diff --git a/android/docs/diagrams/update_graphs.sh b/android/docs/diagrams/update_graphs.sh
index 51d3b74b85ef..c339cdeac1e7 100755
--- a/android/docs/diagrams/update_graphs.sh
+++ b/android/docs/diagrams/update_graphs.sh
@@ -2,4 +2,4 @@
 
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 
-plantuml $SCRIPT_DIR/*.puml
+plantuml "$SCRIPT_DIR"/*.puml
diff --git a/android/fdroid-build/env.sh b/android/fdroid-build/env.sh
index 3e2faf8fe2e3..c6c3e224b6f1 100755
--- a/android/fdroid-build/env.sh
+++ b/android/fdroid-build/env.sh
@@ -1,6 +1,8 @@
+#!/usr/bin/env bash
 # Sourcing this file prepares the environment for building inside the F-Droid build server
 
 # Ensure Cargo tools are accessible
+# shellcheck source=/dev/null
 source "$HOME/.cargo/env"
 
 # Ensure Go compiler is accessible
diff --git a/android/fdroid-build/init.sh b/android/fdroid-build/init.sh
index 4d5cf8ce35cc..07bc5939d72b 100755
--- a/android/fdroid-build/init.sh
+++ b/android/fdroid-build/init.sh
@@ -5,12 +5,12 @@ set -eux
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 REPO_DIR="$SCRIPT_DIR/../../"
-TOOLCHAINS_DIR="$HOME/android-ndk-toolchains"
 
 # Install Rust
 curl -sf -L https://sh.rustup.rs > /tmp/rustup.sh
 chmod +x /tmp/rustup.sh
 /tmp/rustup.sh -y
+# shellcheck source=/dev/null
 source "$HOME/.cargo/env"
 rustup set profile minimal
 rustup target add \
diff --git a/android/scripts/generate-pngs.sh b/android/scripts/generate-pngs.sh
index 6aa4aa380e72..dc72e9f53812 100755
--- a/android/scripts/generate-pngs.sh
+++ b/android/scripts/generate-pngs.sh
@@ -46,11 +46,12 @@ function convert_image() {
 
     local source_image="$1"
     local dpi_config="$2"
+    local destination_image
 
     if (( $# >= 3 )); then
-        local destination_image="$3"
+        destination_image="$3"
     else
-        local destination_image="$(basename "$source_image" .svg | sed -e 's/-/_/g')"
+        destination_image="$(basename "$source_image" .svg | sed -e 's/-/_/g')"
     fi
 
     if (( $# >= 4 )); then
@@ -59,8 +60,10 @@ function convert_image() {
         local destination_dir="drawable"
     fi
 
-    local dpi="$(echo "$dpi_config" | cut -f1 -d'-')"
-    local size="$(echo "$dpi_config" | cut -f2 -d'-')"
+    local dpi
+    dpi="$(echo "$dpi_config" | cut -f1 -d'-')"
+    local size
+    size="$(echo "$dpi_config" | cut -f2 -d'-')"
 
     local dpi_dir="../lib/resource/src/main/res/${destination_dir}-${dpi}"
 
diff --git a/android/scripts/run-instrumented-tests-locally.sh b/android/scripts/run-instrumented-tests-locally.sh
index 359c648d30d9..4a642356eb01 100755
--- a/android/scripts/run-instrumented-tests-locally.sh
+++ b/android/scripts/run-instrumented-tests-locally.sh
@@ -4,7 +4,7 @@ set -eu
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
-cd $SCRIPT_DIR/..
+cd "$SCRIPT_DIR"/..
 ./gradlew assembleOssProdAndroidTest
 ./gradlew app:assembleOssProdDebug
-$SCRIPT_DIR/run-instrumented-tests.sh app
+"$SCRIPT_DIR"/run-instrumented-tests.sh app
diff --git a/android/scripts/run-instrumented-tests.sh b/android/scripts/run-instrumented-tests.sh
index 5e3320533f8b..e72d4687bd29 100755
--- a/android/scripts/run-instrumented-tests.sh
+++ b/android/scripts/run-instrumented-tests.sh
@@ -23,7 +23,7 @@ INVALID_TEST_ACCOUNT_TOKEN="${INVALID_TEST_ACCOUNT_TOKEN:-}"
 while [[ "$#" -gt 0 ]]; do
     case $1 in
         --test-type)
-            if [[ ! -z ${2-} && "$2" =~ ^(app|mockapi|e2e)$ ]]; then
+            if [[ -n "${2-}" && "$2" =~ ^(app|mockapi|e2e)$ ]]; then
                 TEST_TYPE="$2"
             else
                 echo "Error: Bad or missing test type. Must be one of: app, mockapi, e2e"
@@ -32,7 +32,7 @@ while [[ "$#" -gt 0 ]]; do
             shift 2
             ;;
         --infra-flavor)
-            if [[ ! -z ${2-} && "$2" =~ ^(prod|stagemole)$ ]]; then
+            if [[ -n "${2-}" && "$2" =~ ^(prod|stagemole)$ ]]; then
                 INFRA_FLAVOR="$2"
             else
                 echo "Error: Bad or missing infra flavor. Must be one of: prod, stagemole"
@@ -41,7 +41,7 @@ while [[ "$#" -gt 0 ]]; do
             shift 2
             ;;
         --billing-flavor)
-            if [[ ! -z ${2-} && "$2" =~ ^(oss|play)$ ]]; then
+            if [[ -n "${2-}" && "$2" =~ ^(oss|play)$ ]]; then
                 BILLING_FLAVOR="$2"
             else
                 echo "Error: Bad or missing billing flavor. Must be one of: oss, play"
diff --git a/build-apk.sh b/build-apk.sh
index 90a395c33ef4..006b014cb3f3 100755
--- a/build-apk.sh
+++ b/build-apk.sh
@@ -21,7 +21,7 @@ BUILD_BUNDLE="no"
 CARGO_TARGET_DIR=${CARGO_TARGET_DIR:-"target"}
 SKIP_STRIPPING=${SKIP_STRIPPING:-"no"}
 
