diff --git a/.github/scripts/changelog/checker.sh b/.github/scripts/changelog/checker.sh
index f8b31355dd4..eab4f534b82 100644
--- a/.github/scripts/changelog/checker.sh
+++ b/.github/scripts/changelog/checker.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 # This script check that the current master changelog has been updated by PR,
 # ignoring some internal files.
 # It is used by the changelog_check github action.
@@ -31,11 +32,11 @@ release
 changelog=master_changes.md
 diffile=/tmp/diff
 
-git fetch origin $GITHUB_BASE_REF --depth=1 --quiet
+git fetch origin "$GITHUB_BASE_REF" --depth=1 --quiet
 echo "> base commit"
-git show origin/$GITHUB_BASE_REF --format=oneline -s
+git show origin/"$GITHUB_BASE_REF" --format=oneline -s
 
-git diff origin/$GITHUB_BASE_REF --name-only --diff-filter=AMRCX > $diffile
+git diff origin/"$GITHUB_BASE_REF" --name-only --diff-filter=AMRCX > $diffile
 updated=0
 grep -sq $changelog $diffile || updated=1
 
@@ -49,9 +50,9 @@ done
 echo "> kept changes"
 cat $diffile
 
-num_changes=`wc -l $diffile | cut -f 1 -d ' '`
+num_changes=$(wc -l $diffile | cut -f 1 -d ' ')
 
-if [ $num_changes -ne 0 ] ; then
+if [ "$num_changes" -ne 0 ] ; then
   if [ $updated -eq 0 ] ; then
     echo -e "\033[32mChangelog updated\033[m"
   else
diff --git a/.github/scripts/common/hygiene-preamble.sh b/.github/scripts/common/hygiene-preamble.sh
index 63dc514629b..fd46412c45f 100644
--- a/.github/scripts/common/hygiene-preamble.sh
+++ b/.github/scripts/common/hygiene-preamble.sh
@@ -1,6 +1,7 @@
+#!/bin/bash
 . .github/scripts/common/preamble.sh
 
-if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "x" = "x$BASE_REF_SHA$PR_REF_SHA" ] ; then
+if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ -z "$BASE_REF_SHA$PR_REF_SHA" ] ; then
   echo "Variables BASE_REF_SHA and PR_REF_SHA must be defined in a pull request job"
   exit 2
 fi
@@ -12,12 +13,12 @@ if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
   # we need to get history from base ref to head ref for check configure
   depth=10
   set +e
-  git cat-file -e $BASE_REF_SHA
+  git cat-file -e "$BASE_REF_SHA"
   r=$?
   while [ $r -ne 0 ] ; do
-    git fetch origin $GITHUB_REF --depth=$depth
-    depth=$(( $depth + 10 ))
-    git cat-file -e $BASE_REF_SHA
+    git fetch origin "$GITHUB_REF" --depth=$depth
+    depth=$(( depth + 10 ))
+    git cat-file -e "$BASE_REF_SHA"
     r=$?
   done
   set -e
diff --git a/.github/scripts/common/preamble.sh b/.github/scripts/common/preamble.sh
index f7080f30e6d..d3567524d5b 100644
--- a/.github/scripts/common/preamble.sh
+++ b/.github/scripts/common/preamble.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 case $GITHUB_EVENT_NAME in
   pull_request)
     BRANCH=$GITHUB_HEAD_REF
diff --git a/.github/scripts/depexts/generate-actions.sh b/.github/scripts/depexts/generate-actions.sh
index c17fa2d735d..7a5299085c3 100644
--- a/.github/scripts/depexts/generate-actions.sh
+++ b/.github/scripts/depexts/generate-actions.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 set -eu
 
@@ -6,10 +6,10 @@ set -eu
 target=$1
 dir=.github/actions/$target
 
-mkdir -p $dir
+mkdir -p "$dir"
 
 ### Generate the action
-cat >$dir/action.yml << EOF
+cat >"$dir"/action.yml << EOF
 name: 'depexts-$target'
 description: 'Test external dependencies handling for $target'
 runs:
@@ -25,7 +25,7 @@ OCAML_CONSTRAINT=''
 
 case "$target" in
   alpine)
-    cat >$dir/Dockerfile << EOF
+    cat >"$dir"/Dockerfile << EOF
 FROM alpine
 RUN apk add $mainlibs $ocaml
 RUN apk add g++
@@ -33,7 +33,7 @@ EOF
     ;;
   archlinux)
 # no automake
-    cat >$dir/Dockerfile << EOF
+    cat >"$dir"/Dockerfile << EOF
 FROM archlinux
 RUN pacman -Syu --noconfirm $mainlibs $ocaml gcc diffutils
 EOF
@@ -41,14 +41,14 @@ EOF
  centos)
    # CentOS 7 doesn't support OCaml 5 (GCC is too old)
    OCAML_CONSTRAINT=' & < "5.0"'
-    cat >$dir/Dockerfile << EOF
+    cat >"$dir"/Dockerfile << EOF
 FROM centos:7
 RUN yum install -y $mainlibs $ocaml
 RUN yum install -y gcc-c++
 EOF
     ;;
   debian)
-  cat >$dir/Dockerfile << EOF
+  cat >"$dir"/Dockerfile << EOF
 FROM debian
 RUN apt update
 RUN apt install -y $mainlibs $ocaml
@@ -56,7 +56,7 @@ RUN apt install -y g++
 EOF
     ;;
   fedora)
-  cat >$dir/Dockerfile << EOF
+  cat >"$dir"/Dockerfile << EOF
 FROM fedora
 RUN dnf install -y $mainlibs $ocaml diffutils
 RUN dnf install -y gcc-c++
@@ -66,7 +66,7 @@ EOF
   mainlibs=${mainlibs/git/dev-vcs\/git}
   mainlibs=${mainlibs/tar/app-arch\/tar}
   mainlibs=${mainlibs/bzip2/app-arch\/bzip2}
-  cat >$dir/Dockerfile << EOF
+  cat >"$dir"/Dockerfile << EOF
 # name the portage image
 FROM gentoo/portage as portage
 # image is based on stage3
@@ -78,21 +78,21 @@ EOF
     ;;
   opensuse)
   # glpk-dev is installed manually because os-family doesn't handle tumbleweed
-    cat >$dir/Dockerfile << EOF
+    cat >"$dir"/Dockerfile << EOF
 FROM opensuse/leap:15.3
 RUN zypper --non-interactive install $mainlibs $ocaml diffutils gzip glpk-devel
 RUN zypper --non-interactive install gcc-c++
 EOF
     ;;
   oraclelinux)
-    cat >$dir/Dockerfile << EOF
+    cat >"$dir"/Dockerfile << EOF
 FROM oraclelinux:8
 RUN yum install -y $mainlibs
 RUN yum install -y gcc-c++
 EOF
   ;;
   ubuntu)
-  cat >$dir/Dockerfile << EOF
+  cat >"$dir"/Dockerfile << EOF
 FROM ubuntu:20.04
 RUN apt update
 RUN apt install -y $mainlibs $ocaml
@@ -104,9 +104,9 @@ esac
 OCAML_INVARIANT="\"ocaml\" {>= \"4.09.0\"$OCAML_CONSTRAINT}"
 
 # Copy 2.1 opam binary from cache
-cp binary/opam $dir/opam
+cp binary/opam "$dir"/opam
 
-cat >>$dir/Dockerfile << EOF
+cat >>"$dir"/Dockerfile << EOF
 RUN test -d /opam || mkdir /opam
 ENV OPAMROOTISOK 1
 ENV OPAMROOT /opam/root
@@ -120,7 +120,7 @@ EOF
 
 
 ### Generate the entrypoint
-cat >$dir/entrypoint.sh << EOF
+cat >"$dir"/entrypoint.sh << EOF
 #!/bin/sh
 set -eux
 
@@ -136,14 +136,14 @@ cd /github/workspace
 EOF
 
 # workaround for opensuse, mccs & glpk
-if [ $target = "opensuse" ]; then
-  cat >>$dir/entrypoint.sh << EOF
+if [ "$target" = "opensuse" ]; then
+  cat >>"$dir"/entrypoint.sh << EOF
 OPAMEDITOR="sed -i 's|^build.*$|& [\\"mv\\" \\"src/glpk/dune-shared\\" \\"src/glpk/dune\\"]|'" opam pin edit mccs -yn
 #opam show --raw mccs
 EOF
 fi
 
-cat >>$dir/entrypoint.sh << EOF
+cat >>"$dir"/entrypoint.sh << EOF
 opam install . --deps
 eval \$(opam env)
 ./configure
@@ -153,15 +153,15 @@ make
 EOF
 
 test_depext () {
-  for pkg in $@ ; do
-    echo "./opam install $pkg || true" >> $dir/entrypoint.sh
+  for pkg in "$@" ; do
+    echo "./opam install $pkg || true" >> "$dir"/entrypoint.sh
   done
 }
 
 test_depext conf-gmp conf-which conf-autoconf
 
 # disable automake for centos, as os-family returns rhel
-if [ $target != "centos" ] && [ $target != "opensuse" ]; then
+if [ "$target" != "centos" ] && [ "$target" != "opensuse" ]; then
   test_depext conf-automake
 fi
 
@@ -169,6 +169,6 @@ fi
 test_depext dpkg # gentoo
 test_depext lib-sundials-dev # os version check
 
-chmod +x $dir/entrypoint.sh
+chmod +x "$dir"/entrypoint.sh
 
 #done
diff --git a/.github/scripts/main/archives-cache.sh b/.github/scripts/main/archives-cache.sh
index d1b68b10f17..dfd6d760797 100644
--- a/.github/scripts/main/archives-cache.sh
+++ b/.github/scripts/main/archives-cache.sh
@@ -8,4 +8,4 @@ rm -rf src_ext/archives
 make -C src_ext cache-archives
 ls -al src_ext/archives
 rm -rf ~/opam-repository
-git clone $OPAM_REPO_MAIN ~/opam-repository --bare
+git clone "$OPAM_REPO_MAIN" ~/opam-repository --bare
diff --git a/.github/scripts/main/create-ocaml-cache.sh b/.github/scripts/main/create-ocaml-cache.sh
index e7a3456aa03..c1232eaafcf 100755
--- a/.github/scripts/main/create-ocaml-cache.sh
+++ b/.github/scripts/main/create-ocaml-cache.sh
@@ -11,8 +11,8 @@ PLATFORM="$5"
 if [[ $OCAML_BRANCH -gt 407 ]]; then
   if [[ -n $GITHUB_BASE_REF ]]; then
     git tag combak
-    git fetch origin $GITHUB_BASE_REF
-    git checkout origin/$GITHUB_BASE_REF
+    git fetch origin "$GITHUB_BASE_REF"
+    git checkout origin/"$GITHUB_BASE_REF"
   fi
   make -C src_ext dune-local.stamp
   cd src_ext/dune-local
diff --git a/.github/scripts/main/hygiene.sh b/.github/scripts/main/hygiene.sh
index 343bed632f1..042ba352770 100644
--- a/.github/scripts/main/hygiene.sh
+++ b/.github/scripts/main/hygiene.sh
@@ -58,7 +58,7 @@ case $GITHUB_EVENT_NAME in
     CheckConfigure "$GITHUB_SHA"
     ;;
   pull_request)
-    for commit in $(git rev-list $BASE_REF_SHA...$PR_REF_SHA --reverse)
+    for commit in $(git rev-list "$BASE_REF_SHA...$PR_REF_SHA" --reverse)
     do
       echo "check configure for $commit"
       CheckConfigure "$commit"
@@ -97,9 +97,9 @@ cd ..
 
