diff --git a/.github/scripts/main/hygiene.sh b/.github/scripts/main/hygiene.sh
index e1c9700bfd7..042ba352770 100644
--- a/.github/scripts/main/hygiene.sh
+++ b/.github/scripts/main/hygiene.sh
@@ -58,7 +58,7 @@ case $GITHUB_EVENT_NAME in
     CheckConfigure "$GITHUB_SHA"
     ;;
   pull_request)
-    for commit in $(git rev-list "$BASE_REF_SHA"..."$PR_REF_SHA" --reverse)
+    for commit in $(git rev-list "$BASE_REF_SHA...$PR_REF_SHA" --reverse)
     do
       echo "check configure for $commit"
       CheckConfigure "$commit"
diff --git a/.github/scripts/main/ocaml-cache.sh b/.github/scripts/main/ocaml-cache.sh
index 9c6605b89c4..e202b6f93ae 100644
--- a/.github/scripts/main/ocaml-cache.sh
+++ b/.github/scripts/main/ocaml-cache.sh
@@ -115,7 +115,7 @@ if [[ $OPAM_TEST -ne 1 ]] ; then
   fi
 fi
 
-if ! ./configure --prefix "$PREFIX""$HOST" --with-vendored-deps "${CONFIGURE_SWITCHES:-}" ; then
+if ! ./configure --prefix "$PREFIX$HOST" --with-vendored-deps "${CONFIGURE_SWITCHES:-}" ; then
   echo
   echo -e "[\e[31mERROR\e[0m] OCaml's configure script failed"
   (set +x ; echo -en "::group::config.log contents\r") 2>/dev/null
diff --git a/.github/scripts/main/preamble.sh b/.github/scripts/main/preamble.sh
index 10b7abfc7db..1d04b224aa0 100644
--- a/.github/scripts/main/preamble.sh
+++ b/.github/scripts/main/preamble.sh
@@ -44,9 +44,9 @@ init-bootstrap () {
     export OPAMROOT=$OPAMBSROOT
     # The system compiler will be picked up
     if [ "${OPAM_REPO%.git}" != "${OPAM_REPO_MAIN%.git}" ]; then
-      opam init --no-setup git+$OPAM_REPO_MAIN#"$OPAM_REPO_SHA"
+      opam init --no-setup git+"$OPAM_REPO_MAIN#$OPAM_REPO_SHA"
     else
-      opam init --no-setup git+"$OPAM_REPO_CACHE"#"$OPAM_REPO_SHA"
+      opam init --no-setup git+"$OPAM_REPO_CACHE#$OPAM_REPO_SHA"
     fi
 
     cat >> "$OPAMROOT"/config <<EOF
diff --git a/.github/scripts/main/test.sh b/.github/scripts/main/test.sh
index 65755b52669..417bb73b760 100644
--- a/.github/scripts/main/test.sh
+++ b/.github/scripts/main/test.sh
@@ -17,7 +17,7 @@ fi
 # The SHA is fixed so that upstream changes shouldn't affect CI. The SHA needs
 # to be moved forwards when a new version of OCaml is added to ensure that the
 # ocaml-system package is available at the correct version.
-opam init --bare default git+"$OPAM_REPO_CACHE"#"$OPAM_TEST_REPO_SHA"
+opam init --bare default git+"$OPAM_REPO_CACHE#$OPAM_TEST_REPO_SHA"
 cat >> $(opam var root --global 2>/dev/null)/config <<EOF
 archive-mirrors: "https://opam.ocaml.org/cache"
 EOF
diff --git a/shell/bootstrap-ocaml.sh b/shell/bootstrap-ocaml.sh
index 9244d34049f..d0c158c0964 100755
--- a/shell/bootstrap-ocaml.sh
+++ b/shell/bootstrap-ocaml.sh
@@ -20,7 +20,7 @@ V=$(echo "${URL}"| sed -e 's|.*/\([^/]*\)\.tar\.gz|\1|')
 FV_URL=$(sed -ne 's/URL_flexdll *= *//p' "$BOOTSTRAP_ROOT"/src_ext/Makefile | tr -d '\r')
 FLEXDLL=$(echo "${FV_URL}"| sed -e 's|.*/\([^/]*\)|\1|')
 if [ ! -e "${V}".tar.gz ]; then
-  cp "$BOOTSTRAP_ROOT"/src_ext/archives/"${V}".tar.gz . 2>/dev/null || ${CURL} "${URL}"
+  cp "$BOOTSTRAP_ROOT/src_ext/archives/${V}".tar.gz . 2>/dev/null || ${CURL} "${URL}"
 fi
 
