diff --git a/.ci/check-python-dists.sh b/.ci/check-python-dists.sh
index 020f02879..c9c4eb6d1 100644
--- a/.ci/check-python-dists.sh
+++ b/.ci/check-python-dists.sh
@@ -16,11 +16,11 @@ pip install \
     twine || exit 1
 
 echo "twine check..."
-twine check --strict ${DIST_DIR}/* || exit 1
+twine check --strict "$(echo "${DIST_DIR}"/*)" || exit 1
 
 if { test "${TASK}" = "bdist" || test "${METHOD}" = "wheel"; }; then
     echo "check-wheel-contents..."
-    check-wheel-contents ${DIST_DIR}/*.whl || exit 1
+    check-wheel-contents "$(echo "${DIST_DIR}"/*.whl)" || exit 1
 fi
 
 PY_MINOR_VER=$(python -c "import sys; print(sys.version_info.minor)")
@@ -34,7 +34,7 @@ if [ "$PY_MINOR_VER" -gt 7 ]; then
             --ignore 'distro-too-large-compressed' \
             --max-allowed-size-uncompressed '100M' \
             --max-allowed-files 800 \
-            "$(echo ${DIST_DIR}/*)" || exit 1
+            "$(echo "${DIST_DIR}"/*)" || exit 1
     elif { test "$(uname -m)" = "aarch64"; }; then
         pydistcheck \
             --inspect \
@@ -42,14 +42,14 @@ if [ "$PY_MINOR_VER" -gt 7 ]; then
             --max-allowed-size-compressed '5M' \
             --max-allowed-size-uncompressed '15M' \
             --max-allowed-files 800 \
-            "$(echo ${DIST_DIR}/*)" || exit 1
+            "$(echo "${DIST_DIR}"/*)" || exit 1
     else
         pydistcheck \
             --inspect \
             --max-allowed-size-compressed '5M' \
             --max-allowed-size-uncompressed '15M' \
             --max-allowed-files 800 \
-            "$(echo ${DIST_DIR}/*)" || exit 1
+            "$(echo "${DIST_DIR}"/*)" || exit 1
     fi
 else
     echo "skipping pydistcheck (does not support Python 3.${PY_MINOR_VER})"
diff --git a/.ci/lint-cpp.sh b/.ci/lint-cpp.sh
index dae0e1e93..2bd3e487c 100755
--- a/.ci/lint-cpp.sh
+++ b/.ci/lint-cpp.sh
@@ -10,14 +10,15 @@ cpplint \
 echo "done running cpplint"
 
 echo "running cmakelint"
-cmake_files=$(
-    find . -name CMakeLists.txt -o -path "./cmake/*.cmake" \
-    | grep -v external_libs
-)
-cmakelint \
+find \
+    . \
+    -type f \
+    \( -name CMakeLists.txt -o -path "./cmake/*.cmake" \) \
+    -not -path './external_libs/*' \
+    -exec cmakelint \
     --linelength=120 \
     --filter=-convention/filename,-package/stdargs,-readability/wonkycase \
-    ${cmake_files} \
+    {} \+ \
 || exit 1
 echo "done running cmakelint"
 
diff --git a/.ci/rerun-workflow.sh b/.ci/rerun-workflow.sh
index 757bfdab9..b9453f2b1 100755
--- a/.ci/rerun-workflow.sh
+++ b/.ci/rerun-workflow.sh
@@ -35,13 +35,13 @@ runs=$(
     "${GITHUB_API_URL}/repos/microsoft/LightGBM/actions/workflows/${workflow_id}/runs?event=pull_request&branch=${pr_branch}" | \
   jq '.workflow_runs'
 )
-runs=$(echo $runs | jq --arg pr_number "$pr_number" --arg pr_branch "$pr_branch" 'map(select(.event == "pull_request" and ((.pull_requests | length) != 0 and (.pull_requests[0].number | tostring) == $pr_number or .head_branch == $pr_branch)))')
-runs=$(echo $runs | jq 'sort_by(.run_number) | reverse')
+runs=$(echo "${runs}" | jq --arg pr_number "${pr_number}" --arg pr_branch "${pr_branch}" 'map(select(.event == "pull_request" and ((.pull_requests | length) != 0 and (.pull_requests[0].number | tostring) == $pr_number or .head_branch == $pr_branch)))')
+runs=$(echo "${runs}" | jq 'sort_by(.run_number) | reverse')
 