 if [ "$GITHUB_EVENT_NAME" = "push" ] && [ "$BRANCH" = "master" ]; then
   (set +x ; echo -en "::group::check default cli\r") 2>/dev/null
-  CURRENT_MAJOR="`sed -n "s/^AC_INIT(\[opam],\[\([0-9]\+\)[^0-9]*.*])$/\1/p" configure.ac`"
-  DEFAULT_CLI_MAJOR="`sed -n "/let *default *=/s/.*(\([0-9]*\)[^0-9]*.*/\1/p" src/client/opamCLIVersion.ml`"
-  if [ $CURRENT_MAJOR -eq $DEFAULT_CLI_MAJOR ]; then
+  CURRENT_MAJOR="$(sed -n "s/^AC_INIT(\[opam],\[\([0-9]\+\)[^0-9]*.*])$/\1/p" configure.ac)"
+  DEFAULT_CLI_MAJOR="$(sed -n "/let *default *=/s/.*(\([0-9]*\)[^0-9]*.*/\1/p" src/client/opamCLIVersion.ml)"
+  if [ "$CURRENT_MAJOR" -eq "$DEFAULT_CLI_MAJOR" ]; then
     echo "Major viersion is default cli one: $CURRENT_MAJOR"
   else
     echo -e "[\e[31mERROR\e[0m] Major version $CURRENT_MAJOR and default cli version $DEFAULT_CLI_MAJOR mismatches"
@@ -125,4 +125,4 @@ please run dune exec --root=. -- ./ci.exe from .github/workflows and fixup the c
 fi
 (set +x ; echo -en "::endgroup::check workflow generation\r") 2>/dev/null
 
-exit $ERROR
+exit "$ERROR"
diff --git a/.github/scripts/main/legacy.sh b/.github/scripts/main/legacy.sh
index 22c3eeea7b3..df472127cfe 100644
--- a/.github/scripts/main/legacy.sh
+++ b/.github/scripts/main/legacy.sh
@@ -5,7 +5,7 @@ set -xue
 . .github/scripts/main/preamble.sh
 
 eval $(opam env)
-OPAMCONFIRMLEVEL= OPAMCLI=2.0 opam upgrade --unlock-base --yes
+OPAMCONFIRMLEVEL='' OPAMCLI=2.0 opam upgrade --unlock-base --yes
 
 for package in core format installer ; do
   opam pin add --yes --no-action opam-$package .
diff --git a/.github/scripts/main/main.sh b/.github/scripts/main/main.sh
index 84b8c62cf09..9317e1239d0 100644
--- a/.github/scripts/main/main.sh
+++ b/.github/scripts/main/main.sh
@@ -15,7 +15,7 @@ export OCAMLRUNPARAM=b
 if [[ $OPAM_TEST -eq 1 ]] ; then
   export OPAMROOT=$OPAMBSROOT
   # If the cached root is newer, regenerate a binary compatible root
-  opam env || { rm -rf $OPAMBSROOT; init-bootstrap; }
+  opam env || { rm -rf "$OPAMBSROOT"; init-bootstrap; }
   eval $(opam env)
 fi
 
@@ -37,7 +37,7 @@ if [ "$OPAM_TEST" != "1" ]; then
   echo 'DUNE_PROFILE=dev' >> Makefile.config
 fi
 
-if [ $OPAM_UPGRADE -eq 1 ]; then
+if [ "$OPAM_UPGRADE" -eq 1 ]; then
   unset-dev-version
 fi
 # Disable implicit transitive deps
@@ -83,17 +83,17 @@ if [ "$OPAM_TEST" = "1" ]; then
   # Compile and run opam-rt
   (set +x ; echo -en "::group::opam-rt\r") 2>/dev/null
   opamrt_url="https://github.com/ocaml-opam/opam-rt"
-  if [ ! -d $CACHE/opam-rt ]; then
-    git clone $opamrt_url  $CACHE/opam-rt
+  if [ ! -d "$CACHE"/opam-rt ]; then
+    git clone $opamrt_url  "$CACHE"/opam-rt
   fi
-  cd $CACHE/opam-rt
+  cd "$CACHE"/opam-rt
   git fetch origin
-  if git ls-remote --exit-code origin $BRANCH ; then
-    if git branch | grep -q $BRANCH; then
-      git checkout $BRANCH
-      git reset --hard origin/$BRANCH
+  if git ls-remote --exit-code origin "$BRANCH" ; then
+    if git branch | grep -q "$BRANCH"; then
+      git checkout "$BRANCH"
+      git reset --hard origin/"$BRANCH"
     else
-      git checkout -b $BRANCH origin/$BRANCH
+      git checkout -b "$BRANCH" origin/"$BRANCH"
     fi
   else
     git checkout master
@@ -102,7 +102,7 @@ if [ "$OPAM_TEST" = "1" ]; then
 
   test -d _opam || opam switch create . --no-install --formula '"ocaml-system"'
   eval $(opam env)
-  opam pin $GITHUB_WORKSPACE -yn --with-version to-test
+  opam pin "$GITHUB_WORKSPACE" -yn --with-version to-test
   # opam lib pins defined in opam-rt are ignored as there is a local pin
   opam pin . -yn --ignore-pin-depends
   opam install opam-rt --deps-only opam-devel.to-test
diff --git a/.github/scripts/main/ocaml-cache.sh b/.github/scripts/main/ocaml-cache.sh
index c2e9f5e76ea..e202b6f93ae 100644
--- a/.github/scripts/main/ocaml-cache.sh
+++ b/.github/scripts/main/ocaml-cache.sh
@@ -10,7 +10,7 @@ HOST="${3:-}"
 
 if [ "$PLATFORM" = Windows ]; then
   EXE='.exe'
-  if [ -e $OCAML_LOCAL.tar ]; then
+  if [ -e "$OCAML_LOCAL".tar ]; then
     mkdir -p "$OCAML_LOCAL"
     tar -C "$OCAML_LOCAL" -pxf "$OCAML_LOCAL.tar"
     exit 0
@@ -115,7 +115,7 @@ if [[ $OPAM_TEST -ne 1 ]] ; then
   fi
 fi
 
-if ! ./configure --prefix "$PREFIX"$HOST --with-vendored-deps ${CONFIGURE_SWITCHES:-} ; then
+if ! ./configure --prefix "$PREFIX$HOST" --with-vendored-deps "${CONFIGURE_SWITCHES:-}" ; then
   echo
   echo -e "[\e[31mERROR\e[0m] OCaml's configure script failed"
   (set +x ; echo -en "::group::config.log contents\r") 2>/dev/null
@@ -137,7 +137,7 @@ cd ..
 rm -rf "ocaml-$OCAML_VERSION"
 
 if [[ $PLATFORM != 'Windows' ]]; then
-  echo > "$OCAML_LOCAL/bin/ocamldoc" <<"EOF"
+  cat > "$OCAML_LOCAL/bin/ocamldoc" <<"EOF"
 #!/bin/sh
 
 echo 'ocamldoc is not supposed to be called'>&2
diff --git a/.github/scripts/main/opam-bs-cache.sh b/.github/scripts/main/opam-bs-cache.sh
index 8db122194c5..85e9f2593ae 100644
--- a/.github/scripts/main/opam-bs-cache.sh
+++ b/.github/scripts/main/opam-bs-cache.sh
@@ -4,23 +4,23 @@ set -xue
 
 . .github/scripts/main/preamble.sh
 
-rm -f $OPAM_LOCAL/bin/opam-bootstrap
-mkdir -p $OPAM_LOCAL/bin/
+rm -f "$OPAM_LOCAL"/bin/opam-bootstrap
+mkdir -p "$OPAM_LOCAL"/bin/
 
 os=$( (uname -s || echo unknown) | awk '{print tolower($0)}')
 if [ "$os" = "darwin" ] ; then
   os=macos
 fi
 
-curl -sL -o $OPAM_LOCAL/bin/opam-bootstrap \
+curl -sL -o "$OPAM_LOCAL"/bin/opam-bootstrap \
   "https://github.com/ocaml/opam/releases/download/$OPAMBSVERSION/opam-$OPAMBSVERSION-$(uname -m)-$os"
-cp -f $OPAM_LOCAL/bin/opam-bootstrap $OPAM_LOCAL/bin/opam
-chmod a+x $OPAM_LOCAL/bin/opam
+cp -f "$OPAM_LOCAL"/bin/opam-bootstrap "$OPAM_LOCAL"/bin/opam
+chmod a+x "$OPAM_LOCAL"/bin/opam
 
 opam --version
 
 if [[ -d $OPAMBSROOT ]] ; then
-  init-bootstrap || { rm -rf $OPAMBSROOT; init-bootstrap; }
+  init-bootstrap || { rm -rf "$OPAMBSROOT"; init-bootstrap; }
 else
   init-bootstrap
 fi
diff --git a/.github/scripts/main/opam-rt.sh b/.github/scripts/main/opam-rt.sh
index 9e8a13b2361..03d63cad5ed 100644
--- a/.github/scripts/main/opam-rt.sh
+++ b/.github/scripts/main/opam-rt.sh
@@ -12,5 +12,5 @@ export OPAMKEEPLOGS=1
 # TODO: Make opam-rt compatible with non-master initial branches
 git config --global init.defaultBranch master
 
-cd $CACHE/opam-rt
+cd "$CACHE"/opam-rt
 make KINDS="local git" run
diff --git a/.github/scripts/main/preamble.sh b/.github/scripts/main/preamble.sh
index 53fb04d05ff..1d04b224aa0 100644
--- a/.github/scripts/main/preamble.sh
+++ b/.github/scripts/main/preamble.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 . .github/scripts/common/preamble.sh
 
 CWD=$PWD
@@ -18,8 +19,8 @@ OPAM_UPGRADE=${OPAM_UPGRADE:-0}
 
 OPAM_REPO_MAIN=https://github.com/ocaml/opam-repository.git
 
-OPAM12CACHE=`eval echo $OPAM12CACHE`
-OPAMBSROOT=`eval echo $OPAMBSROOT`
+OPAM12CACHE=$(eval echo "$OPAM12CACHE")
+OPAMBSROOT=$(eval echo "$OPAMBSROOT")
 
 OPAMBSSWITCH=opam-build
 
@@ -43,12 +44,12 @@ init-bootstrap () {
     export OPAMROOT=$OPAMBSROOT
     # The system compiler will be picked up
     if [ "${OPAM_REPO%.git}" != "${OPAM_REPO_MAIN%.git}" ]; then
-      opam init --no-setup git+$OPAM_REPO_MAIN#$OPAM_REPO_SHA
+      opam init --no-setup git+"$OPAM_REPO_MAIN#$OPAM_REPO_SHA"
     else
-      opam init --no-setup git+$OPAM_REPO_CACHE#$OPAM_REPO_SHA
+      opam init --no-setup git+"$OPAM_REPO_CACHE#$OPAM_REPO_SHA"
     fi
 
