diff --git a/build/build b/build/build
index c34c83ee..dc82efe0 100755
--- a/build/build
+++ b/build/build
@@ -7,7 +7,8 @@ main() {
   # Set minimal locale.
   export LC_ALL=C
   # Set source date. This is honored by `asciidoctor` and other tools.
-  export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
+  SOURCE_DATE_EPOCH="$(git log -1 --pretty=%ct)"
+  export SOURCE_DATE_EPOCH
 
   if ! command -v rad > /dev/null; then
     echo "fatal: rad is not installed" >&2 ; exit 1
@@ -21,7 +22,7 @@ main() {
     echo "fatal: sha256sum is not installed" >&2 ; exit 1
   fi
 
-  rev="$(git rev-parse --short HEAD)"
+  rev="$(git rev-parse HEAD)"
   gitarchive="build/heartwood-$rev.tar.gz"
   keypath="$(rad path)/keys/radicle.pub"
   version="$(build/version)"
@@ -42,38 +43,39 @@ main() {
     --build-arg SOURCE_DATE_EPOCH \
     --build-arg TZ \
     --build-arg LC_ALL \
-    --build-arg RADICLE_VERSION=$version \
-    --build-arg GIT_HEAD=$rev \
-    --arch amd64 --tag $image -f ./build/Dockerfile - < $gitarchive
+    --build-arg "RADICLE_VERSION=$version" \
+    --build-arg "GIT_HEAD=$rev" \
+    --arch amd64 --tag "$image" -f ./build/Dockerfile - < "$gitarchive"
 
   echo "Creating container (radicle-build-container).."
-  podman --cgroup-manager=cgroupfs create --ulimit=host --replace --name radicle-build-container $image
+  podman --cgroup-manager=cgroupfs create --ulimit=host --replace --name radicle-build-container "$image"
 
   # Copy build artifacts to output folder.
   outdir=build/artifacts
   mkdir -p $outdir
   podman cp --overwrite radicle-build-container:/builds/. $outdir/
 
-  for target in $(cat build/TARGETS); do
+  while IFS= read -r target
+  do
     echo "Signing artifacts for $target.."
 
     filename="radicle-$version-$target.tar.xz"
     filepath="$outdir/$filename"
 
     # Output SHA256 digest of archive.
-    checksum="$(cd $outdir && sha256sum $filename)"
+    checksum="$(cd $outdir && sha256sum "$filename")"
     echo "Checksum of $filepath is $(echo "$checksum" | cut -d' ' -f1)"
-    echo "$checksum" > $filepath.sha256
+    echo "$checksum" > "${filepath}.sha256"
 
     # Sign archive and verify archive.
-    rm -f $filepath.sig # Delete existing signature
-    ssh-keygen -Y sign -n file -f $keypath $filepath
-    ssh-keygen -Y check-novalidate -n file -s $filepath.sig < $filepath
-  done
+    rm -f "${filepath}.sig" # Delete existing signature
+    ssh-keygen -Y sign -n file -f "$keypath" "$filepath"
+    ssh-keygen -Y check-novalidate -n file -s "$filepath.sig" < "$filepath"
+  done < build/TARGETS
 
   # Remove build artifacts that aren't needed anymore.
   podman rm radicle-build-container > /dev/null
-  podman rmi --ignore localhost/$image
+  podman rmi --ignore "localhost/$image"
 }
 
 # Run build.
diff --git a/build/release b/build/release
index a35d1a9c..740a971e 100755
--- a/build/release
+++ b/build/release
@@ -23,12 +23,12 @@ main() {
   fi
 
   printf "Releasing Radicle %s? [y/N] " "$version"
-  read confirmation
+  read -r confirmation
 
   case "$confirmation" in
     [Yy]*)
       echo "Creating 'latest' symlink.."
-      ssh -i "$SSH_KEY" "$SSH_ADDRESS" ln -snf /mnt/radicle/files/releases/$version /mnt/radicle/files/releases/latest ;;
+      ssh -i "$SSH_KEY" "$SSH_ADDRESS" ln -snf "/mnt/radicle/files/releases/$version" /mnt/radicle/files/releases/latest ;;
     *)
       echo "Operation aborted."
       exit 1 ;;
diff --git a/build/tag b/build/tag
index 7c8b3dbf..e3d04db7 100755
--- a/build/tag
+++ b/build/tag
@@ -19,8 +19,8 @@ if [ "$signing_key" != "$(rad self --ssh-key)" ]; then
 fi
 
 printf "\n"
-printf "Tag the above commit with \033[35m$tag\033[0m, using \033[35m$(rad self --did)\033[0m? [y/N] "
-read confirmation
+printf "Tag the above commit with \033[35m%s\033[0m, using \033[35m$(rad self --did)\033[0m? [y/N] " "$tag"
+read -r confirmation
 rad auth
 
 case "$confirmation" in
diff --git a/build/upload b/build/upload
index b8020b5f..e0b9439c 100755
--- a/build/upload
+++ b/build/upload
@@ -17,22 +17,23 @@ main() {
   destination="/mnt/radicle/files/releases/$version"
 
