doesn't exist."
+  fi
+}
+
 remove_launchctl_service 'com.microsoft.EdgeUpdater.update-internal.109.0.1518.89.system'
 remove_launchctl_service 'com.microsoft.EdgeUpdater.update.system'
 remove_launchctl_service 'com.microsoft.EdgeUpdater.wake.system'
diff --git a/server/mdm/maintainedapps/testdata/scripts/microsoft-excel_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/microsoft-excel_uninstall.golden.sh
index d36e6e14442e..170c57073258 100644
--- a/server/mdm/maintainedapps/testdata/scripts/microsoft-excel_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/microsoft-excel_uninstall.golden.sh
@@ -2,6 +2,45 @@
 
 # variables
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
+
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
 
 remove_launchctl_service() {
   local service="$1"
@@ -48,44 +87,6 @@ remove_launchctl_service() {
   done
 }
 
-quit_application() {
-  local bundle_id="$1"
-  local timeout_duration=10
-
-  # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
-    return
-  fi
-
-  local console_user
-  console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
-    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
-    return
-  fi
-
-  echo "Quitting application '$bundle_id'..."
-
-  # try to quit the application within the timeout period
-  local quit_success=false
-  SECONDS=0
-  while (( SECONDS < timeout_duration )); do
-    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
-      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
-        echo "Application '$bundle_id' quit successfully."
-        quit_success=true
-        break
-      fi
-    fi
-    sleep 1
-  done
-
-  if [[ "$quit_success" = false ]]; then
-    echo "Application '$bundle_id' did not quit."
-  fi
-}
-
-
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
diff --git a/server/mdm/maintainedapps/testdata/scripts/microsoft-teams_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/microsoft-teams_uninstall.golden.sh
index edc9aeefc657..c3193ccc3d45 100644
--- a/server/mdm/maintainedapps/testdata/scripts/microsoft-teams_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/microsoft-teams_uninstall.golden.sh
@@ -2,6 +2,45 @@
 
 # variables
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
+
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
 
 remove_launchctl_service() {
   local service="$1"
@@ -48,44 +87,6 @@ remove_launchctl_service() {
   done
 }
 
-quit_application() {
-  local bundle_id="$1"
-  local timeout_duration=10
-
-  # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
-    return
-  fi
-
-  local console_user
-  console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
-    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
-    return
-  fi
-
-  echo "Quitting application '$bundle_id'..."
-
-  # try to quit the application within the timeout period
-  local quit_success=false
-  SECONDS=0
-  while (( SECONDS < timeout_duration )); do
-    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
-      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
-        echo "Application '$bundle_id' quit successfully."
-        quit_success=true
-        break
-      fi
-    fi
-    sleep 1
-  done
-
-  if [[ "$quit_success" = false ]]; then
-    echo "Application '$bundle_id' did not quit."
-  fi
-}
-
-
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
diff --git a/server/mdm/maintainedapps/testdata/scripts/microsoft-word_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/microsoft-word_uninstall.golden.sh
index 816fad2d8fb8..312f00d1eab4 100644
--- a/server/mdm/maintainedapps/testdata/scripts/microsoft-word_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/microsoft-word_uninstall.golden.sh
@@ -2,28 +2,46 @@
 
 # variables
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
 
-trash() {
-  local logged_in_user="$1"
-  local target_file="$2"
-  local timestamp="$(date +%Y-%m-%d-%s)"
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
 
-  # replace ~ with /Users/$logged_in_user
-  if [[ "$target_file" == ~* ]]; then
-    target_file="/Users/$logged_in_user${target_file:1}"
+  # check if the application is running
+  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+    return
   fi
 
-  local trash="/Users/$logged_in_user/.Trash"
-  local file_name="$(basename "${target_file}")"
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
 
-  if [[ -e "$target_file" ]]; then
-    echo "removing $target_file."
-    mv -f "$target_file" "$trash/${file_name}_${timestamp}"
-  else
-    echo "$target_file doesn't exist."
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
   fi
 }
 
+
 remove_launchctl_service() {
   local service="$1"
   local booleans=("true" "false")
@@ -69,44 +87,27 @@ remove_launchctl_service() {
   done
 }
 
-quit_application() {
-  local bundle_id="$1"
-  local timeout_duration=10
-
-  # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
-    return
-  fi
+trash() {
+  local logged_in_user="$1"
+  local target_file="$2"
+  local timestamp="$(date +%Y-%m-%d-%s)"
 
-  local console_user
-  console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
-    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
-    return
+  # replace ~ with /Users/$logged_in_user
+  if [[ "$target_file" == ~* ]]; then
+    target_file="/Users/$logged_in_user${target_file:1}"
   fi
 
-  echo "Quitting application '$bundle_id'..."
-
-  # try to quit the application within the timeout period
-  local quit_success=false
-  SECONDS=0
-  while (( SECONDS < timeout_duration )); do
-    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
-      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
-        echo "Application '$bundle_id' quit successfully."
-        quit_success=true
-        break
-      fi
-    fi
-    sleep 1
-  done
+  local trash="/Users/$logged_in_user/.Trash"
+  local file_name="$(basename "${target_file}")"
 
