diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 7752ee2ce..e9a820d72 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -106,41 +106,6 @@
             enable = true;
             excludes = [
               # We haven't linted these files yet
-              ''^tests/functional/flakes/prefetch\.sh$''
-              ''^tests/functional/flakes/run\.sh$''
-              ''^tests/functional/flakes/show\.sh$''
-              ''^tests/functional/formatter\.sh$''
-              ''^tests/functional/formatter\.simple\.sh$''
-              ''^tests/functional/gc-auto\.sh$''
-              ''^tests/functional/gc-concurrent\.builder\.sh$''
-              ''^tests/functional/gc-concurrent\.sh$''
-              ''^tests/functional/gc-concurrent2\.builder\.sh$''
-              ''^tests/functional/gc-non-blocking\.sh$''
-              ''^tests/functional/hash-convert\.sh$''
-              ''^tests/functional/impure-derivations\.sh$''
-              ''^tests/functional/impure-eval\.sh$''
-              ''^tests/functional/install-darwin\.sh$''
-              ''^tests/functional/legacy-ssh-store\.sh$''
-              ''^tests/functional/linux-sandbox\.sh$''
-              ''^tests/functional/logging\.sh$''
-              ''^tests/functional/misc\.sh$''
-              ''^tests/functional/multiple-outputs\.sh$''
-              ''^tests/functional/nested-sandboxing\.sh$''
-              ''^tests/functional/nested-sandboxing/command\.sh$''
-              ''^tests/functional/nix-build\.sh$''
-              ''^tests/functional/nix-channel\.sh$''
-              ''^tests/functional/nix-collect-garbage-d\.sh$''
-              ''^tests/functional/nix-copy-ssh-common\.sh$''
-              ''^tests/functional/nix-copy-ssh-ng\.sh$''
-              ''^tests/functional/nix-copy-ssh\.sh$''
-              ''^tests/functional/nix-daemon-untrusting\.sh$''
-              ''^tests/functional/nix-profile\.sh$''
-              ''^tests/functional/nix-shell\.sh$''
-              ''^tests/functional/nix_path\.sh$''
-              ''^tests/functional/optimise-store\.sh$''
-              ''^tests/functional/output-normalization\.sh$''
-              ''^tests/functional/parallel\.builder\.sh$''
-              ''^tests/functional/parallel\.sh$''
               ''^tests/functional/pass-as-file\.sh$''
               ''^tests/functional/path-from-hash-part\.sh$''
               ''^tests/functional/path-info\.sh$''
diff --git a/tests/functional/flakes/prefetch.sh b/tests/functional/flakes/prefetch.sh
index a451b7120..999270c1e 100755
--- a/tests/functional/flakes/prefetch.sh
+++ b/tests/functional/flakes/prefetch.sh
@@ -3,6 +3,6 @@
 source common.sh
 
 # Test symlinks in zip files (#10649).
-path=$(nix flake prefetch --json file://$(pwd)/tree.zip | jq -r .storePath)
-[[ $(cat $path/foo) = foo ]]
-[[ $(readlink $path/bar) = foo ]]
+path=$(nix flake prefetch --json file://"$(pwd)"/tree.zip | jq -r .storePath)
+[[ $(cat "$path"/foo) = foo ]]
+[[ $(readlink "$path"/bar) = foo ]]
diff --git a/tests/functional/flakes/run.sh b/tests/functional/flakes/run.sh
index 0a2947825..107b3dfb8 100755
--- a/tests/functional/flakes/run.sh
+++ b/tests/functional/flakes/run.sh
@@ -5,10 +5,10 @@ source ../common.sh
 TODO_NixOS
 
 clearStore
-rm -rf $TEST_HOME/.cache $TEST_HOME/.config $TEST_HOME/.local
+rm -rf "$TEST_HOME"/.cache "$TEST_HOME"/.config "$TEST_HOME"/.local
 
-cp ../shell-hello.nix "${config_nix}" $TEST_HOME
-cd $TEST_HOME
+cp ../shell-hello.nix "${config_nix}" "$TEST_HOME"
+cd "$TEST_HOME"
 
 cat <<EOF > flake.nix
 {
@@ -34,8 +34,8 @@ nix run --no-write-lock-file .#pkgAsPkg
 # For instance, we might set an environment variable temporarily to affect some
 # initialization or whatnot, but this must not leak into the environment of the
 # command being run.
-env > $TEST_ROOT/expected-env
-nix run -f shell-hello.nix env > $TEST_ROOT/actual-env
+env > "$TEST_ROOT"/expected-env
+nix run -f shell-hello.nix env > "$TEST_ROOT"/actual-env
 # Remove/reset variables we expect to be different.
 # - PATH is modified by nix shell
 # - we unset TMPDIR on macOS if it contains /var/folders. bad. https://github.com/NixOS/nix/issues/7731
@@ -48,12 +48,12 @@ sed -i \
   -e '/^TMPDIR=\/var\/folders\/.*/d' \
   -e '/^__CF_USER_TEXT_ENCODING=.*$/d' \
   -e '/^__LLVM_PROFILE_RT_INIT_ONCE=.*$/d' \
-  $TEST_ROOT/expected-env $TEST_ROOT/actual-env
-sort $TEST_ROOT/expected-env | uniq > $TEST_ROOT/expected-env.sorted
+  "$TEST_ROOT"/expected-env "$TEST_ROOT"/actual-env
+sort "$TEST_ROOT"/expected-env | uniq > "$TEST_ROOT"/expected-env.sorted
 # nix run appears to clear _. I don't understand why. Is this ok?
-echo "_=..." >> $TEST_ROOT/actual-env
-sort $TEST_ROOT/actual-env | uniq > $TEST_ROOT/actual-env.sorted
-diff $TEST_ROOT/expected-env.sorted $TEST_ROOT/actual-env.sorted
+echo "_=..." >> "$TEST_ROOT"/actual-env
+sort "$TEST_ROOT"/actual-env | uniq > "$TEST_ROOT"/actual-env.sorted
+diff "$TEST_ROOT"/expected-env.sorted "$TEST_ROOT"/actual-env.sorted
 