-while [ ! -z "${1:-""}" ]; do
+while [ -n "${1:-""}" ]; do
     if [[ "${1:-""}" == "--dev-build" ]]; then
         BUILD_TYPE="debug"
         GRADLE_BUILD_TYPE="debug"
@@ -103,7 +103,7 @@ for ARCHITECTURE in ${ARCHITECTURES:-aarch64 armv7 x86_64 i686}; do
     esac
 
     echo "Building mullvad-daemon for $TARGET"
-    cargo build $CARGO_ARGS --target "$TARGET" --package mullvad-jni
+    cargo build "$CARGO_ARGS" --target "$TARGET" --package mullvad-jni
 
     STRIP_TOOL="${NDK_TOOLCHAIN_DIR}/llvm-strip"
     TARGET_LIB_PATH="$SCRIPT_DIR/android/app/build/extraJni/$ABI/libmullvad_jni.so"
@@ -117,7 +117,7 @@ for ARCHITECTURE in ${ARCHITECTURES:-aarch64 armv7 x86_64 i686}; do
 done
 
 echo "Updating relays.json..."
-cargo run --bin relay_list $CARGO_ARGS > build/relays.json
+cargo run --bin relay_list "$CARGO_ARGS" > build/relays.json
 
 cd "$SCRIPT_DIR/android"
 $GRADLE_CMD --console plain "${GRADLE_TASKS[@]}"
diff --git a/building/build-and-publish-container-image.sh b/building/build-and-publish-container-image.sh
index 9c7a068c53e7..4ed02af8162d 100755
--- a/building/build-and-publish-container-image.sh
+++ b/building/build-and-publish-container-image.sh
@@ -53,7 +53,7 @@ trap 'delete_tmp_signature_dir' EXIT
 
 log_header "Pushing $full_container_name:latest"
 podman push "$full_container_name:latest" \
-    --sign-by $CONTAINER_SIGNING_KEY_FINGERPRINT \
+    --sign-by "$CONTAINER_SIGNING_KEY_FINGERPRINT" \
     --digestfile "$tmp_signature_dir/digest_latest"
 
 digest=$(cat "$tmp_signature_dir/digest_latest")
@@ -68,7 +68,7 @@ cp "$signature_dir/signature-1" "$tmp_signature_dir/signature-2"
 
 log_header "Pushing $full_container_name:$tag"
 podman push "$full_container_name:$tag" \
-    --sign-by $CONTAINER_SIGNING_KEY_FINGERPRINT \
+    --sign-by "$CONTAINER_SIGNING_KEY_FINGERPRINT" \
     --digestfile "$tmp_signature_dir/digest_$tag"
 
 if ! cmp -s "$tmp_signature_dir/digest_latest" "$tmp_signature_dir/digest_$tag"; then
diff --git a/ci/buildserver-build.sh b/ci/buildserver-build.sh
index 2b9d2a49048e..8032c99b04fe 100755
--- a/ci/buildserver-build.sh
+++ b/ci/buildserver-build.sh
@@ -20,6 +20,7 @@ LAST_BUILT_DIR="$SCRIPT_DIR/last-built"
 
 BRANCHES_TO_BUILD=("origin/main")
 
+# shellcheck source=ci/buildserver-config.sh
 source "$SCRIPT_DIR/buildserver-config.sh"
 