-    cat >> $OPAMROOT/config <<EOF
+    cat >> "$OPAMROOT"/config <<EOF
 archive-mirrors: "https://opam.ocaml.org/cache"
 EOF
 
@@ -58,7 +59,7 @@ EOF
     if [[ $CURRENT_SWITCH != "default" ]] ; then
       opam switch default
       eval $(opam env)
-      opam switch remove $CURRENT_SWITCH
+      opam switch remove "$CURRENT_SWITCH"
     fi
 
     opam switch create $OPAMBSSWITCH ocaml-system
diff --git a/.github/scripts/main/solvers.sh b/.github/scripts/main/solvers.sh
index 73a5eb7bc03..a2adae7f339 100644
--- a/.github/scripts/main/solvers.sh
+++ b/.github/scripts/main/solvers.sh
@@ -9,11 +9,11 @@ export OCAMLRUNPARAM=b
 # All environment variable are overwritten in job description
 # One cache per solver, $CACHE/opam.<solver>.cached
 export OPAMROOT=$OPAMBSROOT
-echo $OPAMROOT
+echo "$OPAMROOT"
 
 case "$SOLVER" in
   z3)
-    PKGS=$SOLVER
+    PKGS=("$SOLVER")
     if [[ $RUNNER_OS = 'macOS' ]]; then
       # brew may require extra flags to override the system-installed python,
       # so we assume the presence of python3 on the macOS runners.
@@ -21,7 +21,7 @@ case "$SOLVER" in
     fi
     ;;
   0install)
-    PKGS="$SOLVER opam-0install-cudf"
+    PKGS=("$SOLVER" opam-0install-cudf)
     ;;
   *)
     echo -e "\e[31mSolver $SOLVER not handled\e[0m";
@@ -30,9 +30,9 @@ case "$SOLVER" in
 esac
 
 opam update --depexts
-opam switch create $SOLVER ocaml-system || true
+opam switch create "$SOLVER" ocaml-system || true
 opam upgrade --all
-opam install $PKGS
+opam install "${PKGS[@]}"
 opam install . --deps
 opam clean --logs --switch-cleanup
 eval $(opam env)
diff --git a/.github/scripts/main/test.sh b/.github/scripts/main/test.sh
index 35ec1387296..417bb73b760 100644
--- a/.github/scripts/main/test.sh
+++ b/.github/scripts/main/test.sh
@@ -17,7 +17,7 @@ fi
 # The SHA is fixed so that upstream changes shouldn't affect CI. The SHA needs
 # to be moved forwards when a new version of OCaml is added to ensure that the
 # ocaml-system package is available at the correct version.
-opam init --bare default git+$OPAM_REPO_CACHE#$OPAM_TEST_REPO_SHA
+opam init --bare default git+"$OPAM_REPO_CACHE#$OPAM_TEST_REPO_SHA"
 cat >> $(opam var root --global 2>/dev/null)/config <<EOF
 archive-mirrors: "https://opam.ocaml.org/cache"
 EOF
diff --git a/.github/scripts/main/upgrade.sh b/.github/scripts/main/upgrade.sh
index 8ee7a4266cf..11ca8f580d1 100644
--- a/.github/scripts/main/upgrade.sh
+++ b/.github/scripts/main/upgrade.sh
@@ -10,22 +10,22 @@ export PATH=~/local/bin:$PATH
 
 OPAM12=$OPAM12CACHE/bin/opam
 if [[ ! -f $OPAM12 ]]; then
-  mkdir -p $OPAM12CACHE/bin
+  mkdir -p "$OPAM12CACHE"/bin
 
   os="Linux"
   if [ "$RUNNER_OS" = "macOS" ]; then
     os="Darwin"
   fi
-  curl -sL "https://github.com/ocaml/opam/releases/download/1.2.2/opam-1.2.2-x86_64-$os" -o $OPAM12
-  chmod +x $OPAM12
+  curl -sL "https://github.com/ocaml/opam/releases/download/1.2.2/opam-1.2.2-x86_64-$os" -o "$OPAM12"
+  chmod +x "$OPAM12"
 fi
 export OPAMROOT=/tmp/opamroot
 rm -rf $OPAMROOT
 if [[ ! -d $OPAM12CACHE/root ]]; then
   $OPAM12 init
-  cp -r /tmp/opamroot/ $OPAM12CACHE/root
+  cp -r /tmp/opamroot/ "$OPAM12CACHE"/root
 else
-  cp -r $OPAM12CACHE/root /tmp/opamroot
+  cp -r "$OPAM12CACHE"/root /tmp/opamroot
 fi
 set +e
 $OPAM12 --version
diff --git a/.github/scripts/scripts/hygiene.sh b/.github/scripts/scripts/hygiene.sh
index 2d41b6c3fca..356f4eecdd1 100644
--- a/.github/scripts/scripts/hygiene.sh
+++ b/.github/scripts/scripts/hygiene.sh
@@ -15,7 +15,7 @@ if [[ $GITHUB_EVENT_NAME = 'pull_request' ]]; then
     echo "OPAM_BIN_URL_BASE = $OPAM_BIN_URL_BASE"
     echo "VERSION = $VERSION; DEV_VERSION = $DEV_VERSION"
     DEV_VERSION=${DEV_VERSION//\~/-}
-    if [[ $DEV_VERSION != $VERSION ]]; then
+    if [[ $DEV_VERSION != "$VERSION" ]]; then
       ARCHES=2
     else
       ARCHES=1
@@ -23,9 +23,9 @@ if [[ $GITHUB_EVENT_NAME = 'pull_request' ]]; then
     current_tag=''
 
     while read -r line tag platform sha ; do
-      if [[ $tag != $current_tag ]]; then
+      if [[ $tag != "$current_tag" ]]; then
         current_tag="$tag"
-        if [[ $tag = $VERSION || $tag = $DEV_VERSION ]]; then
+        if [[ $tag = "$VERSION" || $tag = "$DEV_VERSION" ]]; then
           ((ARCHES--))
         fi
         echo "🐪 Checking binaries for opam ${tag//-/\~}"
@@ -33,7 +33,7 @@ if [[ $GITHUB_EVENT_NAME = 'pull_request' ]]; then
       URL="$OPAM_BIN_URL_BASE$tag/opam-$tag-$platform"
       echo "Downloading $URL"
       check=$(curl -Ls "$URL" | sha512sum | cut -d' ' -f1)
-      if [[ $check = $sha ]] ; then
+      if [[ $check = "$sha" ]] ; then
         echo "         as expected ($sha)"
       else
         echo "::error file=shell/install.sh,line=$line::Incorrect checksum; got $check"
@@ -51,4 +51,4 @@ if [[ $GITHUB_EVENT_NAME = 'pull_request' ]]; then
 fi
 
 
-exit $ERROR
+exit "$ERROR"
diff --git a/admin-scripts/extract_mini_repository.sh b/admin-scripts/extract_mini_repository.sh
index 6836c0f4155..9c8298c230a 100755
--- a/admin-scripts/extract_mini_repository.sh
+++ b/admin-scripts/extract_mini_repository.sh
@@ -75,7 +75,7 @@ rm -rf "${WORK_DIR}/${REPO_DIR_NAME}/.git"
 
 unrequired_compiler() {
   for version in ${COMPILERS}; do
-      if [ ${version} = "$1" ]; then return 1; fi
+      if [ "${version}" = "$1" ]; then return 1; fi
   done
   return 0
 }
@@ -101,7 +101,7 @@ done
 ## Fetch the packages and compilers archives
 
 for version in ${COMPILERS}; do
-    opam admin make --resolve --compiler ${version} ocaml.${version} ${PACKAGES}
+    opam admin make --resolve --compiler "${version}" ocaml."${version}" "${PACKAGES}"
 done
 
 ## Remove the unrequired package "versions
diff --git a/release/release.sh b/release/release.sh
index 70da16a0119..4b44ae2d60e 100755
--- a/release/release.sh
+++ b/release/release.sh
@@ -21,7 +21,7 @@ if test "$(uname -s)" != Darwin -o "$(uname -m)" != arm64; then
   exit 1
 fi
 
-DIR=$(dirname $0)
+DIR=$(dirname "$0")
 cd "$DIR"
 
 LC_ALL=C
@@ -56,8 +56,8 @@ make JOBS="${JOBS}" TAG="$TAG" armhf-linux
 make JOBS="${JOBS}" TAG="$TAG" arm64-linux
 make JOBS="${JOBS}" TAG="$TAG" ppc64le-linux
 make JOBS="${JOBS}" TAG="$TAG" s390x-linux
-[ -f "${OUTDIR}/opam-$TAG-x86_64-macos" ] || make TAG="$TAG" JOBS="${JOBS}" macos-local MACOS_ARCH=x86_64 REMOTE_DIR=opam-release-$TAG GIT_URL="$CWD/.."
-[ -f "${OUTDIR}/opam-$TAG-arm64-macos" ] || make TAG="$TAG" JOBS="${JOBS}" macos-local MACOS_ARCH=arm64 REMOTE_DIR=opam-release-$TAG GIT_URL="$CWD/.."
+[ -f "${OUTDIR}/opam-$TAG-x86_64-macos" ] || make TAG="$TAG" JOBS="${JOBS}" macos-local MACOS_ARCH=x86_64 REMOTE_DIR=opam-release-"$TAG" GIT_URL="$CWD/.."
+[ -f "${OUTDIR}/opam-$TAG-arm64-macos" ] || make TAG="$TAG" JOBS="${JOBS}" macos-local MACOS_ARCH=arm64 REMOTE_DIR=opam-release-"$TAG" GIT_URL="$CWD/.."
 [ -d ./qemu-base-images ] || git clone https://gitlab.com/kit-ty-kate/qemu-base-images.git
 [ -f "${OUTDIR}/opam-$TAG-x86_64-openbsd" ] || qemu_build 9999 OpenBSD-7.4-amd64 "pkg_add gmake curl bzip2" gmake x86_64 &
 [ -f "${OUTDIR}/opam-$TAG-x86_64-freebsd" ] || qemu_build 9998 FreeBSD-13.2-RELEASE-amd64 "pkg install -y gmake curl bzip2" gmake x86_64 &
diff --git a/release/sign.sh b/release/sign.sh
index b534e0278f2..4168b7e8eb9 100755
--- a/release/sign.sh
+++ b/release/sign.sh
@@ -21,12 +21,12 @@ sign() {
     fi
 }
 
-DIR=$(dirname $0)
+DIR=$(dirname "$0")
 cd "$DIR"
 
 OUTDIR="out/$TAG"
 cd "${OUTDIR}"
 
