diff --git a/bin/post_compile b/bin/post_compile
index 425bd8943..03388e598 100755
--- a/bin/post_compile
+++ b/bin/post_compile
@@ -5,7 +5,7 @@
 set -euo pipefail
 
 # Make the current Git revision accessible at <site-root>/revision.txt
-echo $SOURCE_VERSION > ui/revision.txt
+echo "$SOURCE_VERSION" > ui/revision.txt
 
 # Create a `dist/` directory containing built/minified versions of the `ui/` assets.
 # Uses the node binaries/packages installed by the nodejs buildpack previously.
diff --git a/bin/run_celery_worker b/bin/run_celery_worker
index cf4f2b343..7078ce954 100755
--- a/bin/run_celery_worker
+++ b/bin/run_celery_worker
@@ -4,7 +4,7 @@
 set -euo pipefail
 
 SRC_DIR=$(dirname "$(dirname "${BASH_SOURCE[0]}")")
-cd $SRC_DIR
+cd "$SRC_DIR"
 
 source /etc/profile.d/treeherder.sh
 
diff --git a/bin/run_celery_worker_buildapi b/bin/run_celery_worker_buildapi
index 36c409c78..01746ea1e 100755
--- a/bin/run_celery_worker_buildapi
+++ b/bin/run_celery_worker_buildapi
@@ -4,7 +4,7 @@
 set -euo pipefail
 
 SRC_DIR=$(dirname "$(dirname "${BASH_SOURCE[0]}")")
-cd $SRC_DIR
+cd "$SRC_DIR"
 
 source /etc/profile.d/treeherder.sh
 
diff --git a/bin/run_celery_worker_hp b/bin/run_celery_worker_hp
index 5fbbc01fd..cc10ae073 100755
--- a/bin/run_celery_worker_hp
+++ b/bin/run_celery_worker_hp
@@ -4,7 +4,7 @@
 set -euo pipefail
 
 SRC_DIR=$(dirname "$(dirname "${BASH_SOURCE[0]}")")
-cd $SRC_DIR
+cd "$SRC_DIR"
 
 source /etc/profile.d/treeherder.sh
 
diff --git a/bin/run_celery_worker_log_parser b/bin/run_celery_worker_log_parser
index fa7f423ec..791816d30 100755
--- a/bin/run_celery_worker_log_parser
+++ b/bin/run_celery_worker_log_parser
@@ -4,7 +4,7 @@
 set -euo pipefail
 
 SRC_DIR=$(dirname "$(dirname "${BASH_SOURCE[0]}")")
-cd $SRC_DIR
+cd "$SRC_DIR"
 
 source /etc/profile.d/treeherder.sh
 
diff --git a/bin/run_celery_worker_pushlog b/bin/run_celery_worker_pushlog
index 44454e392..7fd17788e 100755
--- a/bin/run_celery_worker_pushlog
+++ b/bin/run_celery_worker_pushlog
@@ -4,7 +4,7 @@
 set -euo pipefail
 
 SRC_DIR=$(dirname "$(dirname "${BASH_SOURCE[0]}")")
-cd $SRC_DIR
+cd "$SRC_DIR"
 
 source /etc/profile.d/treeherder.sh
 
diff --git a/bin/run_celerybeat b/bin/run_celerybeat
index 0310a00ed..d018109e1 100755
--- a/bin/run_celerybeat
+++ b/bin/run_celerybeat
@@ -4,7 +4,7 @@
 set -euo pipefail
 
 SRC_DIR=$(dirname "$(dirname "${BASH_SOURCE[0]}")")
-cd $SRC_DIR
+cd "$SRC_DIR"
 
 source /etc/profile.d/treeherder.sh
 
diff --git a/bin/run_gunicorn b/bin/run_gunicorn
index 296cbc37f..9e394a02a 100755
--- a/bin/run_gunicorn
+++ b/bin/run_gunicorn
@@ -4,7 +4,7 @@
 set -euo pipefail
 
 SRC_DIR=$(dirname "$(dirname "${BASH_SOURCE[0]}")")
-cd $SRC_DIR
+cd "$SRC_DIR"
 
 source /etc/profile.d/treeherder.sh
 
diff --git a/bin/run_read_pulse_jobs b/bin/run_read_pulse_jobs
index 0f5549530..108565a01 100755
--- a/bin/run_read_pulse_jobs
+++ b/bin/run_read_pulse_jobs
@@ -4,7 +4,7 @@
 set -euo pipefail
 
 SRC_DIR=$(dirname "$(dirname "${BASH_SOURCE[0]}")")
-cd $SRC_DIR
+cd "$SRC_DIR"
 
 source /etc/profile.d/treeherder.sh
 
diff --git a/bin/run_read_pulse_pushes b/bin/run_read_pulse_pushes
index cbd28557f..aa23afb80 100755
--- a/bin/run_read_pulse_pushes
+++ b/bin/run_read_pulse_pushes
@@ -4,7 +4,7 @@
 set -euo pipefail
 
 SRC_DIR=$(dirname "$(dirname "${BASH_SOURCE[0]}")")
-cd $SRC_DIR
+cd "$SRC_DIR"
 
 source /etc/profile.d/treeherder.sh
 
diff --git a/vagrant/setup.sh b/vagrant/setup.sh
index 2983c6ea6..f130e4214 100644
--- a/vagrant/setup.sh
+++ b/vagrant/setup.sh
@@ -83,7 +83,7 @@ if ! cmp -s vagrant/mysql.cnf /etc/mysql/conf.d/treeherder.cnf; then
     sudo systemctl restart mysql.service
 fi
 
-if [[ "$($PYTHON_DIR/bin/python --version 2>&1)" != *"$PYTHON_VERSION" ]]; then
+if [[ "$("${PYTHON_DIR}/bin/python" --version 2>&1)" != *"$PYTHON_VERSION" ]]; then
     echo "-----> Installing Python"
     rm -rf "$PYTHON_DIR"
     mkdir -p "$PYTHON_DIR"
@@ -91,7 +91,7 @@ if [[ "$($PYTHON_DIR/bin/python --version 2>&1)" != *"$PYTHON_VERSION" ]]; then
     curl -sSf "https://lang-python.s3.amazonaws.com/heroku-16/runtimes/python-$PYTHON_VERSION.tar.gz" | tar -xz -C "$PYTHON_DIR"
 fi
 
-if [[ "$($PYTHON_DIR/bin/pip --version 2>&1)" != *"$PIP_VERSION"* ]]; then
+if [[ "$("${PYTHON_DIR}/bin/pip" --version 2>&1)" != *"$PIP_VERSION"* ]]; then
     echo "-----> Installing pip"
     curl -sSf https://bootstrap.pypa.io/get-pip.py | python - "pip==$PIP_VERSION"
 fi