 # Ask for the passphrase to the signing keys
diff --git a/ci/buildserver-upload.sh b/ci/buildserver-upload.sh
index 0a585d5e9c00..fde7c192b886 100755
--- a/ci/buildserver-upload.sh
+++ b/ci/buildserver-upload.sh
@@ -7,6 +7,7 @@ CODE_SIGNING_KEY_FINGERPRINT="A1198702FC3E0A09A9AE5B75D5A1D4F266DE8DDF"
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
+# shellcheck source=ci/buildserver-config.sh
 source "$SCRIPT_DIR/buildserver-config.sh"
 
 cd "$UPLOAD_DIR"
diff --git a/ci/ios/build-app.sh b/ci/ios/build-app.sh
index abf6fac1cd86..d2eb5907b1d6 100644
--- a/ci/ios/build-app.sh
+++ b/ci/ios/build-app.sh
@@ -17,7 +17,7 @@ cd ~/build/ios
 rm -r Build
 
 # Instantiate Xcconfig templates.
-for file in ./Configurations/*.template ; do cp $file ${file//.template/} ; done
+for file in ./Configurations/*.template ; do cp "$file" "${file//.template/}" ; done
 
 IOS_PROVISIONING_PROFILES_DIR=~/provisioning-profiles \
     PATH=/usr/local/go/bin:$PATH \
diff --git a/ci/ios/buildserver-build-ios.sh b/ci/ios/buildserver-build-ios.sh
index fab47acd976b..9a94a442c62b 100644
--- a/ci/ios/buildserver-build-ios.sh
+++ b/ci/ios/buildserver-build-ios.sh
@@ -14,7 +14,7 @@ export GIT_DIR="$GIT_WORK_TREE/.git"
 function run_git {
     # `git submodule` needs more info than just $GIT_DIR and $GIT_WORK_TREE.
     # But -C makes it work.
-    git -C $GIT_WORK_TREE $@
+    git -C "$GIT_WORK_TREE" "$@"
 }
 
 
@@ -43,7 +43,7 @@ function build_ref() {
     fi
 
     run_git reset --hard
-    run_git checkout $tag
+    run_git checkout "$tag"
     run_git submodule update
     run_git clean -df
 
@@ -92,7 +92,8 @@ function run_build_loop() {
         run_git tag | xargs git tag -d > /dev/null
 
         run_git fetch --prune --tags 2> /dev/null || continue
-        local tags=( $(run_git tag | grep "$TAG_PATTERN_TO_BUILD") )
+        local tags
+        tags=( $(run_git tag | grep "$TAG_PATTERN_TO_BUILD") )
 
         for tag in "${tags[@]}"; do
           build_ref "refs/tags/$tag"
diff --git a/ci/ios/run-build-and-upload.sh b/ci/ios/run-build-and-upload.sh
index 6c15389331ca..769ba484eeeb 100644
--- a/ci/ios/run-build-and-upload.sh
+++ b/ci/ios/run-build-and-upload.sh
@@ -10,7 +10,7 @@
 set -eu -o pipefail
 
 # Add SSH key for iOS build VMs to be able to SSH into them without user interaction
-eval $(ssh-agent)
+eval "$(ssh-agent)"
 ssh-add ~/.ssh/ios-vm-key
 
 # This single path really screws with XCode and wireguard-go's makefiles, which
diff --git a/ci/ios/run-in-vm.sh b/ci/ios/run-in-vm.sh
index 331ba04af4df..fb0a719e40a8 100644
--- a/ci/ios/run-in-vm.sh
+++ b/ci/ios/run-in-vm.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 # This takes the following positional arguments 
 # 1. tart VM name
 # 2. Script to execute in the VM
@@ -23,7 +24,7 @@ sleep 10
 
 # apparently, there's a difference between piping into zsh like this and doing
 # a <(echo $SCRIPT).
-cat "$SCRIPT" | ssh admin@$(tart ip "$VM_NAME") bash /dev/stdin
+cat "$SCRIPT" | ssh admin@"$(tart ip "$VM_NAME")" bash /dev/stdin
 script_status=$?
 
 kill $vm_pid
diff --git a/ci/ios/upload-app.sh b/ci/ios/upload-app.sh
index aebb444384b7..d6e207def22c 100644
--- a/ci/ios/upload-app.sh
+++ b/ci/ios/upload-app.sh
@@ -1,8 +1,10 @@
 #!/usr/bin/env bash
+set -eu
 # Upload script to run in `ios-upload` VM to upload a newly built IPA to TestFlight
 