-for f in opam-$TAG-* opam-full-$TAG.tar.gz; do
+for f in opam-"$TAG"-* opam-full-"$TAG".tar.gz; do
     sign "$f"
 done
diff --git a/shell/bootstrap-ocaml.sh b/shell/bootstrap-ocaml.sh
index 8b77e21e588..b01acac9910 100755
--- a/shell/bootstrap-ocaml.sh
+++ b/shell/bootstrap-ocaml.sh
@@ -14,16 +14,16 @@ BOOTSTRAP_ROOT=${BOOTSTRAP_ROOT:-..}
 BOOTSTRAP_TARGETS=${BOOTSTRAP_TARGETS:-world.opt}
 mkdir -p "$BOOTSTRAP_DIR"
 cd "$BOOTSTRAP_DIR"
-URL=`sed -ne 's/URL_ocaml *= *//p' $BOOTSTRAP_ROOT/src_ext/Makefile | tr -d '\r'`
-MD5=`sed -ne 's/MD5_ocaml *= *//p' $BOOTSTRAP_ROOT/src_ext/Makefile | tr -d '\r'`
-V=`echo ${URL}| sed -e 's|.*/\([^/]*\)\.tar\.gz|\1|'`
-FV_URL=`sed -ne 's/URL_flexdll *= *//p' $BOOTSTRAP_ROOT/src_ext/Makefile | tr -d '\r'`
-FLEXDLL=`echo ${FV_URL}| sed -e 's|.*/\([^/]*\)|\1|'`
-if [ ! -e ${V}.tar.gz ]; then
-  cp $BOOTSTRAP_ROOT/src_ext/archives/${V}.tar.gz . 2>/dev/null || ${CURL} ${URL}
+URL=$(sed -ne 's/URL_ocaml *= *//p' "$BOOTSTRAP_ROOT"/src_ext/Makefile | tr -d '\r')
+MD5=$(sed -ne 's/MD5_ocaml *= *//p' "$BOOTSTRAP_ROOT"/src_ext/Makefile | tr -d '\r')
+V=$(echo "${URL}"| sed -e 's|.*/\([^/]*\)\.tar\.gz|\1|')
+FV_URL=$(sed -ne 's/URL_flexdll *= *//p' "$BOOTSTRAP_ROOT"/src_ext/Makefile | tr -d '\r')
+FLEXDLL=$(echo "${FV_URL}"| sed -e 's|.*/\([^/]*\)|\1|')
+if [ ! -e "${V}".tar.gz ]; then
+  cp "$BOOTSTRAP_ROOT/src_ext/archives/${V}".tar.gz . 2>/dev/null || ${CURL} "${URL}"
 fi
 
-ACTUALMD5=`openssl md5 ${V}.tar.gz  2> /dev/null | cut -f 2 -d ' '`
+ACTUALMD5=$(openssl md5 "${V}".tar.gz  2> /dev/null | cut -f 2 -d ' ')
 if [ -z "$ACTUALMD5" ]; then
   echo "Blank checksum returned; is openssl installed?"
   exit 2
@@ -36,16 +36,16 @@ else
   fi
 fi
 
-if [ ${GEN_CONFIG_ONLY} -eq 0 ] ; then
-  tar -zxf ${V}.tar.gz
+if [ "${GEN_CONFIG_ONLY}" -eq 0 ] ; then
+  tar -zxf "${V}".tar.gz
 else
-  mkdir -p ${V}
+  mkdir -p "${V}"
 fi
-cd ${V}
+cd "${V}"
 PATH_PREPEND=
 LIB_PREPEND=
 INC_PREPEND=
-if [ -n "$1" -a -n "${COMSPEC}" -a -x "${COMSPEC}" ] ; then
+if [ -n "$1" ] && [ -n "${COMSPEC}" ] && [ -x "${COMSPEC}" ] ; then
   case "$(uname -m)" in
     'i686')
       BUILD=i686-pc-cygwin
@@ -64,7 +64,7 @@ if [ -n "$1" -a -n "${COMSPEC}" -a -x "${COMSPEC}" ] ; then
     "msvc")
       HOST=i686-pc-windows
       if ! command -v ml > /dev/null ; then
-        eval `$BOOTSTRAP_ROOT/../shell/msvs-detect --arch=x86`
+        eval $("$BOOTSTRAP_ROOT"/../shell/msvs-detect --arch=x86)
         if [ -n "${MSVS_NAME}" ] ; then
           PATH_PREPEND="${MSVS_PATH}"
           LIB_PREPEND="${MSVS_LIB};"
@@ -75,7 +75,7 @@ if [ -n "$1" -a -n "${COMSPEC}" -a -x "${COMSPEC}" ] ; then
     "msvc64")
       HOST=x86_64-pc-windows
       if ! command -v ml64 > /dev/null ; then
-        eval `$BOOTSTRAP_ROOT/../shell/msvs-detect --arch=x64`
+        eval $("$BOOTSTRAP_ROOT"/../shell/msvs-detect --arch=x64)
         if [ -n "${MSVS_NAME}" ] ; then
           PATH_PREPEND="${MSVS_PATH}"
           LIB_PREPEND="${MSVS_LIB};"
@@ -87,7 +87,7 @@ if [ -n "$1" -a -n "${COMSPEC}" -a -x "${COMSPEC}" ] ; then
       if [ "$1" != "auto" ] ; then
         echo "Compiler architecture $1 not recognised -- mingw64, mingw, msvc64, msvc (or auto)"
       fi
-      if [ -n "${PROCESSOR_ARCHITEW6432}" -o "${PROCESSOR_ARCHITECTURE}" = "AMD64" ] ; then
+      if [ -n "${PROCESSOR_ARCHITEW6432}" ] || [ "${PROCESSOR_ARCHITECTURE}" = "AMD64" ] ; then
         TRY64=1
       else
         TRY64=0
@@ -99,10 +99,10 @@ if [ -n "$1" -a -n "${COMSPEC}" -a -x "${COMSPEC}" ] ; then
         HOST=i686-w64-mingw32
       elif [ ${TRY64} -eq 1 ] && command -v ml64 > /dev/null ; then
         HOST=x86_64-pc-windows
-        PATH_PREPEND=`bash $BOOTSTRAP_ROOT/../shell/check_linker`
+        PATH_PREPEND=$(bash "$BOOTSTRAP_ROOT"/../shell/check_linker)
       elif command -v ml > /dev/null ; then
         HOST=i686-pc-windows
-        PATH_PREPEND=`bash $BOOTSTRAP_ROOT/../shell/check_linker`
+        PATH_PREPEND=$(bash "$BOOTSTRAP_ROOT"/../shell/check_linker)
       else
         if [ ${TRY64} -eq 1 ] ; then
           HOST=x86_64-pc-windows
@@ -111,7 +111,7 @@ if [ -n "$1" -a -n "${COMSPEC}" -a -x "${COMSPEC}" ] ; then
           HOST=i686-pc-windows
           HOST_ARCH=x86
         fi
-        eval `$BOOTSTRAP_ROOT/../shell/msvs-detect --arch=${HOST_ARCH}`
+        eval $("$BOOTSTRAP_ROOT"/../shell/msvs-detect --arch=${HOST_ARCH})
         if [ -z "${MSVS_NAME}" ] ; then
           echo "No appropriate C compiler was found -- unable to build OCaml"
           exit 1
@@ -127,56 +127,56 @@ if [ -n "$1" -a -n "${COMSPEC}" -a -x "${COMSPEC}" ] ; then
     PATH_PREPEND="${PATH_PREPEND}:"
   fi
   cd ..
-  if [ ! -e ${FLEXDLL} ]; then
-    cp $BOOTSTRAP_ROOT/src_ext/archives/${FLEXDLL} . 2>/dev/null || ${CURL} ${FV_URL}
+  if [ ! -e "${FLEXDLL}" ]; then
+    cp "$BOOTSTRAP_ROOT/src_ext/archives/${FLEXDLL}" . 2>/dev/null || ${CURL} "${FV_URL}"
   fi
-  cd ${V}
-  PREFIX=`cd .. ; pwd`/ocaml
-  WINPREFIX=`echo ${PREFIX} | cygpath -f - -m`
-  if [ ${GEN_CONFIG_ONLY} -eq 0 ] ; then
-    tar -xzf $BOOTSTRAP_ROOT/${FLEXDLL}
+  cd "${V}"
+  PREFIX=$(cd .. ; pwd)/ocaml
+  WINPREFIX=$(echo "${PREFIX}" | cygpath -f - -m)
+  if [ "${GEN_CONFIG_ONLY}" -eq 0 ] ; then
+    tar -xzf "$BOOTSTRAP_ROOT/${FLEXDLL}"
     rm -rf flexdll
     mv flexdll-* flexdll
     PATH="${PATH_PREPEND}${PREFIX}/bin:${PATH}" \
     Lib="${LIB_PREPEND}${Lib}" \
     Include="${INC_PREPEND}${Include}" \
       ./configure --prefix "$WINPREFIX" \
-                  --build=$BUILD --host=$HOST \
+                  --build="$BUILD" --host=$HOST \
                   --disable-stdlib-manpages \
                   $BOOTSTRAP_EXTRA_OPTS
     for target in $BOOTSTRAP_TARGETS; do
-      PATH="${PATH_PREPEND}${PREFIX}/bin:${PATH}" Lib="${LIB_PREPEND}${Lib}" Include="${INC_PREPEND}${Include}" make -j $target
+      PATH="${PATH_PREPEND}${PREFIX}/bin:${PATH}" Lib="${LIB_PREPEND}${Lib}" Include="${INC_PREPEND}${Include}" make -j "$target"
     done
     PATH="${PATH_PREPEND}${PREFIX}/bin:${PATH}" Lib="${LIB_PREPEND}${Lib}" Include="${INC_PREPEND}${Include}" make install
   fi
   OCAMLLIB=${WINPREFIX}/lib/ocaml
 else
-  PREFIX=`cd .. ; pwd`/ocaml
-  if [ ${GEN_CONFIG_ONLY} -eq 0 ] ; then
+  PREFIX=$(cd .. ; pwd)/ocaml
+  if [ "${GEN_CONFIG_ONLY}" -eq 0 ] ; then
     ./configure --prefix "${PREFIX}" $BOOTSTRAP_EXTRA_OPTS --disable-stdlib-manpages
     for target in $BOOTSTRAP_TARGETS; do
-      ${MAKE:-make} -j $target
+      ${MAKE:-make} -j "$target"
     done
     ${MAKE:-make} install
   fi
   OCAMLLIB=${PREFIX}/lib/ocaml
 fi
 
-if [ ${GEN_CONFIG_ONLY} -eq 0 ] ; then
-  echo "${URL} ${FV_URL}" > $BOOTSTRAP_ROOT/installed-tarball
+if [ "${GEN_CONFIG_ONLY}" -eq 0 ] ; then
+  echo "${URL} ${FV_URL}" > "$BOOTSTRAP_ROOT"/installed-tarball
 fi
 