 ACTUALMD5=$(openssl md5 "${V}".tar.gz  2> /dev/null | cut -f 2 -d ' ')
@@ -128,13 +128,13 @@ if [ -n "$1" ] && [ -n "${COMSPEC}" ] && [ -x "${COMSPEC}" ] ; then
   fi
   cd ..
   if [ ! -e "${FLEXDLL}" ]; then
-    cp "$BOOTSTRAP_ROOT"/src_ext/archives/"${FLEXDLL}" . 2>/dev/null || ${CURL} "${FV_URL}"
+    cp "$BOOTSTRAP_ROOT/src_ext/archives/${FLEXDLL}" . 2>/dev/null || ${CURL} "${FV_URL}"
   fi
   cd "${V}"
   PREFIX=$(cd .. ; pwd)/ocaml
   WINPREFIX=$(echo "${PREFIX}" | cygpath -f - -m)
   if [ "${GEN_CONFIG_ONLY}" -eq 0 ] ; then
-    tar -xzf "$BOOTSTRAP_ROOT"/"${FLEXDLL}"
+    tar -xzf "$BOOTSTRAP_ROOT/${FLEXDLL}"
     rm -rf flexdll
     mv flexdll-* flexdll
     PATH="${PATH_PREPEND}${PREFIX}/bin:${PATH}" \
diff --git a/shell/opam_installer.sh b/shell/opam_installer.sh
index 802af7129a8..c6f105a833b 100755
--- a/shell/opam_installer.sh
+++ b/shell/opam_installer.sh
@@ -76,11 +76,11 @@ mkdir -p "$BINDIR" 2>/dev/null || true
 if [ ! -w "$BINDIR" ]; then
     echo "You don't have write access to $BINDIR: sudo may ask for your password"
     if [ ! -d "$BINDIR" ]; then sudo mkdir -p "$BINDIR"; fi
-    sudo install -g root -o root -m 755 "$TMP"/"$file" "$BINDIR"/opam
+    sudo install -g root -o root -m 755 "$TMP/$file" "$BINDIR"/opam
 else
-    install -m 755 "$TMP"/"$file" "$BINDIR"/opam
+    install -m 755 "$TMP/$file" "$BINDIR"/opam
 fi
-rm -f "$TMP"/"$file"
+rm -f "$TMP/$file"
 
 OPAM=$(which opam || echo "$BINDIR/opam")
 if [ "$OPAM" != "$BINDIR/opam" ]; then
diff --git a/shell/re-patch.sh b/shell/re-patch.sh
index 48d8d59280d..c881e0390bf 100755
--- a/shell/re-patch.sh
+++ b/shell/re-patch.sh
@@ -38,7 +38,7 @@ for package in $(cd patches ; find . -maxdepth 1 -mindepth 1 -type d | sed -e 's
   # Re-do the patches
   for mode in $modes ; do
     # Extract the package in this mode
-    make "$package"."$mode"
+    make "$package.$mode"
     rm -rf "$package"
     if [[ -e $package.tar.gz ]] ; then
       tarball=$package.tar.gz
@@ -47,9 +47,9 @@ for package in $(cd patches ; find . -maxdepth 1 -mindepth 1 -type d | sed -e 's
       tarball=$package.tbz
       tar_flag=j
     fi
-    rm -rf tmp-"$package"."$mode"
-    mkdir tmp-"$package"."$mode"
-    cd tmp-"$package"."$mode"
+    rm -rf tmp-"$package.$mode"
+    mkdir tmp-"$package.$mode"
+    cd tmp-"$package.$mode"
     tar -x$tar_flag -f ../"$tarball"
     while IFS= read -r -d '' dir ; do
       if [[ $dir = "." || $dir = ".." ]] ; then continue ; fi
@@ -80,6 +80,6 @@ for package in $(cd patches ; find . -maxdepth 1 -mindepth 1 -type d | sed -e 's
     done
 
     cd ..
-    rm -rf tmp-"$package"."$mode"
+    rm -rf tmp-"$package.$mode"
   done
 done
diff --git a/src_ext/update-sources.sh b/src_ext/update-sources.sh
index 7b9da8502cc..428d5e105b4 100755
--- a/src_ext/update-sources.sh
+++ b/src_ext/update-sources.sh
@@ -13,9 +13,9 @@ while read -r name prefix version url; do
   esac
   latest=$(opam show "$package" -f all-versions | sed -e 's/  base//')
   latest=${latest##* }
-  package_url=$(opam show "$package"."$latest" -f url.src: | sed -e 's/"//g')
+  package_url=$(opam show "$package.$latest" -f url.src: | sed -e 's/"//g')
   md5=$(sed -n -e "s/MD5$prefix$name *= *\(.*\)/\1/p" Makefile.sources)
-  package_md5=$(opam show "$package"."$latest" -f url.checksum: | sed -n -e "/md5/s/.*md5=\([a-fA-F0-9]\{32\}\).*/\1/p")
+  package_md5=$(opam show "$package.$latest" -f url.checksum: | sed -n -e "/md5/s/.*md5=\([a-fA-F0-9]\{32\}\).*/\1/p")
   if [[ -z $package_md5 ]] ; then
     echo -e "\n$name: [\033[1;33mWARN\033[m] no md5 given in opam, downloading $package_url to check"
     package_md5=$(curl -LSs "$package_url" | md5sum | cut -f1 -d' ')