 VM_UPLOAD_IPA_PATH="/Volumes/My Shared Files/build-output/MullvadVPN.ipa"
 API_KEY_PATH="$HOME/ci/app-store-connect-key.json"
 cd ci/
+# shellcheck source=/dev/null
 source ~/.bash_profile
 bundle exec fastlane pilot upload --api-key-path "${API_KEY_PATH}" --ipa "${VM_UPLOAD_IPA_PATH}"
diff --git a/ci/prepare-apt-repository.sh b/ci/prepare-apt-repository.sh
index 784a6c92f87d..5f4eee9746c7 100755
--- a/ci/prepare-apt-repository.sh
+++ b/ci/prepare-apt-repository.sh
@@ -9,6 +9,7 @@ set -eu
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
+# shellcheck source=ci/buildserver-config.sh
 source "$SCRIPT_DIR/buildserver-config.sh"
 
 artifact_dir=$1
diff --git a/ci/prepare-rpm-repository.sh b/ci/prepare-rpm-repository.sh
index bb89dce2bc21..22616c591f0e 100755
--- a/ci/prepare-rpm-repository.sh
+++ b/ci/prepare-rpm-repository.sh
@@ -9,6 +9,7 @@ set -eu
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
+# shellcheck source=ci/buildserver-config.sh
 source "$SCRIPT_DIR/buildserver-config.sh"
 
 artifact_dir=$1
diff --git a/ci/publish-linux-repositories.sh b/ci/publish-linux-repositories.sh
index bca8451834b4..76d09c33d9b5 100755
--- a/ci/publish-linux-repositories.sh
+++ b/ci/publish-linux-repositories.sh
@@ -9,6 +9,7 @@ set -eu
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
+# shellcheck source=ci/buildserver-config.sh
 source "$SCRIPT_DIR/buildserver-config.sh"
 
 while [ "$#" -gt 0 ]; do
diff --git a/ci/verify-locked-down-signatures.sh b/ci/verify-locked-down-signatures.sh
index 8199a27984b2..407f5f3f285d 100755
--- a/ci/verify-locked-down-signatures.sh
+++ b/ci/verify-locked-down-signatures.sh
@@ -2,7 +2,8 @@
 set -eu
 shopt -s nullglob
 
-readonly SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+readonly SCRIPT_DIR
 readonly REPO_DIR="$SCRIPT_DIR/.."
 
 # In the CI environment we would like to import trusted public keys from a file,
@@ -76,7 +77,7 @@ for locked_path in $locked_down_paths; do
 
     # Check if important file has been removed.
     if [[ ! -e "$REPO_DIR/$locked_path" ]]; then
-        echo "$locked_path was removed. If this was intentional, remove it from `verify-locked-down-signatures.yml`."
+        echo "$locked_path was removed. If this was intentional, remove it from 'verify-locked-down-signatures.yml'"
         important_file_was_removed=1
     fi
 done
diff --git a/gui/scripts/build-logo-icons.sh b/gui/scripts/build-logo-icons.sh
index a1e30dd18b40..e35f713e77d6 100755
--- a/gui/scripts/build-logo-icons.sh
+++ b/gui/scripts/build-logo-icons.sh
@@ -46,8 +46,8 @@ TMP_DIR=$(mktemp -d)
 TMP_ICO_DIR="$TMP_DIR/ico"
 TMP_ICONSET_DIR="$TMP_DIR/icon.iconset"
 
-mkdir $TMP_ICONSET_DIR
-mkdir $TMP_ICO_DIR
+mkdir "$TMP_ICONSET_DIR"
+mkdir "$TMP_ICO_DIR"
 
 COMPRESSION_OPTIONS="-define png:compression-filter=5 -define png:compression-level=9 \
     -define png:compression-strategy=1 -define png:exclude-chunk=all -strip"
@@ -62,30 +62,30 @@ rm "$TMP_ICONSET_DIR"/*
 
 # Linux .icns icon
 for size in 16 32 128 256 512; do
-    double_size=$[$size * 2]
-    rsvg-convert -o $TMP_ICONSET_DIR/icon-$size.png -w $size -h $size $SVG_SOURCE_PATH
-    rsvg-convert -o $TMP_ICONSET_DIR/icon-$size@2x.png -w $double_size -h $double_size \
+    double_size="$((size * 2))"
+    rsvg-convert -o "$TMP_ICONSET_DIR"/icon-$size.png -w $size -h $size $SVG_SOURCE_PATH
+    rsvg-convert -o "$TMP_ICONSET_DIR"/icon-$size@2x.png -w "$double_size" -h "$double_size" \
         $SVG_SOURCE_PATH
 done
-iconutil --convert icns --output $DIST_ASSETS_DIR/icon.icns $TMP_ICONSET_DIR
-rm -rf $TMP_ICONSET_DIR
+iconutil --convert icns --output $DIST_ASSETS_DIR/icon.icns "$TMP_ICONSET_DIR"
+rm -rf "$TMP_ICONSET_DIR"
 