 clearStore
 
diff --git a/tests/functional/flakes/show.sh b/tests/functional/flakes/show.sh
index 7fcc6aca9..a08db115a 100755
--- a/tests/functional/flakes/show.sh
+++ b/tests/functional/flakes/show.sh
@@ -12,6 +12,7 @@ pushd "$flakeDir"
 # By default: Only show the packages content for the current system and no
 # legacyPackages at all
 nix flake show --json > show-output.json
+# shellcheck disable=SC2016
 nix eval --impure --expr '
 let show_output = builtins.fromJSON (builtins.readFile ./show-output.json);
 in
@@ -23,6 +24,7 @@ true
 
 # With `--all-systems`, show the packages for all systems
 nix flake show --json --all-systems > show-output.json
+# shellcheck disable=SC2016
 nix eval --impure --expr '
 let show_output = builtins.fromJSON (builtins.readFile ./show-output.json);
 in
@@ -33,6 +35,7 @@ true
 
 # With `--legacy`, show the legacy packages
 nix flake show --json --legacy > show-output.json
+# shellcheck disable=SC2016
 nix eval --impure --expr '
 let show_output = builtins.fromJSON (builtins.readFile ./show-output.json);
 in
@@ -80,6 +83,7 @@ cat >flake.nix <<EOF
 }
 EOF
 nix flake show --json --legacy --all-systems > show-output.json
+# shellcheck disable=SC2016
 nix eval --impure --expr '
 let show_output = builtins.fromJSON (builtins.readFile ./show-output.json);
 in
@@ -91,11 +95,12 @@ true
 # Test that nix flake show doesn't fail if one of the outputs contains
 # an IFD
 popd
-writeIfdFlake $flakeDir
-pushd $flakeDir
+writeIfdFlake "$flakeDir"
+pushd "$flakeDir"
 
 
 nix flake show --json > show-output.json
+# shellcheck disable=SC2016
 nix eval --impure --expr '
 let show_output = builtins.fromJSON (builtins.readFile ./show-output.json);
 in
diff --git a/tests/functional/formatter.sh b/tests/functional/formatter.sh
index 6631dd6b8..03b31708d 100755
--- a/tests/functional/formatter.sh
+++ b/tests/functional/formatter.sh
@@ -16,6 +16,7 @@ nix fmt --help | grep "reformat your code"
 nix fmt run --help | grep "reformat your code"
 nix fmt build --help | grep "build"
 
+# shellcheck disable=SC2154
 cat << EOF > flake.nix
 {
   outputs = _: {
diff --git a/tests/functional/gc-auto.sh b/tests/functional/gc-auto.sh
index efe3e4b2b..ea877f27f 100755
--- a/tests/functional/gc-auto.sh
+++ b/tests/functional/gc-auto.sh
@@ -2,22 +2,26 @@
 
 source common.sh
 
+# shellcheck disable=SC1111
 needLocalStore "“min-free” and “max-free” are daemon options"
 
 TODO_NixOS
 
 clearStore
 
+# shellcheck disable=SC2034
 garbage1=$(nix store add-path --name garbage1 ./nar-access.sh)
+# shellcheck disable=SC2034
 garbage2=$(nix store add-path --name garbage2 ./nar-access.sh)
+# shellcheck disable=SC2034
 garbage3=$(nix store add-path --name garbage3 ./nar-access.sh)
 
-ls -l $garbage3
-POSIXLY_CORRECT=1 du $garbage3
+ls -l "$garbage3"
+POSIXLY_CORRECT=1 du "$garbage3"
 
 fake_free=$TEST_ROOT/fake-free
 export _NIX_TEST_FREE_SPACE_FILE=$fake_free
-echo 1100 > $fake_free
+echo 1100 > "$fake_free"
 
 fifoLock=$TEST_ROOT/fifoLock
 mkfifo "$fifoLock"
@@ -65,11 +69,11 @@ with import ${config_nix}; mkDerivation {
 EOF
 )
 
-nix build --impure -v -o $TEST_ROOT/result-A -L --expr "$expr" \
+nix build --impure -v -o "$TEST_ROOT"/result-A -L --expr "$expr" \
     --min-free 1K --max-free 2K --min-free-check-interval 1 &
 pid1=$!
 
-nix build --impure -v -o $TEST_ROOT/result-B -L --expr "$expr2" \
+nix build --impure -v -o "$TEST_ROOT"/result-B -L --expr "$expr2" \
     --min-free 1K --max-free 2K --min-free-check-interval 1 &
 pid2=$!
 
