diff --git a/schutzbot/deploy.sh b/schutzbot/deploy.sh
index 4cd6aca71..9f0b5249a 100755
--- a/schutzbot/deploy.sh
+++ b/schutzbot/deploy.sh
@@ -6,7 +6,7 @@ function retry {
     local retries=5
     until "$@"; do
         exit=$?
-        count=$(($count + 1))
+        count=$((count + 1))
         if [[ $count -lt $retries ]]; then
             echo "Retrying command..."
             sleep 1
diff --git a/schutzbot/mockbuild.sh b/schutzbot/mockbuild.sh
index fd2d572aa..62683ccf9 100755
--- a/schutzbot/mockbuild.sh
+++ b/schutzbot/mockbuild.sh
@@ -108,7 +108,7 @@ cp -arv "${REPO_DIR}"/ "${REPO_DIR_LATEST}"/
 
 # Remove the previous latest build for this branch.
 # Don't fail if the path is missing.
-s3cmd --recursive rm s3://${REPO_BUCKET}/"${JOB_NAME}"/latest/"${ID}""${VERSION_ID//./}"_"${ARCH}" || true
+s3cmd --recursive rm "s3://${REPO_BUCKET}/${JOB_NAME}/latest/${ID}${VERSION_ID//./}_${ARCH}" || true
 
 # Upload repository to S3.
 greenprint "☁ Uploading RPMs to S3"
diff --git a/schutzbot/run_base_tests.sh b/schutzbot/run_base_tests.sh
index f5ec683f2..e460367cb 100755
--- a/schutzbot/run_base_tests.sh
+++ b/schutzbot/run_base_tests.sh
@@ -27,9 +27,9 @@ run_test_case () {
     test_divider
 
     if sudo "${1}" -test.v | tee "${WORKSPACE}"/"${TEST_NAME}".log; then
-        PASSED_TESTS+=($TEST_NAME)
+        PASSED_TESTS+=("$TEST_NAME")
     else
-        FAILED_TESTS+=($TEST_NAME)
+        FAILED_TESTS+=("$TEST_NAME")
     fi
 
     test_divider
@@ -49,8 +49,8 @@ done
 
 # Print a report of the test results.
 test_divider
-echo "😃 Passed tests: ${PASSED_TESTS[@]}"
-echo "☹ Failed tests: ${FAILED_TESTS[@]}"
+echo "😃 Passed tests:" "${PASSED_TESTS[@]}"
+echo "☹ Failed tests:" "${FAILED_TESTS[@]}"
 test_divider
 
 # Exit with a failure if any tests failed.
diff --git a/test/image-tests/aws.sh b/test/image-tests/aws.sh
index 82531de94..6299da926 100755
--- a/test/image-tests/aws.sh
+++ b/test/image-tests/aws.sh
@@ -94,7 +94,7 @@ get_compose_metadata () {
     sudo composer-cli compose metadata "$COMPOSE_ID" > /dev/null
 
     # Find the tarball and extract it.
-    TARBALL=$(basename $(find . -maxdepth 1 -type f -name "*-metadata.tar"))
+    TARBALL=$(basename "$(find . -maxdepth 1 -type f -name "*-metadata.tar")")
     tar -xf "$TARBALL"
     rm -f "$TARBALL"
 
@@ -143,7 +143,7 @@ sudo composer-cli blueprints push "$BLUEPRINT_FILE"
 sudo composer-cli blueprints depsolve bash
 
 # Get worker unit file so we can watch the journal.
-WORKER_UNIT=$(sudo systemctl list-units | egrep -o "osbuild.*worker.*\.service")
+WORKER_UNIT=$(sudo systemctl list-units | grep -o -E "osbuild.*worker.*\.service")
 sudo journalctl -af -n 1 -u "${WORKER_UNIT}" &
 WORKER_JOURNAL_PID=$!
 
@@ -245,7 +245,7 @@ PUBLIC_IP=$(jq -r '.Reservations[].Instances[].PublicIpAddress' "$INSTANCE_DATA"
 # Wait for the node to come online.
 greenprint "⏱ Waiting for AWS instance to respond to ssh"
 for LOOP_COUNTER in {0..30}; do
-    if ssh-keyscan "$PUBLIC_IP" 2>&1 > /dev/null; then
+    if ssh-keyscan "$PUBLIC_IP" > /dev/null 2>&1; then
         echo "SSH is up!"
         ssh-keyscan "$PUBLIC_IP" >> ~/.ssh/known_hosts
         break
@@ -253,7 +253,7 @@ for LOOP_COUNTER in {0..30}; do
 
     # Get a screenshot of the instance console.
     echo "Getting instance screenshot..."
-    store_instance_screenshot "$INSTANCE_ID" $LOOP_COUNTER || true
+    store_instance_screenshot "$INSTANCE_ID" "$LOOP_COUNTER" || true
 