 # Windows .ico icon
 for size in 16 20 24 30 32 36 40 48 60 64 72 80 96 256 512; do
-    rsvg-convert -o $TMP_ICO_DIR/$size.png -w $size -h $size $SVG_SOURCE_PATH
+    rsvg-convert -o "$TMP_ICO_DIR"/$size.png -w $size -h $size $SVG_SOURCE_PATH
 done
-convert $TMP_ICO_DIR/* $COMPRESSION_OPTIONS $DIST_ASSETS_DIR/icon.ico
-rm -rf $TMP_ICO_DIR
+convert "$TMP_ICO_DIR"/* "$COMPRESSION_OPTIONS" $DIST_ASSETS_DIR/icon.ico
+rm -rf "$TMP_ICO_DIR"
 
 # Windows installer sidebar
 # "bmp3" specifies the Windows 3.x format which is required for the image to be displayed
 sidebar_path="$TMP_DIR/sidebar.png"
 sidebar_logo_size=234
-rsvg-convert -o $sidebar_path -w $sidebar_logo_size -h $sidebar_logo_size $SVG_SOURCE_PATH
-convert -background "#294D73" $sidebar_path \
+rsvg-convert -o "$sidebar_path" -w $sidebar_logo_size -h $sidebar_logo_size $SVG_SOURCE_PATH
+convert -background "#294D73" "$sidebar_path" \
     -gravity center -extent ${sidebar_logo_size}x314 \
     -gravity west -crop 164x314+10+0 bmp3:$DIST_ASSETS_DIR/windows/installersidebar.bmp
-rm $sidebar_path
+rm "$sidebar_path"
 
 # GUI notification icon
 rsvg-convert -o ../assets/images/icon-notification.png -w 128 -h 128 $SVG_SOURCE_PATH
@@ -93,5 +93,5 @@ rsvg-convert -o ../assets/images/icon-notification.png -w 128 -h 128 $SVG_SOURCE
 # GUI in app icon
 cp "$SVG_SOURCE_PATH" ../assets/images/logo-icon.svg
 
-rmdir $TMP_DIR
+rmdir "$TMP_DIR"
 
diff --git a/gui/scripts/build-proto.sh b/gui/scripts/build-proto.sh
index 7cb0d989c4f2..8861eb57302d 100755
--- a/gui/scripts/build-proto.sh
+++ b/gui/scripts/build-proto.sh
@@ -24,8 +24,8 @@ mkdir -p $TYPES_DESTINATION_DIR
 
 if [[ "$PLATFORM" == "Linux" && ("${ARCH,,}" == "arm64" || "${ARCH,,}" == "aarch64") ]]; then
     if [[ -n "${MANAGEMENT_INTERFACE_PROTO_BUILD_DIR}" ]]; then
-      cp $MANAGEMENT_INTERFACE_PROTO_BUILD_DIR/*.js $DESTINATION_DIR
-      cp $MANAGEMENT_INTERFACE_PROTO_BUILD_DIR/*.ts $TYPES_DESTINATION_DIR
+      cp "$MANAGEMENT_INTERFACE_PROTO_BUILD_DIR"/*.js $DESTINATION_DIR
+      cp "$MANAGEMENT_INTERFACE_PROTO_BUILD_DIR"/*.ts $TYPES_DESTINATION_DIR
     else
       >&2 echo "Building management interface proto files on aarch64 is not supported"
       >&2 echo "(see https://github.com/grpc/grpc-node/issues/1497)."
@@ -41,7 +41,7 @@ else
       $PROTO_DIR/$PROTO_FILENAME
 
   "$NODE_MODULES_DIR/grpc_tools_node_protoc" \
-      --plugin=protoc-gen-ts=$TS_PROTOC_PLUGIN \
+      --plugin=protoc-gen-ts="$TS_PROTOC_PLUGIN" \
       --ts_out=grpc_js:$TYPES_DESTINATION_DIR \
       --proto_path=$PROTO_DIR \
       $PROTO_DIR/$PROTO_FILENAME
diff --git a/gui/scripts/crowdin.sh b/gui/scripts/crowdin.sh
index 466f643c7568..74f324bfd2f9 100755
--- a/gui/scripts/crowdin.sh
+++ b/gui/scripts/crowdin.sh
@@ -3,7 +3,7 @@ set -e
 