@@ -77,9 +81,9 @@ pid2=$!
 # If the first build fails, we need to postpone the failure to still allow
 # the second one to finish
 wait "$pid1" || FIRSTBUILDSTATUS=$?
-echo "unlock" > $fifoLock
-( exit ${FIRSTBUILDSTATUS:-0} )
+echo "unlock" > "$fifoLock"
+( exit "${FIRSTBUILDSTATUS:-0}" )
 wait "$pid2"
 
-[[ foo = $(cat $TEST_ROOT/result-A/bar) ]]
-[[ foo = $(cat $TEST_ROOT/result-B/bar) ]]
+[[ foo = $(cat "$TEST_ROOT"/result-A/bar) ]]
+[[ foo = $(cat "$TEST_ROOT"/result-B/bar) ]]
diff --git a/tests/functional/gc-concurrent.builder.sh b/tests/functional/gc-concurrent.builder.sh
index bb6dcd4cf..b3c7abeb1 100644
--- a/tests/functional/gc-concurrent.builder.sh
+++ b/tests/functional/gc-concurrent.builder.sh
@@ -1,16 +1,19 @@
+# shellcheck shell=bash
+# shellcheck disable=SC2154
 echo "Build started" > "$lockFifo"
 
-mkdir $out
-echo $(cat $input1/foo)$(cat $input2/bar) > $out/foobar
+# shellcheck disable=SC2154
+mkdir "$out"
+echo "$(cat "$input1"/foo)""$(cat "$input2"/bar)" > "$out"/foobar
 
 # Wait for someone to write on the fifo
 cat "$lockFifo"
 
 # $out should not have been GC'ed while we were sleeping, but just in
 # case...
-mkdir -p $out
+mkdir -p "$out"
 
 # Check that the GC hasn't deleted the lock on our output.
 test -e "$out.lock"
 
-ln -s $input2 $out/input-2
+ln -s "$input2" "$out"/input-2
diff --git a/tests/functional/gc-concurrent.sh b/tests/functional/gc-concurrent.sh
index df180b14f..dcfcea3e9 100755
--- a/tests/functional/gc-concurrent.sh
+++ b/tests/functional/gc-concurrent.sh
@@ -10,54 +10,58 @@ lockFifo1=$TEST_ROOT/test1.fifo
 mkfifo "$lockFifo1"
 
 drvPath1=$(nix-instantiate gc-concurrent.nix -A test1 --argstr lockFifo "$lockFifo1")
-outPath1=$(nix-store -q $drvPath1)
+outPath1=$(nix-store -q "$drvPath1")
 
 drvPath2=$(nix-instantiate gc-concurrent.nix -A test2)
-outPath2=$(nix-store -q $drvPath2)
+outPath2=$(nix-store -q "$drvPath2")
 
 drvPath3=$(nix-instantiate simple.nix)
-outPath3=$(nix-store -r $drvPath3)
+outPath3=$(nix-store -r "$drvPath3")
 
-(! test -e $outPath3.lock)
-touch $outPath3.lock
+# shellcheck disable=SC2235
+(! test -e "$outPath3".lock)
+touch "$outPath3".lock
 
 rm -f "$NIX_STATE_DIR"/gcroots/foo*
-ln -s $drvPath2 "$NIX_STATE_DIR/gcroots/foo"
-ln -s $outPath3 "$NIX_STATE_DIR/gcroots/foo2"
+ln -s "$drvPath2" "$NIX_STATE_DIR/gcroots/foo"
+ln -s "$outPath3" "$NIX_STATE_DIR/gcroots/foo2"
 
 # Start build #1 in the background.  It starts immediately.
 nix-store -rvv "$drvPath1" &
 pid1=$!
 
 # Wait for the build of $drvPath1 to start
-cat $lockFifo1
+cat "$lockFifo1"
 
 # Run the garbage collector while the build is running.
 nix-collect-garbage
 
 # Unlock the build of $drvPath1
-echo "" > $lockFifo1
+echo "" > "$lockFifo1"
 echo waiting for pid $pid1 to finish...
 wait $pid1
 
 # Check that the root of build #1 and its dependencies haven't been
 # deleted.  The should not be deleted by the GC because they were
 # being built during the GC.
-cat $outPath1/foobar
-cat $outPath1/input-2/bar
+cat "$outPath1"/foobar
+cat "$outPath1"/input-2/bar
 
 # Check that the build build $drvPath2 succeeds.
 # It should succeed because the derivation is a GC root.
 nix-store -rvv "$drvPath2"
-cat $outPath2/foobar
+cat "$outPath2"/foobar
 
 rm -f "$NIX_STATE_DIR"/gcroots/foo*
 
 # The collector should have deleted lock files for paths that have
 # been built previously.
-(! test -e $outPath3.lock)
+# shellcheck disable=SC2235
+(! test -e "$outPath3".lock)
 
 # If we run the collector now, it should delete outPath1/2.
 nix-collect-garbage
-(! test -e $outPath1)
-(! test -e $outPath2)
+# shellcheck disable=SC2235
+(! test -e "$outPath1")
+# shellcheck disable=SC2235
+(! test -e "$outPath2")
diff --git a/tests/functional/gc-concurrent2.builder.sh b/tests/functional/gc-concurrent2.builder.sh
index 4f6c58b96..4b1ad6f5e 100644
--- a/tests/functional/gc-concurrent2.builder.sh
+++ b/tests/functional/gc-concurrent2.builder.sh
@@ -1,5 +1,8 @@
-mkdir $out
-echo $(cat $input1/foo)$(cat $input2/bar)xyzzy > $out/foobar
+# shellcheck shell=bash
+# shellcheck disable=SC2154
+mkdir "$out"
+# shellcheck disable=SC2154
+echo "$(cat "$input1"/foo)""$(cat "$input2"/bar)"xyzzy > "$out"/foobar
 