 # Generate src_ext/Makefile.config
-PATH_PREPEND=`echo "${PATH_PREPEND}" | sed -e 's/#/\\\\#/g' -e 's/\\$/$$/g'`
-echo "export PATH:=${PATH_PREPEND}${PREFIX}/bin:\$(PATH)" > $BOOTSTRAP_ROOT/../src_ext/Makefile.config
+PATH_PREPEND=$(echo "${PATH_PREPEND}" | sed -e 's/#/\\\\#/g' -e 's/\\$/$$/g')
+echo "export PATH:=${PATH_PREPEND}${PREFIX}/bin:\$(PATH)" > "$BOOTSTRAP_ROOT"/../src_ext/Makefile.config
 if [ -n "${LIB_PREPEND}" ] ; then
-  LIB_PREPEND=`echo ${LIB_PREPEND} | sed -e 's/#/\\\\#/g' -e 's/\\$/$$/g'`
-  echo "export Lib:=${LIB_PREPEND}\$(Lib)" >> $BOOTSTRAP_ROOT/../src_ext/Makefile.config
+  LIB_PREPEND=$(echo "${LIB_PREPEND}" | sed -e 's/#/\\\\#/g' -e 's/\\$/$$/g')
+  echo "export Lib:=${LIB_PREPEND}\$(Lib)" >> "$BOOTSTRAP_ROOT"/../src_ext/Makefile.config
 fi
 if [ -n "${INC_PREPEND}" ] ; then
-  INC_PREPEND=`echo ${INC_PREPEND} | sed -e 's/#/\\\\#/g' -e 's/\\$/$$/g'`
-  echo "export Include:=${INC_PREPEND}\$(Include)" >> $BOOTSTRAP_ROOT/../src_ext/Makefile.config
+  INC_PREPEND=$(echo "${INC_PREPEND}" | sed -e 's/#/\\\\#/g' -e 's/\\$/$$/g')
+  echo "export Include:=${INC_PREPEND}\$(Include)" >> "$BOOTSTRAP_ROOT"/../src_ext/Makefile.config
 fi
-echo "export OCAMLLIB=${OCAMLLIB}" >> $BOOTSTRAP_ROOT/../src_ext/Makefile.config
-echo 'unexport CAML_LD_LIBRARY_PATH' >> $BOOTSTRAP_ROOT/../src_ext/Makefile.config
-echo 'unexport OPAM_SWITCH_PREFIX' >> $BOOTSTRAP_ROOT/../src_ext/Makefile.config
+echo "export OCAMLLIB=${OCAMLLIB}" >> "$BOOTSTRAP_ROOT"/../src_ext/Makefile.config
+echo 'unexport CAML_LD_LIBRARY_PATH' >> "$BOOTSTRAP_ROOT"/../src_ext/Makefile.config
+echo 'unexport OPAM_SWITCH_PREFIX' >> "$BOOTSTRAP_ROOT"/../src_ext/Makefile.config
diff --git a/shell/bundle.sh b/shell/bundle.sh
index de006bbf5ea..976a72e96a3 100755
--- a/shell/bundle.sh
+++ b/shell/bundle.sh
@@ -42,7 +42,7 @@ while [ $# -gt 0 ]; do
             MAKESELF=1;;
         -o)
             if [ $# -lt 2 ]; then echo "Missing argument to $1" >&2; exit 2; fi
-            TARGET="$(cd $(dirname "$1"); pwd)/$(basename "$1")";;
+            TARGET="$(cd "$(dirname "$1")"; pwd)/$(basename "$1")";;
         -*)
             echo "Unrecognised option $1" >&2
             help; exit 2;;
@@ -69,7 +69,7 @@ fi
 comma() ( IFS=, ; echo "$*"; )
 
 TMP=$(mktemp -d /tmp/opam-bundle.XXXX)
-CONTENT="$TMP/$(basename ${TARGET%%.*})"
+CONTENT="$TMP/$(basename "${TARGET%%.*}")"
 REPO="$CONTENT/repo"
 
 mkdir -p "$CONTENT"
@@ -221,10 +221,10 @@ opam install --yes --destdir "\$DESTDIR" ${INSTALL_PACKAGES[@]}
 EOF
 
 chmod a+x bootstrap.sh configure.sh compile.sh
-cd $(dirname "$CONTENT")
+cd "$(dirname "$CONTENT")"
 if [ -n "$MAKESELF" ]; then
-    makeself $(basename "$CONTENT") "$TARGET" "$(basename "${TARGET%%.*}")" ./compile.sh
+    makeself "$(basename "$CONTENT")" "$TARGET" "$(basename "${TARGET%%.*}")" ./compile.sh
 else
-    tar cz $(basename "$CONTENT") -f "$TARGET"
+    tar cz "$(basename "$CONTENT")" -f "$TARGET"
 fi
 echo "Bundle has been generated as $TARGET"
diff --git a/shell/check_linker b/shell/check_linker
index 199524a4e1c..2e4fffdab40 100755
--- a/shell/check_linker
+++ b/shell/check_linker
@@ -6,7 +6,7 @@ FAULT=0
 PREPEND=
 while IFS= read -r line; do
   OUTPUT=$("$line" --version 2>/dev/null | head -1 | grep -F "Microsoft (R) Incremental Linker")
-  if [ "x$OUTPUT" = "x" -a $FIRST -eq 1 ] ; then
+  if [ -z "$OUTPUT" ] && [ $FIRST -eq 1 ] ; then
     FAULT=1
   elif [ $FAULT -eq 1 ] ; then
     PREPEND=$(dirname "$line"):
@@ -14,4 +14,4 @@ while IFS= read -r line; do
   fi
 done < <(which --all link)
 
-echo $PATH_PREPEND$PREPEND
+echo "$PATH_PREPEND$PREPEND"
diff --git a/shell/install.sh b/shell/install.sh
index f1266229245..ebfd3fc613e 100755
--- a/shell/install.sh
+++ b/shell/install.sh
@@ -312,11 +312,11 @@ check_sha512() {
     OPAM_BIN_LOC="$1"
     if command -v openssl > /dev/null; then
         sha512_devnull="cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e"
-        sha512_check=`openssl sha512 2>&1 < /dev/null | cut -f 2 -d ' '`
-        if [ "x$sha512_devnull" = "x$sha512_check" ]; then
-            sha512=`openssl sha512 "$OPAM_BIN_LOC" 2> /dev/null | cut -f 2 -d ' '`
-            check=`bin_sha512`
-            test "x$sha512" = "x$check"
+        sha512_check=$(openssl sha512 2>&1 < /dev/null | cut -f 2 -d ' ')
+        if [ "$sha512_devnull" = "$sha512_check" ]; then
+            sha512=$(openssl sha512 "$OPAM_BIN_LOC" 2> /dev/null | cut -f 2 -d ' ')
+            check=$(bin_sha512)
+            test "$sha512" = "$check"
         else
             echo "openssl 512 option not handled, binary integrity check can't be performed."
             return 0
@@ -384,7 +384,7 @@ if [ -z "$NOBACKUP" ] && [ ! "$FRESH" = 1 ] && [ -z "$RESTORE" ]; then
 fi
 
 xsudo() {
-    local CMD=$1; shift
+    local CMD="$1"; shift
     local DST
     for DST in "$@"; do : ; done
 
@@ -400,7 +400,7 @@ xsudo() {
             exit 1
         fi
         echo "Write access to '$DSTDIR' required, using '$SUDO'."
-        echo "Command: $CMD $@"
+        echo "Command: $CMD $*"
         if [ "$CMD" = "install" ]; then
             "$SUDO" "$CMD" -g 0 -o root "$@"
         else
@@ -421,8 +421,8 @@ if [ -n "$RESTORE" ]; then
         exit 1
     fi
     if [ "$NOBACKUP" = 1 ]; then
-        printf "## This will clear $OPAM and $OPAMROOT. Continue ? [Y/n] "
-        read R
+        printf "## This will clear %s and %s. Continue ? [Y/n] " "$OPAM" "$OPAMROOT"
+        read -r R
         case "$R" in
             ""|"y"|"Y"|"yes")
                 xsudo rm -f "$OPAM"
@@ -435,7 +435,7 @@ if [ -n "$RESTORE" ]; then
     fi
     xsudo mv "$OPAM_BAK" "$OPAM"
     mv "$OPAMROOT_BAK" "$OPAMROOT"
-    printf "## Opam $RESTORE and its root were restored."
+    printf "## Opam %s and its root were restored." "$RESTORE"
     if [ "$NOBACKUP" = 1 ]; then echo
     else echo " Opam $OPAMV was backed up."
     fi
@@ -453,16 +453,16 @@ if [ -n "$EXISTING_OPAM" ]; then
 fi
 
 while true; do
-    printf "## Where should it be installed ? [$DEFAULT_BINDIR] "
-    read BINDIR
+    printf "## Where should it be installed ? [%s] " "$DEFAULT_BINDIR"
+    read -r BINDIR
     if [ -z "$BINDIR" ]; then BINDIR="$DEFAULT_BINDIR"; fi
 
     if [ -d "$BINDIR" ]; then break
     else
         if [ "${BINDIR#\~/}" != "$BINDIR" ] ; then
             RES_BINDIR="$HOME/${BINDIR#\~/}"
-            printf "## '$BINDIR' resolves to '$RES_BINDIR', do you confirm [Y/n] "
-            read R
+            printf "## '%s' resolves to '%s', do you confirm [Y/n] " "$BINDIR" "$RES_BINDIR"
+            read -r R
             case "$R" in
                 ""|"y"|"Y"|"yes")
                    BINDIR="$RES_BINDIR"
@@ -472,8 +472,8 @@ while true; do
                    ;;
             esac
         fi
-        printf "## $BINDIR does not exist. Create ? [Y/n] "
-        read R
+        printf "## %s does not exist. Create ? [Y/n] " "$BINDIR"
+        read -r R
         case "$R" in
             ""|"y"|"Y"|"yes")
             xsudo mkdir -p "$BINDIR"
@@ -487,15 +487,15 @@ if [ -e "$EXISTING_OPAM" ]; then
         xsudo rm -f "$EXISTING_OPAM"
     else
         xsudo mv "$EXISTING_OPAM" "$EXISTING_OPAM.$EXISTING_OPAMV"
-        echo "## $EXISTING_OPAM backed up as $(basename $EXISTING_OPAM).$EXISTING_OPAMV"
+        echo "## $EXISTING_OPAM backed up as $(basename "$EXISTING_OPAM").$EXISTING_OPAMV"
     fi
 fi
 
