diff --git a/contrib/depdot.sh b/contrib/depdot.sh
index c065ea57..cb2d3a2f 100755
--- a/contrib/depdot.sh
+++ b/contrib/depdot.sh
@@ -10,7 +10,7 @@
 shopt -s nullglob
 
 
-pushd "$(dirname "$0")/.." >/dev/null
+pushd "$(dirname "$0")/.." >/dev/null || exit
 
 
 escape_name() {
@@ -40,6 +40,6 @@ for makefile in ./package/*/Makefile; do
 	done
 done | sort -u
 
-popd >/dev/null
+popd >/dev/null || exit
 
 echo '}'
diff --git a/contrib/lsupgrade.sh b/contrib/lsupgrade.sh
index eca7a852..4ca33b79 100755
--- a/contrib/lsupgrade.sh
+++ b/contrib/lsupgrade.sh
@@ -25,12 +25,12 @@ else
 fi
 
 
-pushd "$(dirname "$0")/.." >/dev/null
+pushd "$(dirname "$0")/.." >/dev/null || exit
 
-find ./package packages -name Makefile | while read makefile; do
+find ./package packages -name Makefile | while read -r makefile; do
 	dir="$(dirname "$makefile")"
 
-	pushd "$dir" >/dev/null
+	pushd "$dir" >/dev/null || exit
 
 	repo="$(dirname "$dir" | cut -d/ -f 2)"
 	dirname="$(dirname "$dir" | cut -d/ -f 3-)"
@@ -42,7 +42,7 @@ find ./package packages -name Makefile | while read makefile; do
 	for file in "${SUFFIX2}"/*; do
 		echo "${GREEN}$(basename "${file}")${RESET}" "(${BLUE}${repo}${RESET}/${dirname}${dirname:+/}${RED}${package}${RESET}/${SUFFIX2})"
 	done
-	popd >/dev/null
+	popd >/dev/null || exit
 done | sort
 
-popd >/dev/null
+popd >/dev/null || exit
diff --git a/contrib/sign.sh b/contrib/sign.sh
index c04854e8..d88bc345 100755
--- a/contrib/sign.sh
+++ b/contrib/sign.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-if [ $# -ne 2 -o "-h" = "$1" -o "--help" = "$1" -o ! -r "$1" -o ! -r "$2" ]; then
+if [ $# -ne 2 ] || [ "-h" = "$1" ] || [ "--help" = "$1" ] || [ ! -r "$1" ] || [ ! -r "$2" ]; then
 	cat <<EOHELP
 Usage: $0 <secret> <manifest>
 
diff --git a/contrib/sigtest.sh b/contrib/sigtest.sh
index 2a0faf2c..0fa19f90 100755
--- a/contrib/sigtest.sh
+++ b/contrib/sigtest.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-if [ $# -eq 0 -o "-h" = "$1" -o "-help" = "$1" -o "--help" = "$1" ]; then
+if [ $# -eq 0 ] || [ "-h" = "$1" ] || [ "-help" = "$1" ] || [ "--help" = "$1" ]; then
     cat <<EOHELP
 Usage: $0 <public> <signed manifest>
 
@@ -27,7 +27,7 @@ awk "BEGIN    { sep=0 }
                 else       print > \"$lower\"}" \
     "$manifest"
 
-while read line
+while read -r line
 do
     if ecdsaverify -s "$line" -p "$public" "$upper"; then
         ret=0
diff --git a/package/gluon-core/files/lib/netifd/proto/gluon_wired.sh b/package/gluon-core/files/lib/netifd/proto/gluon_wired.sh
index 0778b354..31ad5342 100755
--- a/package/gluon-core/files/lib/netifd/proto/gluon_wired.sh
+++ b/package/gluon-core/files/lib/netifd/proto/gluon_wired.sh
@@ -16,7 +16,7 @@ xor2() {
 
 interface_linklocal() {
         local macaddr="$(ubus call network.device status '{"name": "'"$1"'"}' | jsonfilter -e '@.macaddr')"
-        local oldIFS="$IFS"; IFS=':'; set -- $macaddr; IFS="$oldIFS"
+        local oldIFS="$IFS"; IFS=':'; set -- "$macaddr"; IFS="$oldIFS"
 
         echo "fe80::$(xor2 "$1")$2:$3ff:fe$4:$5$6"
 }
diff --git a/package/gluon-setup-mode/files/etc/hotplug.d/button/50-gluon-setup-mode b/package/gluon-setup-mode/files/etc/hotplug.d/button/50-gluon-setup-mode
index 3a3cb20f..314f8a43 100755
--- a/package/gluon-setup-mode/files/etc/hotplug.d/button/50-gluon-setup-mode
+++ b/package/gluon-setup-mode/files/etc/hotplug.d/button/50-gluon-setup-mode
@@ -12,7 +12,7 @@ wait_setup_mode() {
 }
 
 
-if [ "$BUTTON" = wps -o "$BUTTON" = reset -o "$BUTTON" = phone ]; then
+if [ "$BUTTON" = wps ] || [ "$BUTTON" = reset ] || [ "$BUTTON" = phone ]; then
 	case "$ACTION" in
 		pressed)
 			wait_setup_mode &
@@ -21,7 +21,7 @@ if [ "$BUTTON" = wps -o "$BUTTON" = reset -o "$BUTTON" = phone ]; then
 			;;
 		released)
 			if [ -r /tmp/.wait_setup_mode ]; then
-				kill $(cat /tmp/.wait_setup_mode)
+				kill "$(cat /tmp/.wait_setup_mode)"
 				rm /tmp/.wait_setup_mode
 			fi
 			;;
diff --git a/package/gluon-setup-mode/files/lib/preinit/90_setup_mode b/package/gluon-setup-mode/files/lib/preinit/90_setup_mode
index 396b4f76..c38ac281 100644
--- a/package/gluon-setup-mode/files/lib/preinit/90_setup_mode
+++ b/package/gluon-setup-mode/files/lib/preinit/90_setup_mode
@@ -5,7 +5,7 @@ setup_mode_enable() {
 	local enabled="$(uci -q get 'gluon-setup-mode.@setup_mode[0].enabled')"
 	local configured="$(uci -q get 'gluon-setup-mode.@setup_mode[0].configured')"
 