 # Check that the GC hasn't deleted the lock on our output.
 test -e "$out.lock"
diff --git a/tests/functional/gc-non-blocking.sh b/tests/functional/gc-non-blocking.sh
index 9cd5c0e1c..a85b8e5db 100755
--- a/tests/functional/gc-non-blocking.sh
+++ b/tests/functional/gc-non-blocking.sh
@@ -23,17 +23,17 @@ mkfifo "$fifo2"
 dummy=$(nix store add-path ./simple.nix)
 
 running=$TEST_ROOT/running
-touch $running
+touch "$running"
 
 # Start GC.
-(_NIX_TEST_GC_SYNC_1=$fifo1 _NIX_TEST_GC_SYNC_2=$fifo2 nix-store --gc -vvvvv; rm $running) &
+(_NIX_TEST_GC_SYNC_1=$fifo1 _NIX_TEST_GC_SYNC_2=$fifo2 nix-store --gc -vvvvv; rm "$running") &
 pid=$!
 
 sleep 2
 
 # Delay the start of the root server to check that the build below
 # correctly handles ENOENT when connecting to the root server.
-(sleep 1; echo > $fifo1) &
+(sleep 1; echo > "$fifo1") &
 pid2=$!
 
 # Start a build. This should not be blocked by the GC in progress.
@@ -47,6 +47,8 @@ outPath=$(nix-build --max-silent-time 60 -o "$TEST_ROOT/result" -E "
 wait $pid
 wait $pid2
 
-(! test -e $running)
-(! test -e $dummy)
-test -e $outPath
+# shellcheck disable=SC2235
+(! test -e "$running")
+# shellcheck disable=SC2235
+(! test -e "$dummy")
+test -e "$outPath"
diff --git a/tests/functional/hash-convert.sh b/tests/functional/hash-convert.sh
index c40cb469c..9ef4c189d 100755
--- a/tests/functional/hash-convert.sh
+++ b/tests/functional/hash-convert.sh
@@ -99,7 +99,7 @@ try3() {
     expectStderr 1 nix hash convert --hash-algo "$1" --from nix32 "$4" | grepQuiet "input hash"
 
     # Base-16 hashes can be in uppercase.
-    nix hash convert --hash-algo "$1" --from base16 "$(echo $2 | tr [a-z] [A-Z])"
+    nix hash convert --hash-algo "$1" --from base16 "$(echo "$2" | tr '[:lower:]' '[:upper:]')"
 }
 
 try3 sha1 "800d59cfcd3c05e900cb4e214be48f6b886a08df" "vw46m23bizj4n8afrc0fj19wrp7mj3c0" "gA1Zz808BekAy04hS+SPa4hqCN8="
diff --git a/tests/functional/impure-derivations.sh b/tests/functional/impure-derivations.sh
index 9e483d376..e0b7c3eea 100755
--- a/tests/functional/impure-derivations.sh
+++ b/tests/functional/impure-derivations.sh
@@ -12,62 +12,62 @@ restartDaemon
 clearStoreIfPossible
 
 # Basic test of impure derivations: building one a second time should not use the previous result.
-printf 0 > $TEST_ROOT/counter
+printf 0 > "$TEST_ROOT"/counter
 
 # `nix derivation add` with impure derivations work
 drvPath=$(nix-instantiate ./impure-derivations.nix -A impure)
-nix derivation show $drvPath | jq .[] > $TEST_HOME/impure-drv.json
-drvPath2=$(nix derivation add < $TEST_HOME/impure-drv.json)
+nix derivation show "$drvPath" | jq .[] > "$TEST_HOME"/impure-drv.json
+drvPath2=$(nix derivation add < "$TEST_HOME"/impure-drv.json)
 [[ "$drvPath" = "$drvPath2" ]]
 
 # But only with the experimental feature!
-expectStderr 1 nix derivation add < $TEST_HOME/impure-drv.json --experimental-features nix-command | grepQuiet "experimental Nix feature 'impure-derivations' is disabled"
+expectStderr 1 nix derivation add < "$TEST_HOME"/impure-drv.json --experimental-features nix-command | grepQuiet "experimental Nix feature 'impure-derivations' is disabled"
 
 nix build --dry-run --json --file ./impure-derivations.nix impure.all
 json=$(nix build -L --no-link --json --file ./impure-derivations.nix impure.all)
-path1=$(echo $json | jq -r .[].outputs.out)
-path1_stuff=$(echo $json | jq -r .[].outputs.stuff)
-[[ $(< $path1/n) = 0 ]]
-[[ $(< $path1_stuff/bla) = 0 ]]
+path1=$(echo "$json" | jq -r .[].outputs.out)
+path1_stuff=$(echo "$json" | jq -r .[].outputs.stuff)
+[[ $(< "$path1"/n) = 0 ]]
+[[ $(< "$path1_stuff"/bla) = 0 ]]
 
-[[ $(nix path-info --json $path1 | jq .[].ca) =~ fixed:r:sha256: ]]
+[[ $(nix path-info --json "$path1" | jq .[].ca) =~ fixed:r:sha256: ]]
 
 path2=$(nix build -L --no-link --json --file ./impure-derivations.nix impure | jq -r .[].outputs.out)
-[[ $(< $path2/n) = 1 ]]
+[[ $(< "$path2"/n) = 1 ]]
 