     # ssh-keyscan has a 5 second timeout by default, so the pause per loop
     # is 10 seconds when you include the following `sleep`.
@@ -287,4 +287,4 @@ else
   exit 1
 fi
 
-exit 0
\ No newline at end of file
+exit 0
diff --git a/test/image-tests/koji.sh b/test/image-tests/koji.sh
index c301825c8..d045eaf72 100755
--- a/test/image-tests/koji.sh
+++ b/test/image-tests/koji.sh
@@ -3,7 +3,6 @@ set -euo pipefail
 
 # Get OS data.
 source /etc/os-release
-ARCH=$(uname -m)
 
 # Colorful output.
 function greenprint {
diff --git a/test/image-tests/ostree.sh b/test/image-tests/ostree.sh
index bee304e48..ad074ad8a 100755
--- a/test/image-tests/ostree.sh
+++ b/test/image-tests/ostree.sh
@@ -19,7 +19,7 @@ case "${ID}-${VERSION_ID}" in
         BOOT_LOCATION="https://mirrors.rit.edu/fedora/fedora/linux/releases/32/Everything/x86_64/os/";;
     "rhel-8.3")
         # Override old rhel-8-beta.json because test needs latest systemd and redhat-release
-        sudo cp $(dirname "$0")/rhel-8-beta.json /etc/osbuild-composer/repositories/
+        sudo cp "$(dirname "$0")"/rhel-8-beta.json /etc/osbuild-composer/repositories/
         sudo systemctl restart osbuild-composer.socket
         IMAGE_TYPE=rhel-edge-commit
         OSTREE_REF="rhel/8/${ARCH}/edge"
@@ -101,7 +101,7 @@ EOF
 
 # Set up variables.
 TEST_UUID=$(uuidgen)
-IMAGE_KEY=osbuild-composer-ostree-test-${TEST_UUID}
+IMAGE_KEY="osbuild-composer-ostree-test-${TEST_UUID}"
 GUEST_ADDRESS=192.168.100.50
 
 # Set up temporary files.
@@ -112,7 +112,7 @@ COMPOSE_START=${TEMPDIR}/compose-start-${IMAGE_KEY}.json
 COMPOSE_INFO=${TEMPDIR}/compose-info-${IMAGE_KEY}.json
 
 # SSH setup.
-SSH_OPTIONS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5"
+SSH_OPTIONS=(-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5)
 SSH_KEY=${WORKSPACE}/test/keyring/id_rsa
 chmod 0600 "$SSH_KEY"
 
@@ -134,7 +134,7 @@ get_compose_metadata () {
     sudo composer-cli compose metadata "$COMPOSE_ID" > /dev/null
 
     # Find the tarball and extract it.
-    TARBALL=$(basename $(find . -maxdepth 1 -type f -name "*-metadata.tar"))
+    TARBALL=$(basename "$(find . -maxdepth 1 -type f -name "*-metadata.tar")")
     tar -xf "$TARBALL" -C "${TEMPDIR}"
     rm -f "$TARBALL"
 
@@ -153,7 +153,7 @@ build_image() {
     sudo composer-cli blueprints depsolve "$blueprint_name"
 
     # Get worker unit file so we can watch the journal.
-    WORKER_UNIT=$(sudo systemctl list-units | egrep -o "osbuild.*worker.*\.service")
+    WORKER_UNIT=$(sudo systemctl list-units | grep -o -E "osbuild.*worker.*\.service")
     sudo journalctl -af -n 1 -u "${WORKER_UNIT}" &
     WORKER_JOURNAL_PID=$!
 
@@ -200,7 +200,7 @@ build_image() {
 
 # Wait for the ssh server up to be.
 wait_for_ssh_up () {
-    SSH_STATUS=$(ssh "$SSH_OPTIONS" -i "${SSH_KEY}" admin@"${1}" '/bin/bash -c "echo -n READY"')
+    SSH_STATUS=$(ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" admin@"${1}" '/bin/bash -c "echo -n READY"')
     if [[ $SSH_STATUS == READY ]]; then
         echo 1
     else
@@ -438,14 +438,15 @@ UPGRADE_HASH=$(jq -r '."ostree-commit"' < "${UPGRADE_PATH}"/compose.json)
 
 # Upgrade image/commit.
 greenprint "Upgrade ostree image/commit"
-ssh "$SSH_OPTIONS" -i "${SSH_KEY}" admin@${GUEST_ADDRESS} 'sudo rpm-ostree upgrade'
-ssh "$SSH_OPTIONS" -i "${SSH_KEY}" admin@${GUEST_ADDRESS} 'nohup sudo systemctl reboot &>/dev/null & exit'
+ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" admin@${GUEST_ADDRESS} 'sudo rpm-ostree upgrade'
+ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" admin@${GUEST_ADDRESS} 'nohup sudo systemctl reboot &>/dev/null & exit'
 