 if [ -d "$OPAMROOT" ]; then
     if [ "$FRESH" = 1 ]; then
         if [ "$NOBACKUP" = 1 ]; then
-            printf "## This will clear $OPAMROOT. Continue ? [Y/n] "
-            read R
+            printf "## This will clear %s. Continue ? [Y/n] " "$OPAMROOT"
+            read -r R
             case "$R" in
                 ""|"y"|"Y"|"yes")
                     rm -rf "$OPAMROOT";;
@@ -503,11 +503,11 @@ if [ -d "$OPAMROOT" ]; then
             esac
         else
             mv "$OPAMROOT" "$OPAMROOT.$EXISTING_OPAMV"
-            echo "## $OPAMROOT backed up as $(basename $OPAMROOT).$EXISTING_OPAMV"
+            echo "## $OPAMROOT backed up as $(basename "$OPAMROOT").$EXISTING_OPAMV"
         fi
         echo "## opam $VERSION installed. Please run 'opam init' to get started"
     elif [ ! "$NOBACKUP" = 1 ]; then
-        echo "## Backing up $OPAMROOT to $(basename $OPAMROOT).$EXISTING_OPAMV (this may take a while)"
+        echo "## Backing up $OPAMROOT to $(basename "$OPAMROOT").$EXISTING_OPAMV (this may take a while)"
         if [ -e "$OPAMROOT.$EXISTING_OPAMV" ]; then
             echo "ERROR: there is already a backup at $OPAMROOT.$EXISTING_OPAMV"
             echo "Please move it away or run with --no-backup"
@@ -520,7 +520,7 @@ if [ -d "$OPAMROOT" ]; then
             exit 1
         fi
         cp -a "$OPAMROOT" "$OPAMROOT.$EXISTING_OPAMV"
-        echo "## $OPAMROOT backed up as $(basename $OPAMROOT).$EXISTING_OPAMV"
+        echo "## $OPAMROOT backed up as $(basename "$OPAMROOT").$EXISTING_OPAMV"
     fi
     rm -f "$OPAMROOT"/repo/*/*.tar.gz*
 fi
diff --git a/shell/msvs-detect b/shell/msvs-detect
index 8c72c436aaf..e14980c5625 100755
--- a/shell/msvs-detect
+++ b/shell/msvs-detect
@@ -140,7 +140,7 @@ check_environment ()
   ASSEMBLER=${ASSEMBLER%86}.exe
   if [[ $ML_REQUIRED -eq 1 ]] ; then
     RET=0
-    find_in "$1" $ASSEMBLER
+    find_in "$1" "$ASSEMBLER"
     if [[ $RET -gt 0 ]] ; then
       warning "Microsoft Assembler ($ASSEMBLER) not found - $4 ($5)"
       return 1
@@ -164,7 +164,7 @@ check_environment ()
 # value (i.e. no change) is output.
 output ()
 {
-  if [[ $3 = $ENV_ARCH ]] ; then
+  if [[ $3 = "$ENV_ARCH" ]] ; then
     VALUE=
   else
     VALUE=$2
@@ -207,7 +207,7 @@ WHICH=$(which which)
 # Parse command-line. At the moment, the short option which usefully combines with anything is -d,
 # so for the time being, combining short options is not permitted, as the loop becomes even less
 # clear with getopts. GNU getopt isn't installed by default on Cygwin...
-if [[ $@ != "" ]] ; then
+if [[ -n $* ]] ; then
   while true ; do
     case "$1" in
       # Mode settings ($MODE)
@@ -570,7 +570,7 @@ if [[ $SCAN_ENV -eq 1 ]] ; then
           ENV_cl=${ENV_CL,,}
           ENV_cl=${ENV_cl/bin\/*_/bin\/}
           debug "Environment appears to include a compiler at $ENV_CL"
-          if [[ -n $TARGET_ARCH && $TARGET_ARCH != $ENV_ARCH ]] ; then
+          if [[ -n $TARGET_ARCH && $TARGET_ARCH != "$ENV_ARCH" ]] ; then
             debug "But architecture doesn't match required value"
             unset ENV_ARCH
           fi
@@ -604,7 +604,7 @@ declare -A COMPILER
 
 # Scan the registry for compiler package (vswhere is later)
 for i in "${!COMPILERS[@]}" ; do
-  eval COMPILER=${COMPILERS[$i]}
+  eval COMPILER="${COMPILERS[$i]}"
 
   if [[ -n ${COMPILER["ENV"]+x} ]] ; then
     # Visual Studio package - test for its environment variable
@@ -612,7 +612,7 @@ for i in "${!COMPILERS[@]}" ; do
     if [[ -n ${!ENV+x} ]] ; then
       debug "$ENV is a candidate"
       TEST_PATH=${!ENV%\"}
-      TEST_PATH=$(cygpath -u -f - <<< ${TEST_PATH#\"})
+      TEST_PATH=$(cygpath -u -f - <<< "${TEST_PATH#\"}")
       if [[ -e $TEST_PATH/vsvars32.bat ]] ; then
         debug "Directory pointed to by $ENV contains vsvars32.bat"
         EXPRESS=0
@@ -686,7 +686,7 @@ for i in $(reg query "$SDK_ROOT" 2>/dev/null | tr -d '\r' | sed -ne '/Windows\\v
         warning "SDK $i is not known to this script - assuming compatibility"
         DISPLAY="Windows SDK $i"
       else
-        eval COMPILER=${COMPILERS["SDK${i#v}"]}
+        eval COMPILER="${COMPILERS["SDK${i#v}"]}"
         DISPLAY=${COMPILER['NAME']}
       fi
       RESULT=${COMPILERS['SDK']%)}
@@ -702,10 +702,10 @@ for i in $(reg query "$SDK_ROOT" 2>/dev/null | tr -d '\r' | sed -ne '/Windows\\v
 done
 
 # Now enumerate Visual Studio 2017+ instances
-VSWHERE=$(dirname $(realpath $0))/vswhere.exe
+VSWHERE=$(dirname "$(realpath "$0")")/vswhere.exe
 if [[ ! -x $VSWHERE ]] ; then
   VSWHERE="$(printenv 'ProgramFiles(x86)')\\Microsoft Visual Studio\\Installer\\vswhere.exe"
-  VSWHERE=$(echo $VSWHERE| cygpath -f -)
+  VSWHERE=$(echo "$VSWHERE"| cygpath -f -)
 fi
 if [[ -x $VSWHERE ]] ; then
   debug "$VSWHERE found"
@@ -722,7 +722,7 @@ if [[ -x $VSWHERE ]] ; then
       displayName)
         INSTANCE_NAME=${line#*: }
         debug "Looking at $INSTANCE in $INSTANCE_PATH ($INSTANCE_VER $INSTANCE_NAME)"
-        if [[ -e "$(echo $INSTANCE_PATH| cygpath -f -)/VC/Auxiliary/Build/vcvarsall.bat" ]] ; then
+        if [[ -e "$(echo "$INSTANCE_PATH"| cygpath -f -)/VC/Auxiliary/Build/vcvarsall.bat" ]] ; then
           debug "vcvarsall.bat found"
           FOUND+=(["VS$INSTANCE_VER"]="([\"DISPLAY\"]=\"$INSTANCE_NAME\" [\"ARCH\"]=\"x86 x64\" [\"SETENV\"]=\"$INSTANCE_PATH\\VC\\Auxiliary\\Build\\vcvarsall.bat\" [\"SETENV_RELEASE\"]=\"\")")
         else
@@ -775,33 +775,33 @@ for i in $MSVS_PREFERENCE ; do
   else
     if [[ -n ${COMPILERS[$i]+x} || -n ${COMPILERS[${i%.*}.*]+x} ]] ; then
       if [[ -n ${CANDIDATES[$i]+x} ]] ; then
-        unset CANDIDATES[$i]
-        TEST+=($i)
-        PREFERENCE+=($i)
+        unset "CANDIDATES[$i]"
+        TEST+=("$i")
+        PREFERENCE+=("$i")
       elif [[ ${i#*.} = "*" ]] ; then
         INSTANCES=
         for j in "${!CANDIDATES[@]}" ; do
-          if [[ "${j%.*}.*" = $i ]] ; then
-            unset CANDIDATES[$j]
+          if [[ "${j%.*}.*" = "$i" ]] ; then
+            unset "CANDIDATES[$j]"
             INSTANCES="$INSTANCES $j"
           fi
         done
         INSTANCES="$(sort -r <<< "${INSTANCES// /$'\n'}")"
-        eval TEST+=($INSTANCES)
-        eval PREFERENCE+=($INSTANCES)
+        eval "TEST+=($INSTANCES)"
+        eval "PREFERENCE+=($INSTANCES)"
       fi
     else
       if [[ -n ${CANDIDATES["VS$i"]+x} ]] ; then
-        unset CANDIDATES["VS$i"]
+        unset "CANDIDATES[VS$i]"
         TEST+=("VS$i")
         PREFERENCE+=("VS$i")
       fi
       SDKS=
       for j in "${!COMPILERS[@]}" ; do
-        eval COMPILER=${COMPILERS[$j]}
+        eval COMPILER="${COMPILERS[$j]}"
         if [[ -n ${COMPILER["VC_VER"]+x} ]] ; then
-          if [[ $i = ${COMPILER["VC_VER"]} && -n ${CANDIDATES[$j]+x} ]] ; then
-            unset CANDIDATES[$j]
+          if [[ $i = "${COMPILER["VC_VER"]}" && -n ${CANDIDATES[$j]+x} ]] ; then
+            unset "CANDIDATES[$j]"
             SDKS="$j $SDKS"
           fi
         fi
@@ -809,8 +809,8 @@ for i in $MSVS_PREFERENCE ; do
       SDKS=${SDKS% }
       SDKS="$(sort -r <<< "${SDKS// /$'\n'}")"
       SDKS=${SDKS//$'\n'/ }
-      eval TEST+=($SDKS)
-      eval PREFERENCE+=($SDKS)
+      eval "TEST+=($SDKS)"
+      eval "PREFERENCE+=($SDKS)"
     fi
   fi
 done
@@ -819,9 +819,9 @@ done
 # them from FOUND so that they don't accidentally get reported on later.
 for i in "${!CANDIDATES[@]}" ; do
   if [[ $PREFER_ENV -eq 1 ]] ; then
-    TEST+=($i)
+    TEST+=("$i")
   else
-    unset FOUND[$i]
+    unset "FOUND[$i]"
   fi
 done
 
@@ -852,16 +852,16 @@ declare -A ARCHINFO
 
 for i in "${TEST[@]}" ; do
   CURRENT=${FOUND[$i]}
-  eval COMPILER=$CURRENT
+  eval COMPILER="$CURRENT"
   # At the end of this process, the keys of FOUND will be augmented with the architecture found in
   # each case (so if "VS14.0" was in FOUND from the scan and both the x86 and x64 compilers are
   # valid, then at the end of this loop FOUND will contain "VS14.0-x86" and "VS14.0-x64").
-  unset FOUND[$i]
+  unset "FOUND[$i]"
 
   if [[ ${COMPILER["IS_EXPRESS"]}0 -gt 0 && -n ${COMPILER["EXPRESS_ARCH_SWITCHES"]+x} ]] ; then
-    eval ARCHINFO=${COMPILER["EXPRESS_ARCH_SWITCHES"]}
+    eval ARCHINFO="${COMPILER["EXPRESS_ARCH_SWITCHES"]}"
   elif [[ -n ${COMPILER["ARCH_SWITCHES"]+x} ]] ; then
-    eval ARCHINFO=${COMPILER["ARCH_SWITCHES"]}
+    eval ARCHINFO="${COMPILER["ARCH_SWITCHES"]}"
   else
     ARCHINFO=()
   fi
@@ -874,10 +874,10 @@ for i in "${TEST[@]}" ; do
     ENV=${!ENV%\"}
     ENV=${ENV#\"}
     if [[ ${COMPILER["ENV"]}0 -ge 800 ]] ; then
-      SCRIPT="$(cygpath -d -f - <<< $ENV)\\..\\..\\VC\\vcvarsall.bat"
+      SCRIPT="$(cygpath -d -f - <<< "$ENV")\\..\\..\\VC\\vcvarsall.bat"
       SCRIPT_SWITCHES=
     else
-      SCRIPT="$(cygpath -d -f - <<< $ENV)\\vsvars32.bat"
+      SCRIPT="$(cygpath -d -f - <<< "$ENV")\\vsvars32.bat"
       SCRIPT_SWITCHES=
     fi
   else
@@ -932,9 +932,9 @@ for i in "${TEST[@]}" ; do
     done < <(INCLUDE='' LIB='' PATH="?msvs-detect?:$DIR:$PATH" ORIGINALPATH='' \
              EXEC_SCRIPT="$(basename "$SCRIPT") $ARCH_SWITCHES $SCRIPT_SWITCHES" \
              MSYS2_ARG_CONV_EXCL='*' \
-             $(cygpath "$COMSPEC") /v:on /c $COMMAND 2>/dev/null | grep -F XMARKER -A 3 | tr -d '\015' | tail -3)
+             $(cygpath "$COMSPEC") /v:on /c "$COMMAND" 2>/dev/null | grep -F XMARKER -A 3 | tr -d '\015' | tail -3)
     if [[ $DEBUG -gt 3 ]] ; then
-      echo done>&2
+      echo "done">&2
     fi
 
     if [[ -n $MSVS_PATH ]] ; then
@@ -956,13 +956,13 @@ for i in "${TEST[@]}" ; do
     if [[ ${i/.*/} = "VS7" ]] ; then
       find_in "${MSVS_PATH//:/*}" mt.exe
       if [[ $RET -eq 1 ]] ; then
-        MSVS_PATH="$MSVS_PATH$(cygpath -u -f - <<< $ENV\\Bin\\winnt):"
+        MSVS_PATH="$MSVS_PATH$(cygpath -u -f - <<< "$ENV"\\Bin\\winnt):"
         RET=0
       fi
     fi
 