 # Test impure derivations that depend on impure derivations.
 path3=$(nix build -L --no-link --json --file ./impure-derivations.nix impureOnImpure | jq -r .[].outputs.out)
-[[ $(< $path3/n) = X2 ]]
+[[ $(< "$path3"/n) = X2 ]]
 
 path4=$(nix build -L --no-link --json --file ./impure-derivations.nix impureOnImpure | jq -r .[].outputs.out)
-[[ $(< $path4/n) = X3 ]]
+[[ $(< "$path4"/n) = X3 ]]
 
 # Test that (self-)references work.
-[[ $(< $path4/symlink/bla) = 3 ]]
-[[ $(< $path4/self/n) = X3 ]]
+[[ $(< "$path4"/symlink/bla) = 3 ]]
+[[ $(< "$path4"/self/n) = X3 ]]
 
 # Input-addressed derivations cannot depend on impure derivations directly.
 (! nix build -L --no-link --json --file ./impure-derivations.nix inputAddressed 2>&1) | grep 'depends on impure derivation'
 
 drvPath=$(nix eval --json --file ./impure-derivations.nix impure.drvPath | jq -r .)
-[[ $(nix derivation show $drvPath | jq ".[\"$(basename "$drvPath")\"].outputs.out.impure") = true ]]
-[[ $(nix derivation show $drvPath | jq ".[\"$(basename "$drvPath")\"].outputs.stuff.impure") = true ]]
+[[ $(nix derivation show "$drvPath" | jq ".[\"$(basename "$drvPath")\"].outputs.out.impure") = true ]]
+[[ $(nix derivation show "$drvPath" | jq ".[\"$(basename "$drvPath")\"].outputs.stuff.impure") = true ]]
 
 # Fixed-output derivations *can* depend on impure derivations.
 path5=$(nix build -L --no-link --json --file ./impure-derivations.nix contentAddressed | jq -r .[].outputs.out)
-[[ $(< $path5) = X ]]
-[[ $(< $TEST_ROOT/counter) = 5 ]]
+[[ $(< "$path5") = X ]]
+[[ $(< "$TEST_ROOT"/counter) = 5 ]]
 
 # And they should not be rebuilt.
 path5=$(nix build -L --no-link --json --file ./impure-derivations.nix contentAddressed | jq -r .[].outputs.out)
-[[ $(< $path5) = X ]]
-[[ $(< $TEST_ROOT/counter) = 5 ]]
+[[ $(< "$path5") = X ]]
+[[ $(< "$TEST_ROOT"/counter) = 5 ]]
 
 # Input-addressed derivations can depend on fixed-output derivations that depend on impure derivations.
 path6=$(nix build -L --no-link --json --file ./impure-derivations.nix inputAddressedAfterCA | jq -r .[].outputs.out)
-[[ $(< $path6) = X ]]
-[[ $(< $TEST_ROOT/counter) = 5 ]]
+[[ $(< "$path6") = X ]]
+[[ $(< "$TEST_ROOT"/counter) = 5 ]]
 
 # Test nix/fetchurl.nix.
 path7=$(nix build -L --no-link --print-out-paths --expr "import <nix/fetchurl.nix> { impure = true; url = file://$PWD/impure-derivations.sh; }")
-cmp $path7 $PWD/impure-derivations.sh
+cmp "$path7" "$PWD"/impure-derivations.sh
diff --git a/tests/functional/install-darwin.sh b/tests/functional/install-darwin.sh
index ea2b75323..0070e9dce 100755
--- a/tests/functional/install-darwin.sh
+++ b/tests/functional/install-darwin.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 set -eux
 
@@ -21,12 +21,13 @@ cleanup() {
 
     for file in ~/.bash_profile ~/.bash_login ~/.profile ~/.zshenv ~/.zprofile ~/.zshrc ~/.zlogin; do
         if [ -e "$file" ]; then
+            # shellcheck disable=SC2002
             cat "$file" | grep -v nix-profile > "$file.next"
             mv "$file.next" "$file"
         fi
     done
 
-    for i in $(seq 1 $(sysctl -n hw.ncpu)); do
+    for i in $(seq 1 "$(sysctl -n hw.ncpu)"); do
         sudo /usr/bin/dscl . -delete "/Users/nixbld$i" || true
     done
     sudo /usr/bin/dscl . -delete "/Groups/nixbld" || true
@@ -65,11 +66,11 @@ verify
         echo nix-build ./release.nix -A binaryTarball.x86_64-darwin
     ) | bash -l
     set -e
-    cp ./result/nix-*.tar.bz2 $scratch/nix.tar.bz2
+    cp ./result/nix-*.tar.bz2 "$scratch"/nix.tar.bz2
 )
 
 (
-    cd $scratch
+    cd "$scratch"
     tar -xf ./nix.tar.bz2
 
     cd nix-*
diff --git a/tests/functional/linux-sandbox.sh b/tests/functional/linux-sandbox.sh
index abb635f11..c3ddf6ce6 100755
--- a/tests/functional/linux-sandbox.sh
+++ b/tests/functional/linux-sandbox.sh
@@ -19,8 +19,8 @@ if [[ ! $SHELL =~ /nix/store ]]; then skipTest "Shell is not from Nix store"; fi
 # An alias to automatically bind-mount the $SHELL on nix-build invocations
 nix-sandbox-build () { nix-build --no-out-link --sandbox-paths /nix/store "$@"; }
 