-if [[ $(echo $runs | jq 'length') -gt 0 ]]; then
+if [[ $(echo "${runs}" | jq 'length') -gt 0 ]]; then
   curl -sL \
     -X POST \
     -H "Accept: application/vnd.github.v3+json" \
     -H "Authorization: token $SECRETS_WORKFLOW" \
-    "${GITHUB_API_URL}/repos/microsoft/LightGBM/actions/runs/$(echo $runs | jq '.[0].id')/rerun"
+    "${GITHUB_API_URL}/repos/microsoft/LightGBM/actions/runs/$(echo "${runs}" | jq '.[0].id')/rerun"
 fi
diff --git a/.ci/set-commit-status.sh b/.ci/set-commit-status.sh
index 8682d35e5..cdce35cb4 100755
--- a/.ci/set-commit-status.sh
+++ b/.ci/set-commit-status.sh
@@ -39,9 +39,9 @@ sha=$3
 
 data=$(
   jq -n \
-    --arg state $status \
+    --arg state "${status}" \
     --arg url "${GITHUB_SERVER_URL}/microsoft/LightGBM/actions/runs/${GITHUB_RUN_ID}" \
-    --arg name "$name" \
+    --arg name "${name}" \
     '{"state":$state,"target_url":$url,"context":$name}'
 )
 
diff --git a/.ci/trigger-dispatch-run.sh b/.ci/trigger-dispatch-run.sh
index 7d7bfcad3..0a19647a0 100755
--- a/.ci/trigger-dispatch-run.sh
+++ b/.ci/trigger-dispatch-run.sh
@@ -37,9 +37,9 @@ pr=$(
 data=$(
   jq -n \
     --arg event_type "$dispatch_name" \
-    --arg pr_number "$(echo $pr | jq '.number')" \
-    --arg pr_sha "$(echo $pr | jq '.head.sha')" \
-    --arg pr_branch "$(echo $pr | jq '.head.ref')" \
+    --arg pr_number "$(echo "$pr" | jq '.number')" \
+    --arg pr_sha "$(echo "$pr" | jq '.head.sha')" \
+    --arg pr_branch "$(echo "$pr" | jq '.head.ref')" \
     --arg comment_number "$comment_id" \
     '{"event_type":$event_type,"client_payload":{"pr_number":$pr_number,"pr_sha":$pr_sha,"pr_branch":$pr_branch,"comment_number":$comment_number}}'
 )
diff --git a/R-package/recreate-configure.sh b/R-package/recreate-configure.sh
index 9cf7c5e41..5fcda5b14 100755
--- a/R-package/recreate-configure.sh
+++ b/R-package/recreate-configure.sh
@@ -8,7 +8,7 @@ AUTOCONF_VERSION=$(cat R-package/AUTOCONF_UBUNTU_VERSION)
 
 # R packages cannot have versions like 3.0.0rc1, but
 # 3.0.0-1 is acceptable
-LGB_VERSION=$(cat VERSION.txt | sed "s/rc/-/g")
+LGB_VERSION=$(sed "s/rc/-/g" < VERSION.txt)
 
 # this script changes configure.ac. Copying to a temporary file
 # so changes to configure.ac don't get committed in git
@@ -20,7 +20,7 @@ apt update
 apt-get install \
     --no-install-recommends \
     -y \
-        autoconf=${AUTOCONF_VERSION}
+        autoconf="${AUTOCONF_VERSION}"
 
 cd R-package
 
diff --git a/docs/build-docs.sh b/docs/build-docs.sh
index d4187bc69..682c800b5 100644
--- a/docs/build-docs.sh
+++ b/docs/build-docs.sh
@@ -8,10 +8,10 @@ export PATH="${CONDA}/bin:${PATH}"
 
 curl \
     -sL \
-    -o ${HOME}/miniforge.sh \
+    -o "${HOME}/miniforge.sh" \
     https://github.com/conda-forge/miniforge/releases/latest/download/Miniforge3-Linux-x86_64.sh
 
-/bin/bash ${HOME}/miniforge.sh -b -p ${CONDA}
+/bin/bash "${HOME}/miniforge.sh" -b -p "${CONDA}"
 
 conda config --set always_yes yes --set changeps1 no
 conda update -q -y conda
@@ -20,6 +20,7 @@ conda env create \
     --name docs-env \
     --file env.yml || exit 1
 
+# shellcheck disable=SC1091
 source activate docs-env
 make clean html || exit 1