     # Ensure that these derived values give a valid compiler.
-    if check_environment "${MSVS_PATH//:/*}" "${MSVS_INC//;/*}" "${MSVS_LIB//;/*}" "$i" $arch ; then
+    if check_environment "${MSVS_PATH//:/*}" "${MSVS_INC//;/*}" "${MSVS_LIB//;/*}" "$i" "$arch" ; then
       # Put the package back into FOUND, but augmented with the architecture name and with the
       # derived values.
       FOUND["$i-$arch"]="${CURRENT%)} [\"MSVS_PATH\"]=\"$MSVS_PATH\" \
@@ -975,7 +975,7 @@ for i in "${TEST[@]}" ; do
         TEST_cl=$(PATH="$MSVS_PATH:$PATH" "$WHICH" cl)
         TEST_cl=${TEST_cl,,}
         TEST_cl=${TEST_cl/bin\/*_/bin\/}
-        if [[ $TEST_cl = $ENV_cl ]] ; then
+        if [[ $TEST_cl = "$ENV_cl" ]] ; then
           # Create trailing semi-colon versions of the expansions of ENV_ for comparison with MSVS_
           ENV_EXPAND_INC="${!ENV_INC%%;};"
           ENV_EXPAND_LIB="${!ENV_LIB%%;};"
@@ -1012,7 +1012,7 @@ for i in "${TEST[@]}" ; do
   # Does this package match the current preference? Note that PREFERENCE and TEST are constructed in
   # a cunning (and hopefully not too "You are not expected to understand this" way) such that $PREF
   # will always equal $i, unless $PREF = "@".
-  if [[ $PREF = $i ]] ; then
+  if [[ $PREF = "$i" ]] ; then
     # In which case, check that the architecture(s)s were found
     if [[ -n ${FOUND["$i-$LEFT_ARCH"]+x} && -n ${FOUND["$i-$RIGHT_ARCH"]+x} ]] ; then
       debug "Solved TARGET_ARCH=$TARGET_ARCH with $i"
@@ -1041,7 +1041,7 @@ FLIP=(["x86"]="x64" ["x64"]="x86")
 
 if [[ $MODE -eq 0 ]] ; then
   if [[ $PREF = "@" && -n ${ENV_COMPILER} ]] ; then
-    SOLUTION=${ENV_COMPILER%-$ENV_ARCH}
+    SOLUTION=${ENV_COMPILER%-"$ENV_ARCH"}
     # If --arch wasn't specified, then ensure that the other architecture was also found. If --arch
     # was specified, then validate that the compiler was valid. This should always happen, unless
     # something went wrong running the script to get MSVS_PATH, MSVS_LIB and MSVS_INC.
@@ -1083,7 +1083,7 @@ if [[ $MODE -eq 1 ]] ; then
 fi
 
 if [[ -n $SOLUTION ]] ; then
-  eval COMPILER=${FOUND[$SOLUTION-$LEFT_ARCH]}
+  eval COMPILER="${FOUND[$SOLUTION-$LEFT_ARCH]}"
   output MSVS_NAME "${COMPILER["DISPLAY"]}" $LEFT_ARCH
   output MSVS_PATH "${COMPILER["MSVS_PATH"]}" $LEFT_ARCH
   output MSVS_INC "${COMPILER["MSVS_INC"]}" $LEFT_ARCH
@@ -1092,7 +1092,7 @@ if [[ -n $SOLUTION ]] ; then
     output MSVS_ML "${COMPILER["ASSEMBLER"]%.exe}" always
   fi
   if [[ -z $TARGET_ARCH ]] ; then
-    eval COMPILER=${FOUND[$SOLUTION-$RIGHT_ARCH]}
+    eval COMPILER="${FOUND[$SOLUTION-$RIGHT_ARCH]}"
     output MSVS64_PATH "${COMPILER["MSVS_PATH"]}" $RIGHT_ARCH
     output MSVS64_INC "${COMPILER["MSVS_INC"]}" $RIGHT_ARCH
     output MSVS64_LIB "${COMPILER["MSVS_LIB"]}" $RIGHT_ARCH
diff --git a/shell/opam-bin-cache.sh b/shell/opam-bin-cache.sh
index 44c953283b9..0e95ec9e91b 100755
--- a/shell/opam-bin-cache.sh
+++ b/shell/opam-bin-cache.sh
@@ -4,7 +4,7 @@ COMMAND=$1; shift
 ID=$1; shift
 
 if [ -z "$ID" ]; then
-    if [ $COMMAND = wrap ]; then exec "$@"
+    if [ "$COMMAND" = wrap ]; then exec "$@"
     else exit 0
     fi
 fi
diff --git a/shell/opam_installer.sh b/shell/opam_installer.sh
index c2131b3950f..c6f105a833b 100755
--- a/shell/opam_installer.sh
+++ b/shell/opam_installer.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 set -ue
 
@@ -35,8 +35,8 @@ EOF
 #
 PROGNAME=$0
 error() {
-    echo -n "`basename $PROGNAME`: " >&2
-    for s in "$@"; do echo $s; done
+    echo -n "$(basename "$PROGNAME"): " >&2
+    for s in "$@"; do echo "$s"; done
     exit 1
 }
 
@@ -70,23 +70,23 @@ COMP=${2:-$default_ocaml}
 file="opam-$VERSION-$(uname -m || echo unknown)-$(uname -s || echo unknown)"
 
 echo Downloading opam...
-getopam "https://github.com/ocaml/opam/releases/download/$VERSION" $file
+getopam "https://github.com/ocaml/opam/releases/download/$VERSION" "$file"
 
 mkdir -p "$BINDIR" 2>/dev/null || true
 if [ ! -w "$BINDIR" ]; then
     echo "You don't have write access to $BINDIR: sudo may ask for your password"
     if [ ! -d "$BINDIR" ]; then sudo mkdir -p "$BINDIR"; fi
-    sudo install -g root -o root -m 755 $TMP/$file $BINDIR/opam
+    sudo install -g root -o root -m 755 "$TMP/$file" "$BINDIR"/opam
 else
-    install -m 755 $TMP/$file $BINDIR/opam
+    install -m 755 "$TMP/$file" "$BINDIR"/opam
 fi
-rm -f $TMP/$file
+rm -f "$TMP/$file"
 
 OPAM=$(which opam || echo "$BINDIR/opam")
 if [ "$OPAM" != "$BINDIR/opam" ]; then
     echo "WARNING: you have a different version of opam installed at $OPAM"
     echo "It is highly recommended that you remove it."
-    read -p "[press enter to continue]" x
+    read -p "[press enter to continue]" _
     OPAM="$BINDIR/opam"
 fi
 
diff --git a/shell/re-patch.sh b/shell/re-patch.sh
index c1e8a53ab32..c881e0390bf 100755
--- a/shell/re-patch.sh
+++ b/shell/re-patch.sh
@@ -38,8 +38,8 @@ for package in $(cd patches ; find . -maxdepth 1 -mindepth 1 -type d | sed -e 's
   # Re-do the patches
   for mode in $modes ; do
     # Extract the package in this mode
-    make $package.$mode
-    rm -rf $package
+    make "$package.$mode"
+    rm -rf "$package"
     if [[ -e $package.tar.gz ]] ; then
       tarball=$package.tar.gz
       tar_flag=z
@@ -47,10 +47,10 @@ for package in $(cd patches ; find . -maxdepth 1 -mindepth 1 -type d | sed -e 's
       tarball=$package.tbz
       tar_flag=j
     fi
-    rm -rf tmp-$package.$mode
-    mkdir tmp-$package.$mode
-    cd tmp-$package.$mode
-    tar -x$tar_flag -f ../$tarball
+    rm -rf tmp-"$package.$mode"
+    mkdir tmp-"$package.$mode"
+    cd tmp-"$package.$mode"
+    tar -x$tar_flag -f ../"$tarball"
     while IFS= read -r -d '' dir ; do
       if [[ $dir = "." || $dir = ".." ]] ; then continue ; fi
       mv "$dir" a
@@ -66,20 +66,20 @@ for package in $(cd patches ; find . -maxdepth 1 -mindepth 1 -type d | sed -e 's
     for patch in $locs ; do
       cp -a a/ b/
       cd b
-      patch -p1 --set-time --no-backup-if-mismatch < ../$patch
+      patch -p1 --set-time --no-backup-if-mismatch < ../"$patch"
       cd ..
-      (TZ=UTC+0 diff -Naur a b || true) > $patch.new
-      if ! diff -q $patch $patch.new &>/dev/null ; then
-        mv $patch $patch.old
-        mv $patch.new $patch
+      (TZ=UTC+0 diff -Naur a b || true) > "$patch".new
+      if ! diff -q "$patch" "$patch".new &>/dev/null ; then
+        mv "$patch" "$patch".old
+        mv "$patch".new "$patch"
       else
-        rm $patch.new
+        rm "$patch".new
       fi
       rm -rf a
       mv b a
     done
 
     cd ..
-    rm -rf tmp-$package.$mode
+    rm -rf tmp-"$package.$mode"
   done
 done
diff --git a/shell/wrap-remove.sh b/shell/wrap-remove.sh
index 83b141ea285..c6a5cc3fc7f 100755
--- a/shell/wrap-remove.sh
+++ b/shell/wrap-remove.sh
@@ -13,7 +13,7 @@ exec unshare -Umnr /bin/sh -es "$@" <<EOF
 mount --bind ~ ~ # ro
 mount --bind "$OPAM_SWITCH_PREFIX" "$OPAM_SWITCH_PREFIX" # rw
 mount --bind "$OPAM_SWITCH_PREFIX/.opam-switch" "$OPAM_SWITCH_PREFIX/.opam-switch" # ro
-if [ "X${PWD#$OPAM_SWITCH_PREFIX}" != "X$PWD" ]; then
+if [ "X${PWD#"$OPAM_SWITCH_PREFIX"}" != "X$PWD" ]; then
   mount --bind . . # rw: packages may run e.g. ./configure
 fi
 mount -o remount,ro,bind "$OPAM_SWITCH_PREFIX/.opam-switch"
diff --git a/src/state/shellscripts/bwrap.sh b/src/state/shellscripts/bwrap.sh
index 7b45fc87750..64c27a2d930 100644
--- a/src/state/shellscripts/bwrap.sh
+++ b/src/state/shellscripts/bwrap.sh
@@ -50,7 +50,8 @@ add_mounts() {
 add_sys_mounts() {
     for dir in "$@"; do
         if [ -L "$dir" ]; then
-            local src=$(readlink -f "$dir")
+            local src
+            src=$(readlink -f "$dir")
             add_mount sym "$src" "$dir"
         else
             add_mounts ro "$dir"
@@ -71,7 +72,8 @@ done
 