-chmod -R u+w $TEST_ROOT/store0 || true
-rm -rf $TEST_ROOT/store0
+chmod -R u+w "$TEST_ROOT"/store0 || true
+rm -rf "$TEST_ROOT"/store0
 
 export NIX_STORE_DIR=/my/store
 export NIX_REMOTE=$TEST_ROOT/store0
@@ -29,11 +29,11 @@ outPath=$(nix-sandbox-build dependencies.nix)
 
 [[ $outPath =~ /my/store/.*-dependencies ]]
 
-nix path-info -r $outPath | grep input-2
+nix path-info -r "$outPath" | grep input-2
 
-nix store ls -R -l $outPath | grep foobar
+nix store ls -R -l "$outPath" | grep foobar
 
-nix store cat $outPath/foobar | grep FOOBAR
+nix store cat "$outPath"/foobar | grep FOOBAR
 
 # Test --check without hash rewriting.
 nix-sandbox-build dependencies.nix --check
@@ -42,9 +42,9 @@ nix-sandbox-build dependencies.nix --check
 nix-sandbox-build check.nix -A nondeterministic
 
 # `100 + 4` means non-determinstic, see doc/manual/source/command-ref/status-build-failure.md
-expectStderr 104 nix-sandbox-build check.nix -A nondeterministic --check -K > $TEST_ROOT/log
-grepQuietInverse 'error: renaming' $TEST_ROOT/log
-grepQuiet 'may not be deterministic' $TEST_ROOT/log
+expectStderr 104 nix-sandbox-build check.nix -A nondeterministic --check -K > "$TEST_ROOT"/log
+grepQuietInverse 'error: renaming' "$TEST_ROOT"/log
+grepQuiet 'may not be deterministic' "$TEST_ROOT"/log
 
 # Test that sandboxed builds cannot write to /etc easily
 # `100` means build failure without extra info, see doc/manual/source/command-ref/status-build-failure.md
@@ -59,7 +59,7 @@ testCert () {
     certFile=$3    # a string that can be the path to a cert file
     # `100` means build failure without extra info, see doc/manual/source/command-ref/status-build-failure.md
     [ "$mode" == fixed-output ] && ret=1 || ret=100
-    expectStderr $ret nix-sandbox-build linux-sandbox-cert-test.nix --argstr mode "$mode" --option ssl-cert-file "$certFile" |
+    expectStderr "$ret" nix-sandbox-build linux-sandbox-cert-test.nix --argstr mode "$mode" --option ssl-cert-file "$certFile" |
         grepQuiet "CERT_${expectation}_IN_SANDBOX"
 }
 
@@ -68,10 +68,10 @@ cert=$TEST_ROOT/some-cert-file.pem
 symlinkcert=$TEST_ROOT/symlink-cert-file.pem
 transitivesymlinkcert=$TEST_ROOT/transitive-symlink-cert-file.pem
 symlinkDir=$TEST_ROOT/symlink-dir
-echo -n "CERT_CONTENT" > $cert
-ln -s $cert $symlinkcert
-ln -s $symlinkcert $transitivesymlinkcert
-ln -s $TEST_ROOT $symlinkDir
+echo -n "CERT_CONTENT" > "$cert"
+ln -s "$cert" "$symlinkcert"
+ln -s "$symlinkcert" "$transitivesymlinkcert"
+ln -s "$TEST_ROOT" "$symlinkDir"
 
 # No cert in sandbox when not a fixed-output derivation
 testCert missing normal       "$cert"
diff --git a/tests/functional/logging.sh b/tests/functional/logging.sh
index 83df9a45d..600fce43e 100755
--- a/tests/functional/logging.sh
+++ b/tests/functional/logging.sh
@@ -9,14 +9,14 @@ clearStore
 path=$(nix-build dependencies.nix --no-out-link)
 
 # Test nix-store -l.
-[ "$(nix-store -l $path)" = FOO ]
+[ "$(nix-store -l "$path")" = FOO ]
 
 # Test compressed logs.
 clearStore
-rm -rf $NIX_LOG_DIR
-(! nix-store -l $path)
+rm -rf "$NIX_LOG_DIR"
+(! nix-store -l "$path")
 nix-build dependencies.nix --no-out-link --compress-build-log
-[ "$(nix-store -l $path)" = FOO ]
+[ "$(nix-store -l "$path")" = FOO ]
 
 # test whether empty logs work fine with `nix log`.
 builder="$(realpath "$(mktemp)")"
@@ -40,5 +40,5 @@ if [[ "$NIX_REMOTE" != "daemon" ]]; then
     nix build -vv --file dependencies.nix --no-link --json-log-path "$TEST_ROOT/log.json" 2>&1 | grepQuiet 'building.*dependencies-top.drv'
     jq < "$TEST_ROOT/log.json"
     grep '{"action":"start","fields":\[".*-dependencies-top.drv","",1,1\],"id":.*,"level":3,"parent":0' "$TEST_ROOT/log.json" >&2
-    (( $(grep '{"action":"msg","level":5,"msg":"executing builder .*"}' "$TEST_ROOT/log.json" | wc -l) == 5 ))
+    (( $(grep -c '{"action":"msg","level":5,"msg":"executing builder .*"}' "$TEST_ROOT/log.json" ) == 5 ))
 fi
diff --git a/tests/functional/misc.sh b/tests/functional/misc.sh
index b94a5fc57..131b63323 100755
--- a/tests/functional/misc.sh
+++ b/tests/functional/misc.sh
@@ -14,6 +14,7 @@ source common.sh
 nix-env --version | grep -F "${_NIX_TEST_CLIENT_VERSION:-$version}"
 
 nix_env=$(type -P nix-env)
+# shellcheck disable=SC2123
 (PATH=""; ! $nix_env --help 2>&1 ) | grepQuiet -F "The 'man' command was not found, but it is needed for 'nix-env' and some other 'nix-*' commands' help text. Perhaps you could install the 'man' command?"
 