 BASE_URL=https://api.crowdin.com/api/project/mullvad-app
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-ROOT_DIR=$( dirname $SCRIPT_DIR )
+ROOT_DIR=$( dirname "$SCRIPT_DIR" )
 LOCALE_DIR="$ROOT_DIR/locales"
 
 if [ $# -ne 1 ]; then
@@ -32,9 +32,9 @@ function download_translations {
     wget \
         --content-disposition \
         $BASE_URL/download/all.zip?key="$CROWDIN_API_KEY"
-    unzip -o all.zip -d $LOCALE_DIR
-    find $LOCALE_DIR -type d -exec chmod 755 {} \;
-    find $LOCALE_DIR -type f -exec chmod 644 {} \;
+    unzip -o all.zip -d "$LOCALE_DIR"
+    find "$LOCALE_DIR" -type d -exec chmod 755 {} \;
+    find "$LOCALE_DIR" -type f -exec chmod 644 {} \;
     rm all.zip
 }
 
diff --git a/ios/build-rust-library.sh b/ios/build-rust-library.sh
index 3151149a1bda..958b083dc097 100644
--- a/ios/build-rust-library.sh
+++ b/ios/build-rust-library.sh
@@ -43,18 +43,18 @@ for arch in $ARCHS; do
 
       # Intel iOS simulator
       export CFLAGS_x86_64_apple_ios="-target x86_64-apple-ios"
-      $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib $RELFLAG --target x86_64-apple-ios
-      $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib --target x86_64-apple-ios
+      "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib "$RELFLAG" --target x86_64-apple-ios
+      "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib --target x86_64-apple-ios
       ;;
 
     arm64)
       if [ $IS_SIMULATOR -eq 0 ]; then
         # Hardware iOS targets
-        $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib $RELFLAG --target aarch64-apple-ios
-        $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib --target aarch64-apple-ios
+        "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib "$RELFLAG" --target aarch64-apple-ios
+        "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib --target aarch64-apple-ios
       else
-        $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib $RELFLAG --target aarch64-apple-ios-sim
-        $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib --target aarch64-apple-ios-sim
+        "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib "$RELFLAG" --target aarch64-apple-ios-sim
+        "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib --target aarch64-apple-ios-sim
       fi
   esac
 done
diff --git a/ios/build.sh b/ios/build.sh
index d974a733eb7c..2d2e8a649cd1 100755
--- a/ios/build.sh
+++ b/ios/build.sh
@@ -41,9 +41,6 @@ XCODE_ARCHIVE_DIR="$BUILD_OUTPUT_DIR/$PROJECT_NAME.xcarchive"
 # Export options file used for producing .xcarchive
 EXPORT_OPTIONS_PATH="$SCRIPT_DIR/ExportOptions.plist"
 
-# Path to generated IPA file produced after .xcarchive export
-IPA_PATH="$BUILD_OUTPUT_DIR/$PROJECT_NAME.ipa"
-
 # Xcodebuild intermediate files directory
 DERIVED_DATA_DIR="$BUILD_OUTPUT_DIR/DerivedData"
 
@@ -68,7 +65,8 @@ install_mobile_provisioning() {
     fi
 
     for mobile_provisioning_path in "$IOS_PROVISIONING_PROFILES_DIR"/*.mobileprovision; do
-        local profile_uuid=$(get_mobile_provisioning_uuid "$mobile_provisioning_path")
+        local profile_uuid
+        profile_uuid=$(get_mobile_provisioning_uuid "$mobile_provisioning_path")
         local target_path="$SYSTEM_PROVISIONING_PROFILES_DIR/$profile_uuid.mobileprovision"
 
         if [[ -f "$target_path" ]]; then
@@ -95,7 +93,7 @@ release_build() {
     -sdk iphoneos \
     -configuration Release \
     -derivedDataPath "$DERIVED_DATA_DIR" \
-    $@
+    "$@"
 }
 
 # Clean build directory
diff --git a/prepare-release.sh b/prepare-release.sh
index d7de34199d11..2f0e1b7157cb 100755
--- a/prepare-release.sh
+++ b/prepare-release.sh
@@ -85,7 +85,7 @@ fi
 if [[ "$DESKTOP" == "true" ]]; then
     echo "Tagging current git commit with release tag $PRODUCT_VERSION..."
 
-    git tag -s $PRODUCT_VERSION -m $PRODUCT_VERSION
+    git tag -s "$PRODUCT_VERSION" -m "$PRODUCT_VERSION"
     NEW_TAGS+=" $PRODUCT_VERSION"
 fi
 
diff --git a/test/ci-runtests.sh b/test/ci-runtests.sh
index 7a19995b0c3b..80f70a9f09b1 100755
--- a/test/ci-runtests.sh
+++ b/test/ci-runtests.sh
@@ -59,13 +59,13 @@ echo "$NEW_APP_VERSION" > "$SCRIPT_DIR/.ci-logs/last-version.log"
 
 function nice_time {
     SECONDS=0
-    if $@; then
+    if "$@"; then
         result=0
     else
         result=$?
     fi
     s=$SECONDS
-    echo "\"$@\" completed in $(($s/60))m:$(($s%60))s"
+    echo "\"$*\" completed in $((s/60))m:$((s%60))s"
     return $result
 }
 