 # Sleep 10 seconds here to make sure vm restarted already
 sleep 10
 
 # Check for ssh ready to go.
 greenprint "🛃 Checking for SSH is ready to go"
+# shellcheck disable=SC2034  # Unused variables left for readability
 for LOOP_COUNTER in $(seq 0 30); do
     RESULTS="$(wait_for_ssh_up $GUEST_ADDRESS)"
     if [[ $RESULTS == 1 ]]; then
@@ -471,7 +472,7 @@ ansible_ssh_common_args="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/
 EOF
 
 # Test IoT/Edge OS
-ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=${IMAGE_TYPE} -e ostree_commit="${UPGRADE_HASH}" $(dirname "$0")/check_ostree.yaml || RESULTS=0
+ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=${IMAGE_TYPE} -e ostree_commit="${UPGRADE_HASH}" "$(dirname "$0")"/check_ostree.yaml || RESULTS=0
 check_result
 
 # Final success clean up
diff --git a/test/image-tests/qemu.sh b/test/image-tests/qemu.sh
index c3fcb9368..6629a5c40 100755
--- a/test/image-tests/qemu.sh
+++ b/test/image-tests/qemu.sh
@@ -107,8 +107,8 @@ smoke_test_check () {
     SSH_KEY=${WORKSPACE}/test/keyring/id_rsa
     chmod 0600 "$SSH_KEY"
 
-    SSH_OPTIONS="-o StrictHostKeyChecking=no -o ConnectTimeout=5"
-    SMOKE_TEST=$(ssh "$SSH_OPTIONS" -i "${SSH_KEY}" redhat@"${1}" 'cat /etc/smoke-test.txt')
+    SSH_OPTIONS=(-o StrictHostKeyChecking=no -o ConnectTimeout=5)
+    SMOKE_TEST=$(ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" redhat@"${1}" 'cat /etc/smoke-test.txt')
     if [[ $SMOKE_TEST == smoke-test ]]; then
         echo 1
     else
@@ -134,7 +134,7 @@ get_compose_metadata () {
     sudo composer-cli compose metadata "$COMPOSE_ID" > /dev/null
 
     # Find the tarball and extract it.
-    TARBALL=$(basename $(find . -maxdepth 1 -type f -name "*-metadata.tar"))
+    TARBALL=$(basename "$(find . -maxdepth 1 -type f -name "*-metadata.tar")")
     tar -xf "$TARBALL"
     rm -f "$TARBALL"
 
@@ -171,7 +171,7 @@ sudo composer-cli blueprints push "$BLUEPRINT_FILE"
 sudo composer-cli blueprints depsolve bash
 
 # Get worker unit file so we can watch the journal.
-WORKER_UNIT=$(sudo systemctl list-units | egrep -o "osbuild.*worker.*\.service")
+WORKER_UNIT=$(sudo systemctl list-units | grep -o -E "osbuild.*worker.*\.service")
 sudo journalctl -af -n 1 -u "${WORKER_UNIT}" &
 WORKER_JOURNAL_PID=$!
 
@@ -212,7 +212,7 @@ sudo kill ${WORKER_JOURNAL_PID}
 # Download the image.
 greenprint "📥 Downloading the image"
 sudo composer-cli compose image "${COMPOSE_ID}" > /dev/null
-IMAGE_FILENAME=$(basename $(find . -maxdepth 1 -type f -name "*.${IMAGE_EXTENSION}"))
+IMAGE_FILENAME=$(basename "$(find . -maxdepth 1 -type f -name "*.${IMAGE_EXTENSION}")")
 LIBVIRT_IMAGE_PATH=/var/lib/libvirt/images/${IMAGE_KEY}.${IMAGE_EXTENSION}
 sudo mv "$IMAGE_FILENAME" "$LIBVIRT_IMAGE_PATH"
 
@@ -227,7 +227,7 @@ CLOUD_INIT_PATH=/var/lib/libvirt/images/seed.iso
 rm -f $CLOUD_INIT_PATH
 pushd "$CLOUD_INIT_DIR"
     sudo genisoimage -o $CLOUD_INIT_PATH -V cidata \
-        -r -J user-data meta-data network-config 2>&1 > /dev/null
+        -r -J user-data meta-data network-config > /dev/null 2>&1
 popd
 
 # Ensure SELinux is happy with our new images.
@@ -287,6 +287,7 @@ esac
 
 # Check for our smoke test file.
 greenprint "🛃 Checking for smoke test file in VM"
+# shellcheck disable=SC2034  # Unused variables left for readability
 for LOOP_COUNTER in $(seq 0 ${MAX_LOOPS}); do
     RESULTS="$(smoke_test_check $INSTANCE_ADDRESS)"
     if [[ $RESULTS == 1 ]]; then