 mount_linked_cache() {
   local l_cache=$1
-  local cache=$(readlink -m "$l_cache")
+  local cache
+  cache=$(readlink -m "$l_cache")
   mkdir -p "$cache"
   add_mount rw "$l_cache" "$cache"
 }
@@ -125,7 +127,7 @@ case "$COMMAND" in
     remove)
         add_mounts rw "$OPAM_SWITCH_PREFIX"
         add_mounts ro "$OPAM_SWITCH_PREFIX/.opam-switch"
-        if [ "X${PWD#$OPAM_SWITCH_PREFIX/.opam-switch/}" != "X${PWD}" ]; then
+        if [ "X${PWD#"$OPAM_SWITCH_PREFIX"/.opam-switch/}" != "X${PWD}" ]; then
           add_mounts rw "$PWD"
         fi
         ;;
diff --git a/src/state/shellscripts/complete.sh b/src/state/shellscripts/complete.sh
index a30575a7b16..7bd7280542d 100644
--- a/src/state/shellscripts/complete.sh
+++ b/src/state/shellscripts/complete.sh
@@ -66,14 +66,14 @@ _opam()
   compgen_opt=()
   _opam_reply=()
 
-  if [ $COMP_CWORD -eq 1 ]; then
+  if [ "$COMP_CWORD" -eq 1 ]; then
       _opam_add_f opam help topics
-      COMPREPLY=( $(compgen -W "${_opam_reply[*]}" -- $cur) )
+      COMPREPLY=( $(compgen -W "${_opam_reply[*]}" -- "$cur") )
       unset _opam_reply
       return 0
   fi
 
-  case "$(_opam_argtype $cmd $prev)" in
+  case "$(_opam_argtype "$cmd" "$prev")" in
       LEVEL|JOBS|RANK) _opam_add 1 2 3 4 5 6 7 8 9;;
       FILE|FILENAME) compgen_opt+=(-o filenames -f);;
       DIR|ROOT) compgen_opt+=(-o filenames -d);;
@@ -104,12 +104,12 @@ _opam()
   case "$cmd" in
       install|show|info|inst|ins|in|i|inf|sh)
           _opam_add_f opam list --safe -a -s
-          if [ $COMP_CWORD -gt 2 ]; then
+          if [ "$COMP_CWORD" -gt 2 ]; then
               _opam_add_f _opam_flags "$cmd"
           fi;;
       reinstall|remove|uninstall|reinst|remov|uninst|unins)
           _opam_add_f opam list --safe -i -s
-          if [ $COMP_CWORD -gt 2 ]; then
+          if [ "$COMP_CWORD" -gt 2 ]; then
               _opam_add_f _opam_flags "$cmd"
           fi;;
       upgrade|upg)
@@ -172,7 +172,7 @@ _opam()
           _opam_add_f _opam_flags "$cmd"
           ;;
       source|so)
-          if [ $COMP_CWORD -eq 2 ]; then
+          if [ "$COMP_CWORD" -eq 2 ]; then
               _opam_add_f opam list --safe -A -s
           else
               _opam_add_f _opam_flags "$cmd"
@@ -200,23 +200,23 @@ _opam()
                   esac
           esac;;
       unpin)
-          if [ $COMP_CWORD -eq 2 ]; then
+          if [ "$COMP_CWORD" -eq 2 ]; then
               _opam_add_f opam pin list --safe -s
           else
               _opam_add_f _opam_flags "$cmd"
           fi;;
       var|v)
-          if [ $COMP_CWORD -eq 2 ]; then _opam_add_f _opam_vars
+          if [ "$COMP_CWORD" -eq 2 ]; then _opam_add_f _opam_vars
           else _opam_add_f _opam_flags "$cmd"; fi;;
       exec|e)
-          if [ $COMP_CWORD -eq 2 ]; then compgen_opt+=(-c)
+          if [ "$COMP_CWORD" -eq 2 ]; then compgen_opt+=(-c)
           else _opam_add_f _opam_flags "$cmd"; fi;;
       lint|build)
-          if [ $COMP_CWORD -eq 2 ]; then
+          if [ "$COMP_CWORD" -eq 2 ]; then
               compgen_opt+=(-f -X '!*opam' -o plusdirs)
           else _opam_add_f _opam_flags "$cmd"; fi;;
       admin)
-          if [ $COMP_CWORD -eq 2 ]; then
+          if [ "$COMP_CWORD" -eq 2 ]; then
               _opam_add_f _opam_commands "$cmd"
           else _opam_add_f _opam_flags "$cmd" "$subcmd"; fi;;
       *)
diff --git a/src/state/shellscripts/env_hook.fish b/src/state/shellscripts/env_hook.fish
index d11c7bad2ef..971be3a4ed7 100644
--- a/src/state/shellscripts/env_hook.fish
+++ b/src/state/shellscripts/env_hook.fish
@@ -1,3 +1,3 @@
-function __opam_env_export_eval --on-event fish_prompt;
-    eval (opam env --shell=fish --readonly 2> /dev/null);
+function __opam_env_export_eval --on-event fish_prompt
+    eval (opam env --shell=fish --readonly 2> /dev/null)
 end
diff --git a/src/state/shellscripts/sandbox_exec.sh b/src/state/shellscripts/sandbox_exec.sh
index dc1487a3d5b..e5fe157695e 100644
--- a/src/state/shellscripts/sandbox_exec.sh
+++ b/src/state/shellscripts/sandbox_exec.sh
@@ -11,7 +11,8 @@ POL="$POL"'(allow file-write* (regex #"^(/private)?(/var)?/tmp/"))'
 
 add_mounts() {
     if [ -d "$2" ]; then
-      local DIR="$(cd "$2" && pwd -P)"
+      local DIR
+      DIR="$(cd "$2" && pwd -P)"
       case "$1" in
           ro) POL="$POL"'(deny file-write* (subpath "'"$DIR"'"))';;
           rw) POL="$POL"'(allow file-write* (subpath "'"$DIR"'"))';;
@@ -82,7 +83,7 @@ case "$COMMAND" in
     remove)
         add_mounts rw "$OPAM_SWITCH_PREFIX"
         add_mounts ro "$OPAM_SWITCH_PREFIX/.opam-switch"
-        if [ "X${PWD#$OPAM_SWITCH_PREFIX/.opam-switch/}" != "X${PWD}" ]; then
+        if [ "X${PWD#"$OPAM_SWITCH_PREFIX"/.opam-switch/}" != "X${PWD}" ]; then
           add_mounts rw "$PWD"
         fi
         ;;
diff --git a/src_ext/update-sources.sh b/src_ext/update-sources.sh
index 732d1d5205d..428d5e105b4 100755
--- a/src_ext/update-sources.sh
+++ b/src_ext/update-sources.sh
@@ -1,37 +1,39 @@
 #!/usr/bin/env bash
 
-cd $(dirname $0)
+set -ue
+
+cd "$(dirname "$0")"
 echo -n "Checking packages for new versions in opam: "
 DISAGREEMENTS=()
-while read name prefix version url; do
+while read -r name prefix version url; do
   package=$name
   case "$package" in
     findlib) package=ocamlfind;;
     dune-local) package=dune;;
   esac
-  latest=$(opam show $package -f all-versions | sed -e 's/  base//')
+  latest=$(opam show "$package" -f all-versions | sed -e 's/  base//')
   latest=${latest##* }
-  package_url=$(opam show $package.$latest -f url.src: | sed -e 's/"//g')
+  package_url=$(opam show "$package.$latest" -f url.src: | sed -e 's/"//g')
   md5=$(sed -n -e "s/MD5$prefix$name *= *\(.*\)/\1/p" Makefile.sources)
-  package_md5=$(opam show $package.$latest -f url.checksum: | sed -n -e "/md5/s/.*md5=\([a-fA-F0-9]\{32\}\).*/\1/p")
+  package_md5=$(opam show "$package.$latest" -f url.checksum: | sed -n -e "/md5/s/.*md5=\([a-fA-F0-9]\{32\}\).*/\1/p")
   if [[ -z $package_md5 ]] ; then
     echo -e "\n$name: [\033[1;33mWARN\033[m] no md5 given in opam, downloading $package_url to check"
-    package_md5=$(curl -LSs $package_url | md5sum | cut -f1 -d' ')
+    package_md5=$(curl -LSs "$package_url" | md5sum | cut -f1 -d' ')
   fi
-  if [[ $package_url = $url ]] ; then
-    if [[ $package_md5 = $md5 ]] ; then
+  if [[ $package_url = "$url" ]] ; then
+    if [[ $package_md5 = "$md5" ]] ; then
       echo -ne "[\033[0;32m$name\033[m] "
-      if [[ $latest != $version ]] ; then
-        DISAGREEMENTS+=" $name ($version vs $latest in opam)"
+      if [[ $latest != "$version" ]] ; then
+        DISAGREEMENTS+=(" $name ($version vs $latest in opam)")
       fi
     else
       echo -e "\n$name: [\033[1;33mWARN\033[m] MD5 is wrong for (should be $package_md5 according to opam)"
     fi
   else
-    if [[ $package_md5 = $md5 ]] ; then
+    if [[ $package_md5 = "$md5" ]] ; then
       echo -e "\n$name: [\033[1;33mWARN\033[m] URL is wrong for $name (should be $package_url according to opam)"
     else
-      if [[ $latest = $version ]] ; then
+      if [[ $latest = "$version" ]] ; then
         echo -e "\n$name: [\033[1;33mWARN\033[m] URL and MD5 are wrong for $name (should be $package_url (md5=$package_md5) according to opam)"
       else
         echo -ne "[\033[0;31m$name\033[m: \033[1m$latest\033[m] "
@@ -43,5 +45,5 @@ while read name prefix version url; do
 done < <(grep -F URL_ Makefile.sources | sed -e "s/URL\(_\(PKG_\)\?\)\([^ =]*\) *= *\(.*\/\(\([^0-9][^-]*\)*-\)\?v\?\)\([0-9.]\+\([-+.][^\/]*\)\?\)\(\.tbz\|\.tar\.gz\)/\3 \1 \7 \4\7\9/" | sort)
 echo -e "\nComplete."
 if [[ ${#DISAGREEMENTS[@]} -gt 0 ]] ; then
-  echo "Disagreements over version:${DISAGREEMENTS[@]}"
+  echo "Disagreements over version:${DISAGREEMENTS[*]}"
 fi