@@ -82,7 +82,7 @@ function is_dev_version {
 function get_app_filename {
     local version=$1
     local os=$2
-    if is_dev_version $version; then
+    if is_dev_version "$version"; then
         # only save 6 chars of the hash
         local commit="${BASH_REMATCH[3]}"
         version="${BASH_REMATCH[1]}${commit}"
@@ -116,19 +116,20 @@ function download_app_package {
     local os=$2
     local package_repo=""
 
-    if is_dev_version $version; then
+    if is_dev_version "$version"; then
         package_repo="${BUILD_DEV_REPOSITORY}"
     else
         package_repo="${BUILD_RELEASE_REPOSITORY}"
     fi
 
-    local filename=$(get_app_filename $version $os)
+    local filename
+    filename=$(get_app_filename "$version" "$os")
     local url="${package_repo}/$version/$filename"
 
     mkdir -p "$PACKAGES_DIR"
     if [[ ! -f "$PACKAGES_DIR/$filename" ]]; then
         echo "Downloading build for $version ($os) from $url"
-        curl -sf -o "$PACKAGES_DIR/$filename" $url
+        curl -sf -o "$PACKAGES_DIR/$filename" "$url"
     else
         echo "Found build for $version ($os)"
     fi
@@ -137,7 +138,7 @@ function download_app_package {
 function get_e2e_filename {
     local version=$1
     local os=$2
-    if is_dev_version $version; then
+    if is_dev_version "$version"; then
         # only save 6 chars of the hash
         local commit="${BASH_REMATCH[3]}"
         version="${BASH_REMATCH[1]}${commit}"
@@ -164,19 +165,20 @@ function download_e2e_executable {
     local os=$2
     local package_repo=""
 
-    if is_dev_version $version; then
+    if is_dev_version "$version"; then
         package_repo="${BUILD_DEV_REPOSITORY}"
     else
         package_repo="${BUILD_RELEASE_REPOSITORY}"
     fi
 
-    local filename=$(get_e2e_filename $version $os)
+    local filename
+    filename=$(get_e2e_filename "$version" "$os")
     local url="${package_repo}/$version/additional-files/$filename"
 
-    mkdir -p $PACKAGES_DIR
+    mkdir -p "$PACKAGES_DIR"
     if [[ ! -f "$PACKAGES_DIR/$filename" ]]; then
         echo "Downloading e2e executable for $version ($os) from $url"
-        curl -sf -o "$PACKAGES_DIR/$filename" $url
+        curl -sf -o "$PACKAGES_DIR/$filename" "$url"
     else
         echo "Found e2e executable for $version ($os)"
     fi
@@ -185,8 +187,10 @@ function download_e2e_executable {
 function run_tests_for_os {
     local os=$1
 
-    local prev_filename=$(get_app_filename $OLD_APP_VERSION $os)
-    local cur_filename=$(get_app_filename $NEW_APP_VERSION $os)
+    local prev_filename
+    prev_filename=$(get_app_filename "$OLD_APP_VERSION" "$os")
+    local cur_filename
+    cur_filename=$(get_app_filename "$NEW_APP_VERSION" "$os")
 
     rm -f "$SCRIPT_DIR/.ci-logs/${os}_report"
 
@@ -203,10 +207,10 @@ echo "**********************************"
 echo "* Downloading app packages"
 echo "**********************************"
 
-mkdir -p $PACKAGES_DIR
-nice_time download_app_package $OLD_APP_VERSION $TEST_OS
-nice_time download_app_package $NEW_APP_VERSION $TEST_OS
-nice_time download_e2e_executable $NEW_APP_VERSION $TEST_OS
+mkdir -p "$PACKAGES_DIR"
+nice_time download_app_package "$OLD_APP_VERSION" "$TEST_OS"
+nice_time download_app_package "$NEW_APP_VERSION" "$TEST_OS"
+nice_time download_e2e_executable "$NEW_APP_VERSION" "$TEST_OS"
 
 echo "**********************************"
 echo "* Building test runner"
diff --git a/test/scripts/ssh-setup.sh b/test/scripts/ssh-setup.sh
index 9ab1d895f566..a3809e023036 100644
--- a/test/scripts/ssh-setup.sh
+++ b/test/scripts/ssh-setup.sh
@@ -3,7 +3,7 @@
 set -eu
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-cd $SCRIPT_DIR
+cd "$SCRIPT_DIR"
 
 RUNNER_DIR="$1"
 CURRENT_APP="$2"
@@ -14,11 +14,11 @@ UI_RUNNER="$4"
 
 echo "Copying test-runner to $RUNNER_DIR"
 