   # Create remote folder.
-  ssh -i $SSH_KEY $SSH_ADDRESS mkdir -p $destination
+  ssh -i "$SSH_KEY" "$SSH_ADDRESS" mkdir -p "$destination"
   # Copy files over.
-  scp -i $SSH_KEY build/artifacts/radicle-$version* $SSH_ADDRESS:$destination
-  scp -i $SSH_KEY build/artifacts/radicle.json $SSH_ADDRESS:$destination
-  scp -i $SSH_KEY build/heartwood-$version.tar.gz $SSH_ADDRESS:$destination
+  scp -i "$SSH_KEY" "build/artifacts/radicle-$version"* "$SSH_ADDRESS:$destination"
+  scp -i "$SSH_KEY" build/artifacts/radicle.json "$SSH_ADDRESS:$destination"
+  scp -i "$SSH_KEY" "build/heartwood-$version.tar.gz" "$SSH_ADDRESS:$destination"
 
-  for target in $(cat build/TARGETS); do
+  while IFS= read -r target
+  do
     archive=$destination/radicle-$version-$target.tar.xz
     symlink=$destination/radicle-$target.tar.xz
 
     echo "Creating symlinks for $target.."
 
-    ssh -i $SSH_KEY $SSH_ADDRESS ln -snf $archive $symlink
-    ssh -i $SSH_KEY $SSH_ADDRESS ln -snf $archive.sig $symlink.sig
-    ssh -i $SSH_KEY $SSH_ADDRESS ln -snf $archive.sha256 $symlink.sha256
-  done
+    ssh -i "$SSH_KEY" "$SSH_ADDRESS" ln -snf "$archive" "$symlink"
+    ssh -i "$SSH_KEY" "$SSH_ADDRESS" ln -snf "$archive.sig" "$symlink.sig"
+    ssh -i "$SSH_KEY" "$SSH_ADDRESS" ln -snf "$archive.sha256" "$symlink.sha256"
+  done < build/TARGETS
 
   # TODO(cloudhead): Don't pass `--tags` when we have canonical refs.
   echo "Pushing tags.."
diff --git a/build/version b/build/version
index 4383147c..8a8e573b 100755
--- a/build/version
+++ b/build/version
@@ -6,4 +6,4 @@ fi
 # Remove `v` prefix from version.
 version=${version#v}
 
-echo $version
+echo "$version"
diff --git a/debian/build-deb b/debian/build-deb
index 6f9ff8bc..bcd240c9 100755
--- a/debian/build-deb
+++ b/debian/build-deb
@@ -10,6 +10,7 @@ name="$(dpkg-parsechangelog -SSource)"
 version="$(dpkg-parsechangelog -SVersion)"
 
 # Get upstream version: everything before the last dash.
+# shellcheck disable=SC2001
 uv="$(echo "$version" | sed 's/-[^-]*$//')"
 orig="${name}_${uv}.orig.tar.xz"
 
diff --git a/scripts/changelog b/scripts/changelog
index 4c108ea1..324436a7 100755
--- a/scripts/changelog
+++ b/scripts/changelog
@@ -24,7 +24,7 @@ done
 
 # Current/latest tag.
 current=$(git describe --tags --match='v*' --abbrev=0)
-version=$(echo $current | sed 's/^v//')
+version=$(echo "$current" | sed 's/^v//')
 
 if [ -z "$from" ]; then
   previous="$(git describe --abbrev=0 HEAD^)"
@@ -53,14 +53,16 @@ echo "* This update is recommended for everyone. No manual intervention is requi
 echo
 echo "## Changelog"
 
-ncommits=$(git rev-list --count $previous..$current)
-ncontribs=$(git log $previous..$current --format='%ae' | sort -u | wc -l)
+range="${previous}..${current}"
+ncommits=$(git rev-list --count "$range")
+ncontribs=$(git log "$range" --format='%ae' | sort -u | wc -l)
 
 echo
 echo "This release contains $ncommits commit(s) by $ncontribs contributor(s)."
 echo
 
-git log --pretty=format:'* `%h` **%s** *<%ae>*' $previous..$current
+# shellcheck disable=SC2016
+git log --pretty=format:'* `%h` **%s** *<%ae>*' "$range"
 
 echo
 echo "## Checksums"
diff --git a/scripts/clear-refs-db.sh b/scripts/clear-refs-db.sh
index ff70af01..32fb3fd9 100755
--- a/scripts/clear-refs-db.sh
+++ b/scripts/clear-refs-db.sh
@@ -5,8 +5,8 @@ DB="$(rad path)/node/node.db"
 
 if command -v sqlite3 >/dev/null 2>&1; then
   if [ -f "$DB" ]; then
-    echo -n "Clearing 'refs' table from $DB.. "
-    sqlite3 $DB "DELETE FROM refs;"
+    printf "Clearing 'refs' table from %s.. " "$DB"
+    sqlite3 "$DB" "DELETE FROM refs;"
     echo "done."
   else
     echo "fatal: database file does not exist"
diff --git a/scripts/create-env.sh b/scripts/create-env.sh
index 79f98c39..ff467480 100755
--- a/scripts/create-env.sh
+++ b/scripts/create-env.sh
@@ -6,12 +6,12 @@ unset SSH_AGENT_PID
 
 tmp="$(mktemp -d)"
 