 # Usage errors.
@@ -22,12 +23,12 @@ expect 1 nix-env -q --foo 2>&1 | grep "unknown flag"
 
 # Eval Errors.
 eval_arg_res=$(nix-instantiate --eval -E 'let a = {} // a; in a.foo' 2>&1 || true)
-echo $eval_arg_res | grep "at «string»:1:15:"
-echo $eval_arg_res | grep "infinite recursion encountered"
+echo "$eval_arg_res" | grep "at «string»:1:15:"
+echo "$eval_arg_res" | grep "infinite recursion encountered"
 
 eval_stdin_res=$(echo 'let a = {} // a; in a.foo' | nix-instantiate --eval -E - 2>&1 || true)
-echo $eval_stdin_res | grep "at «stdin»:1:15:"
-echo $eval_stdin_res | grep "infinite recursion encountered"
+echo "$eval_stdin_res" | grep "at «stdin»:1:15:"
+echo "$eval_stdin_res" | grep "infinite recursion encountered"
 
 # Attribute path errors
 expectStderr 1 nix-instantiate --eval -E '{}' -A '"x' | grepQuiet "missing closing quote in selection path"
@@ -40,10 +41,10 @@ expectStderr 1 nix-instantiate --eval -E '[]' -A '1' | grepQuiet "out of range"
 # NOTE(cole-h): behavior is different depending on the order, which is why we test an unknown option
 # before and after the `'{}'`!
 out="$(expectStderr 0 nix-instantiate --option foobar baz --expr '{}')"
-[[ "$(echo "$out" | grep foobar | wc -l)" = 1 ]]
+[[ "$(echo "$out" | grep -c foobar )" = 1 ]]
 
 out="$(expectStderr 0 nix-instantiate '{}' --option foobar baz --expr )"
-[[ "$(echo "$out" | grep foobar | wc -l)" = 1 ]]
+[[ "$(echo "$out" | grep -c foobar )" = 1 ]]
 
 if [[ $(uname) = Linux && $(uname -m) = i686 ]]; then
     [[ $(nix config show system) = i686-linux ]]
diff --git a/tests/functional/multiple-outputs.sh b/tests/functional/multiple-outputs.sh
index c4e0be15e..f703fb02b 100755
--- a/tests/functional/multiple-outputs.sh
+++ b/tests/functional/multiple-outputs.sh
@@ -6,15 +6,17 @@ TODO_NixOS
 
 clearStoreIfPossible
 
-rm -f $TEST_ROOT/result*
+rm -f "$TEST_ROOT"/result*
 
 # Placeholder strings are opaque, so cannot do this check for floating
 # content-addressing derivations.
-if [[ ! -n "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
+if [[ -z "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
     # Test whether the output names match our expectations
     outPath=$(nix-instantiate multiple-outputs.nix --eval -A nameCheck.out.outPath)
+    # shellcheck disable=SC2016
     [ "$(echo "$outPath" | sed -E 's_^".*/[^-/]*-([^/]*)"$_\1_')" = "multiple-outputs-a" ]
     outPath=$(nix-instantiate multiple-outputs.nix --eval -A nameCheck.dev.outPath)
+    # shellcheck disable=SC2016
     [ "$(echo "$outPath" | sed -E 's_^".*/[^-/]*-([^/]*)"$_\1_')" = "multiple-outputs-a-dev" ]
 fi
 
@@ -27,16 +29,17 @@ echo "evaluating c..."
 # outputs.
 drvPath=$(nix-instantiate multiple-outputs.nix -A c)
 #[ "$drvPath" = "$drvPath2" ]
-grepQuiet 'multiple-outputs-a.drv",\["first","second"\]' $drvPath
-grepQuiet 'multiple-outputs-b.drv",\["out"\]' $drvPath
+grepQuiet 'multiple-outputs-a.drv",\["first","second"\]' "$drvPath"
+grepQuiet 'multiple-outputs-b.drv",\["out"\]' "$drvPath"
 
 # While we're at it, test the ‘unsafeDiscardOutputDependency’ primop.
 outPath=$(nix-build multiple-outputs.nix -A d --no-out-link)
-drvPath=$(cat $outPath/drv)
+drvPath=$(cat "$outPath"/drv)
 if [[ -n "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
-    expectStderr 1 nix-store -q $drvPath | grepQuiet "Cannot use output path of floating content-addressing derivation until we know what it is (e.g. by building it)"
+    expectStderr 1 nix-store -q "$drvPath" | grepQuiet "Cannot use output path of floating content-addressing derivation until we know what it is (e.g. by building it)"
 else
-    outPath=$(nix-store -q $drvPath)
+    outPath=$(nix-store -q "$drvPath")
+    # shellcheck disable=SC2233
     (! [ -e "$outPath" ])
 fi
 