-	if [ "$enabled" = 1 -o "$configured" != 1 ]; then
+	if [ "$enabled" = 1 ] || [ "$configured" != 1 ]; then
 		echo '/lib/gluon/setup-mode/rc.d' > /tmp/rc_d_path
 	fi
 }
diff --git a/scripts/features.sh b/scripts/features.sh
index 2d35fdee..f3a25d9e 100755
--- a/scripts/features.sh
+++ b/scripts/features.sh
@@ -34,7 +34,7 @@ sanitize() {
 vars=
 
 for feature in $1; do
-	if [ "$(type -t gluon_feature_nodefault_${feature})" != 'function' ]; then
+	if [ "$(type -t gluon_feature_nodefault_"${feature}")" != 'function' ]; then
 		echo "gluon-${feature}"
 	fi
 
@@ -57,7 +57,7 @@ packages() {
 
 	# Let will return false when the result of the passed expression is 0,
 	# so we always add 1. This way false is only returned for syntax errors.
-	local ret="$(env -i $vars bash --norc -ec "let _result_='1+($cond)'; echo -n \"\$_result_\"" 2>/dev/null)"
+	local ret="$(env -i "$vars" bash --norc -ec "let _result_='1+($cond)'; echo -n \"\$_result_\"" 2>/dev/null)"
 	case "$ret" in
 	2)
 		for pkg in "$@"; do
diff --git a/scripts/filesize.sh b/scripts/filesize.sh
index 1a6ea4dd..b5045df2 100755
--- a/scripts/filesize.sh
+++ b/scripts/filesize.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 check_command() {
-	which "$1" >/dev/null 2>&1
+	command -v "$1" >/dev/null 2>&1
 }
 
 if check_command gnustat; then
diff --git a/scripts/patch.sh b/scripts/patch.sh
index 082ca1fc..9269ffb5 100755
--- a/scripts/patch.sh
+++ b/scripts/patch.sh
@@ -3,7 +3,7 @@
 set -e
 shopt -s nullglob
 
-[ "$GLUON_TMPDIR" -a "$GLUON_PATCHESDIR" ] || exit 1
+[ "$GLUON_TMPDIR" ] && [ "$GLUON_PATCHESDIR" ] || exit 1
 
 . scripts/modules.sh
 
diff --git a/scripts/sha256sum.sh b/scripts/sha256sum.sh
index e4f6f3e5..99d97acd 100755
--- a/scripts/sha256sum.sh
+++ b/scripts/sha256sum.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 check_command() {
-	which "$1" >/dev/null 2>&1
+	command -v "$1" >/dev/null 2>&1
 }
 
 if check_command sha256sum; then
diff --git a/scripts/sha512sum.sh b/scripts/sha512sum.sh
index d9fd544d..cb4b07e4 100755
--- a/scripts/sha512sum.sh
+++ b/scripts/sha512sum.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 check_command() {
-	which "$1" >/dev/null 2>&1
+	command -v "$1" >/dev/null 2>&1
 }
 
 if check_command sha512sum; then
diff --git a/scripts/update-patches.sh b/scripts/update-patches.sh
index 933d20ac..067e1e51 100755
--- a/scripts/update-patches.sh
+++ b/scripts/update-patches.sh
@@ -13,13 +13,13 @@ GLUONDIR="$(pwd)"
 for module in $GLUON_MODULES; do
 	echo "--- Updating patches for module '$module' ---"
 
-	rm -rf "${GLUON_PATCHESDIR}/$module"
+	rm -rf "${GLUON_PATCHESDIR:?}/$module"
 
 	cd "$GLUONDIR"/"$module"
 
 	n=0
 	for commit in $(git rev-list --reverse --no-merges base..patched); do
-		let n=n+1
+		(( n++ ))
 		mkdir -p "${GLUON_PATCHESDIR}/$module"
 		git -c core.abbrev=40 show --pretty=format:'From: %an <%ae>%nDate: %aD%nSubject: %B' --no-renames --binary "$commit" > "${GLUON_PATCHESDIR}/$module/$(printf '%04u' $n)-$(git show -s --pretty=format:%f "$commit").patch"
 	done
diff --git a/scripts/update.sh b/scripts/update.sh
index afea8e71..a5ac845d 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -10,9 +10,9 @@ GLUONDIR="$(pwd)"
 for module in $GLUON_MODULES; do
 	echo "--- Updating module '$module' ---"
 	var=$(echo "$module" | tr '[:lower:]/' '[:upper:]_')
-	eval repo=\${${var}_REPO}
-	eval branch=\${${var}_BRANCH}
-	eval commit=\${${var}_COMMIT}
+	eval repo=\$\{"${var}"_REPO\}
+	eval branch=\$\{"${var}"_BRANCH\}
+	eval commit=\$\{"${var}"_COMMIT\}
 
 	mkdir -p "$GLUONDIR/$module"
 	cd "$GLUONDIR/$module"