-  if [[ "$quit_success" = false ]]; then
-    echo "Application '$bundle_id' did not quit."
+  if [[ -e "$target_file" ]]; then
+    echo "removing $target_file."
+    mv -f "$target_file" "$trash/${file_name}_${timestamp}"
+  else
+    echo "$target_file doesn't exist."
   fi
 }
 
-
 remove_launchctl_service 'com.microsoft.office.licensingV2.helper'
 quit_application 'com.microsoft.autoupdate2'
 sudo pkgutil --forget 'com.microsoft.package.Microsoft_Word.app'
diff --git a/server/mdm/maintainedapps/testdata/scripts/notion_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/notion_uninstall.golden.sh
index fdea25b2ed30..abbe904ee983 100644
--- a/server/mdm/maintainedapps/testdata/scripts/notion_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/notion_uninstall.golden.sh
@@ -3,6 +3,7 @@
 # variables
 APPDIR="/Applications/"
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
 
 trash() {
   local logged_in_user="$1"
diff --git a/server/mdm/maintainedapps/testdata/scripts/postman_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/postman_uninstall.golden.sh
index 0339c0cfc843..89e7892499c6 100644
--- a/server/mdm/maintainedapps/testdata/scripts/postman_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/postman_uninstall.golden.sh
@@ -3,6 +3,7 @@
 # variables
 APPDIR="/Applications/"
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
 
 trash() {
   local logged_in_user="$1"
diff --git a/server/mdm/maintainedapps/testdata/scripts/slack_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/slack_uninstall.golden.sh
index 05782f8b4212..702aeb3a7ce5 100644
--- a/server/mdm/maintainedapps/testdata/scripts/slack_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/slack_uninstall.golden.sh
@@ -3,6 +3,7 @@
 # variables
 APPDIR="/Applications/"
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
 
 quit_application() {
   local bundle_id="$1"
diff --git a/server/mdm/maintainedapps/testdata/scripts/teamviewer_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/teamviewer_uninstall.golden.sh
index e60721f54b34..6a584a8d9f86 100644
--- a/server/mdm/maintainedapps/testdata/scripts/teamviewer_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/teamviewer_uninstall.golden.sh
@@ -2,6 +2,45 @@
 
 # variables
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
+
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
 
 remove_launchctl_service() {
   local service="$1"
@@ -48,44 +87,6 @@ remove_launchctl_service() {
   done
 }
 
-quit_application() {
-  local bundle_id="$1"
-  local timeout_duration=10
-
-  # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
-    return
-  fi
-
-  local console_user
-  console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
-    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
-    return
-  fi
-
-  echo "Quitting application '$bundle_id'..."
-
-  # try to quit the application within the timeout period
-  local quit_success=false
-  SECONDS=0
-  while (( SECONDS < timeout_duration )); do
-    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
-      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
-        echo "Application '$bundle_id' quit successfully."
-        quit_success=true
-        break
-      fi
-    fi
-    sleep 1
-  done
-
-  if [[ "$quit_success" = false ]]; then
-    echo "Application '$bundle_id' did not quit."
-  fi
-}
-
-
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
diff --git a/server/mdm/maintainedapps/testdata/scripts/visual-studio-code_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/visual-studio-code_uninstall.golden.sh
index 6fc888562930..952e5141f306 100644
--- a/server/mdm/maintainedapps/testdata/scripts/visual-studio-code_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/visual-studio-code_uninstall.golden.sh
@@ -3,6 +3,45 @@
 # variables
 APPDIR="/Applications/"
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
+
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
 
 remove_launchctl_service() {
   local service="$1"
@@ -49,44 +88,6 @@ remove_launchctl_service() {
   done
 }
 
-quit_application() {
-  local bundle_id="$1"
-  local timeout_duration=10
-
-  # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
-    return
-  fi
-
-  local console_user
-  console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
-    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
-    return
-  fi
-
-  echo "Quitting application '$bundle_id'..."
-
-  # try to quit the application within the timeout period
-  local quit_success=false
-  SECONDS=0
-  while (( SECONDS < timeout_duration )); do
-    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
-      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
-        echo "Application '$bundle_id' quit successfully."
-        quit_success=true
-        break
-      fi
-    fi
-    sleep 1
-  done
-
-  if [[ "$quit_success" = false ]]; then
-    echo "Application '$bundle_id' did not quit."
-  fi
-}
-
-
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
diff --git a/server/mdm/maintainedapps/testdata/scripts/whatsapp_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/whatsapp_uninstall.golden.sh
index cc2922beea5d..427218681d9c 100644
--- a/server/mdm/maintainedapps/testdata/scripts/whatsapp_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/whatsapp_uninstall.golden.sh
@@ -3,6 +3,7 @@
 # variables
 APPDIR="/Applications/"
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
 
 trash() {
   local logged_in_user="$1"
diff --git a/server/mdm/maintainedapps/testdata/scripts/zoom_uninstall.golden.sh b/server/mdm/maintainedapps/testdata/scripts/zoom_uninstall.golden.sh
index a3f66c1294b7..b0a5a94fb743 100644
--- a/server/mdm/maintainedapps/testdata/scripts/zoom_uninstall.golden.sh
+++ b/server/mdm/maintainedapps/testdata/scripts/zoom_uninstall.golden.sh
@@ -2,6 +2,7 @@
 
 # variables
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
+# functions
 
 remove_launchctl_service() {
   local service="$1"