-mkdir -p $RUNNER_DIR
+mkdir -p "$RUNNER_DIR"
 
 for file in test-runner $CURRENT_APP $PREVIOUS_APP $UI_RUNNER openvpn.ca.crt; do
     echo "Moving $file to $RUNNER_DIR"
-    cp -f "$SCRIPT_DIR/$file" $RUNNER_DIR
+    cp -f "$SCRIPT_DIR/$file" "$RUNNER_DIR"
 done
 
 chown -R root "$RUNNER_DIR/"
diff --git a/wireguard/build-wireguard-go.sh b/wireguard/build-wireguard-go.sh
index ebf0d2e33f17..7e3b11910d82 100755
--- a/wireguard/build-wireguard-go.sh
+++ b/wireguard/build-wireguard-go.sh
@@ -27,12 +27,15 @@ function is_docker_build {
 }
 
 function unix_target_triple {
-    local platform="$(uname -s)"
+    local platform
+    platform="$(uname -s)"
     if [[ ("${platform}" == "Linux") ]]; then
-        local arch="$(uname -m)"
+        local arch
+        arch="$(uname -m)"
         echo "${arch}-unknown-linux-gnu"
     elif [[ ("${platform}" == "Darwin") ]]; then
-        local arch="$(uname -m)"
+        local arch
+        arch="$(uname -m)"
         if [[ ("${arch}" == "arm64") ]]; then
             arch="aarch64"
         fi
@@ -68,7 +71,8 @@ function build_unix {
                 export GOARCH=arm64
             fi
 
-            export CC="$(xcrun -sdk $SDKROOT --find clang) -arch $arch -isysroot $SDKROOT"
+            CC="$(xcrun -sdk "$SDKROOT" --find clang) -arch $arch -isysroot $SDKROOT"
+            export CC
             export CFLAGS="-isysroot $SDKROOT -arch $arch -I$SDKROOT/usr/include"
             export LD_LIBRARY_PATH="$SDKROOT/usr/lib"
             export CGO_CFLAGS="-isysroot $SDKROOT -arch $arch"
@@ -79,15 +83,15 @@ function build_unix {
     pushd libwg
         target_triple_dir="../../build/lib/$1"
 
-        mkdir -p $target_triple_dir
-        go build -v -o $target_triple_dir/libwg.a -buildmode c-archive
+        mkdir -p "$target_triple_dir"
+        go build -v -o "$target_triple_dir"/libwg.a -buildmode c-archive
     popd
 }
 
 function build_android {
     echo "Building for android"
 
-    if is_docker_build $@; then
+    if is_docker_build "$@"; then
         ../building/container-run.sh android wireguard/libwg/build-android.sh
     else
         ./libwg/build-android.sh
@@ -95,14 +99,15 @@ function build_android {
 }
 
 function build_wireguard_go {
-    if is_android_build $@; then
-        build_android $@
+    if is_android_build "$@"; then
+        build_android "$@"
         return
     fi
 
-    local platform="$(uname -s)";
+    local platform
+    platform="$(uname -s)";
     case  "$platform" in
-        Linux*|Darwin*) build_unix ${1:-$(unix_target_triple)};;
+        Linux*|Darwin*) build_unix "${1:-$(unix_target_triple)}";;
         *)
             echo "Unsupported platform"
             return 1
@@ -112,5 +117,5 @@ function build_wireguard_go {
 
 # Ensure we are in the correct directory for the execution of this script
 script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-cd $script_dir
-build_wireguard_go $@
+cd "$script_dir"
+build_wireguard_go "$@"
diff --git a/wireguard/libwg/build-android.sh b/wireguard/libwg/build-android.sh
index dcfbb34dff87..d1d2705c9b36 100755
--- a/wireguard/libwg/build-android.sh
+++ b/wireguard/libwg/build-android.sh
@@ -4,11 +4,11 @@ set -eu
 
 # Ensure we are in the correct directory for the execution of this script
 script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-cd $script_dir
+cd "$script_dir"
 
 # Keep a GOPATH in the build directory to maintain a cache of downloaded libraries
 export GOPATH=$script_dir/../../build/android-go-path/
-mkdir -p $GOPATH
+mkdir -p "$GOPATH"
 
 ANDROID_STRIP_TOOL="${NDK_TOOLCHAIN_DIR}/llvm-strip"
 
@@ -41,7 +41,7 @@ for arch in ${ARCHITECTURES:-armv7 aarch64 x86_64 i686}; do
     esac
 
     # Build Wireguard-Go
-    echo $(pwd)
+    echo "$(pwd)"
     make -f Android.mk clean
     make -f Android.mk
 
@@ -62,4 +62,4 @@ for arch in ${ARCHITECTURES:-armv7 aarch64 x86_64 i686}; do
 done
 
 # ensure `git clean -fd` does not require root permissions
-find $GOPATH -exec chmod +rw {} \;
+find "$GOPATH" -exec chmod +rw {} \;