-export RAD_HOME=$tmp/.radicle
+export RAD_HOME="$tmp/.radicle"
 export RAD_PASSPHRASE=
 
 set -x
-mkdir $tmp/acme
-cd $tmp/acme
+mkdir "$tmp/acme"
+cd "$tmp/acme"
 echo "ACME" > README
 echo "Copyright (c) 1978-1986 ACME Corp." > COPY
 
diff --git a/scripts/delete-remote-branches.sh b/scripts/delete-remote-branches.sh
index d2d9e75e..6e12f9d3 100755
--- a/scripts/delete-remote-branches.sh
+++ b/scripts/delete-remote-branches.sh
@@ -20,7 +20,7 @@ for branch in $(git branch -r --format "%(refname:short)"); do
   # Extract the branch name without the "$remote/" prefix.
   branch=${branch#"$remote/"}
   # Never delete the master branch.
-  if [ "$branch" == "master" ]; then
+  if [ "$branch" = "master" ]; then
     continue
   fi
 
diff --git a/scripts/delete-remote-refs.sh b/scripts/delete-remote-refs.sh
index 9f93c565..d1db83f4 100755
--- a/scripts/delete-remote-refs.sh
+++ b/scripts/delete-remote-refs.sh
@@ -16,14 +16,14 @@ if [ "$REMOTE" = "$(rad self --nid)" ]; then
   exit 1
 fi
 
-cd $RAD_HOME/storage/$REPO
+cd "$RAD_HOME/storage/$REPO"
 
 refs=$(git for-each-ref --format="%(refname)")
 pattern="refs/namespaces/$2/refs/*"
 
 for ref in $refs; do
   case "$ref" in
-    $pattern)
+    "$pattern" )
       git update-ref -d "$ref"
       printf 'Deleted %s\n' "$ref"
       ;;
diff --git a/scripts/import-issue.sh b/scripts/import-issue.sh
index c210d11a..d293e72e 100755
--- a/scripts/import-issue.sh
+++ b/scripts/import-issue.sh
@@ -25,9 +25,12 @@ if ! command -v sed > /dev/null; then
 fi
 
 function removeImgTags {
-  local html="$(cat)"
-  local imgTags="$(echo "$html" | pcregrep -M '<img [^>]*>')"
+  local html
+  html="$(cat)"
+  local imgTags
+  imgTags="$(echo "$html" | pcregrep -M '<img [^>]*>')"
 
+  # shellcheck disable=SC2066
   for imgTag in "$imgTags"; do
     html="$(echo "$html" | sed -z "s@$imgTag@@")"
   done
diff --git a/scripts/patch-rebase.sh b/scripts/patch-rebase.sh
index 0c0ff6a7..8b0e4211 100755
--- a/scripts/patch-rebase.sh
+++ b/scripts/patch-rebase.sh
@@ -6,7 +6,7 @@ if [ "$#" -lt 1 ]; then
   exit 1
 fi
 
-rad patch checkout $1
+rad patch checkout "$1"
 git rebase master --autosquash
-rad patch update $1 --message "Rebased on master"
+rad patch update "$1" --message "Rebased on master"
 git checkout master
diff --git a/scripts/show-sigrefs.sh b/scripts/show-sigrefs.sh
index 3516dabc..8279502c 100755
--- a/scripts/show-sigrefs.sh
+++ b/scripts/show-sigrefs.sh
@@ -7,16 +7,18 @@ if [ "$#" -lt 2 ]; then
 fi
 
 RAD_HOME=${RAD_HOME:-"$HOME/.radicle"}
+# shellcheck disable=SC2001
 REPO=$(echo "$1" | sed 's/^rad://')
 REMOTE=$2
 
-cd $RAD_HOME/storage/$REPO
+cd "$RAD_HOME/storage/$REPO"
 
 sigrefs=$(git rev-parse "refs/namespaces/$REMOTE/refs/rad/sigrefs")
 signed=$(git show "$sigrefs:refs")
 actual=$(git for-each-ref "refs/namespaces/$REMOTE/refs/**" --format="%(objectname) %(refname)")
 
 # Strip namespace prefix.
+# shellcheck disable=SC2001
 actual=$(echo "$actual" | sed "s@refs/namespaces/$REMOTE/@@")
 # Remove `sigrefs` itself.
 actual=$(echo "$actual" | grep -v "refs/rad/sigrefs$")