@@ -48,34 +51,37 @@ echo "output path is $outPath"
 [ "$(cat "$outPath/file")" = "success" ]
 
 # Test nix-build on a derivation with multiple outputs.
-outPath1=$(nix-build multiple-outputs.nix -A a -o $TEST_ROOT/result)
-[ -e $TEST_ROOT/result-first ]
-(! [ -e $TEST_ROOT/result-second ])
-nix-build multiple-outputs.nix -A a.all -o $TEST_ROOT/result
-[ "$(cat $TEST_ROOT/result-first/file)" = "first" ]
-[ "$(cat $TEST_ROOT/result-second/file)" = "second" ]
-[ "$(cat $TEST_ROOT/result-second/link/file)" = "first" ]
-hash1=$(nix-store -q --hash $TEST_ROOT/result-second)
+outPath1=$(nix-build multiple-outputs.nix -A a -o "$TEST_ROOT"/result)
+[ -e "$TEST_ROOT"/result-first ]
+# shellcheck disable=SC2235
+(! [ -e "$TEST_ROOT"/result-second ])
+nix-build multiple-outputs.nix -A a.all -o "$TEST_ROOT"/result
+[ "$(cat "$TEST_ROOT"/result-first/file)" = "first" ]
+[ "$(cat "$TEST_ROOT"/result-second/file)" = "second" ]
+[ "$(cat "$TEST_ROOT"/result-second/link/file)" = "first" ]
+hash1=$(nix-store -q --hash "$TEST_ROOT"/result-second)
 
-outPath2=$(nix-build $(nix-instantiate multiple-outputs.nix -A a) --no-out-link)
-[[ $outPath1 = $outPath2 ]]
+outPath2=$(nix-build "$(nix-instantiate multiple-outputs.nix -A a)" --no-out-link)
+[[ $outPath1 = "$outPath2" ]]
 
-outPath2=$(nix-build $(nix-instantiate multiple-outputs.nix -A a.first) --no-out-link)
-[[ $outPath1 = $outPath2 ]]
+outPath2=$(nix-build "$(nix-instantiate multiple-outputs.nix -A a.first)" --no-out-link)
+[[ $outPath1 = "$outPath2" ]]
 
-outPath2=$(nix-build $(nix-instantiate multiple-outputs.nix -A a.second) --no-out-link)
-[[ $(cat $outPath2/file) = second ]]
+outPath2=$(nix-build "$(nix-instantiate multiple-outputs.nix -A a.second)" --no-out-link)
+[[ $(cat "$outPath2"/file) = second ]]
 
+# FIXME: Fixing this shellcheck causes the test to fail.
+# shellcheck disable=SC2046
 [[ $(nix-build $(nix-instantiate multiple-outputs.nix -A a.all) --no-out-link | wc -l) -eq 2 ]]
 
-if [[ ! -n "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
+if [[ -z "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
     # Delete one of the outputs and rebuild it.  This will cause a hash
     # rewrite.
-    env -u NIX_REMOTE nix store delete $TEST_ROOT/result-second --ignore-liveness
-    nix-build multiple-outputs.nix -A a.all -o $TEST_ROOT/result
-    [ "$(cat $TEST_ROOT/result-second/file)" = "second" ]
-    [ "$(cat $TEST_ROOT/result-second/link/file)" = "first" ]
-    hash2=$(nix-store -q --hash $TEST_ROOT/result-second)
+    env -u NIX_REMOTE nix store delete "$TEST_ROOT"/result-second --ignore-liveness
+    nix-build multiple-outputs.nix -A a.all -o "$TEST_ROOT"/result
+    [ "$(cat "$TEST_ROOT"/result-second/file)" = "second" ]
+    [ "$(cat "$TEST_ROOT"/result-second/link/file)" = "first" ]
+    hash2=$(nix-store -q --hash "$TEST_ROOT"/result-second)
     [ "$hash1" = "$hash2" ]
 fi
 
@@ -92,15 +98,15 @@ fi
 
 # Do a GC. This should leave an empty store.
 echo "collecting garbage..."
-rm $TEST_ROOT/result*
+rm "$TEST_ROOT"/result*
 nix-store --gc --keep-derivations --keep-outputs
 nix-store --gc --print-roots
-rm -rf $NIX_STORE_DIR/.links
-rmdir $NIX_STORE_DIR
+rm -rf "$NIX_STORE_DIR"/.links
+rmdir "$NIX_STORE_DIR"
 
 # TODO inspect why this doesn't work with floating content-addressing
 # derivations.
-if [[ ! -n "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
+if [[ -z "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
     expect 1 nix build -f multiple-outputs.nix invalid-output-name-1 2>&1 | grep 'contains illegal character'
     expect 1 nix build -f multiple-outputs.nix invalid-output-name-2 2>&1 | grep 'contains illegal character'
 fi
diff --git a/tests/functional/nested-sandboxing.sh b/tests/functional/nested-sandboxing.sh
index 4d4cf125e..8788c7d90 100755
--- a/tests/functional/nested-sandboxing.sh
+++ b/tests/functional/nested-sandboxing.sh
@@ -11,7 +11,7 @@ requiresUnprivilegedUserNamespaces
 
 start="$TEST_ROOT/start"
 mkdir -p "$start"
-cp -r common common.sh ${config_nix} ./nested-sandboxing "$start"
+cp -r common common.sh "${config_nix}" ./nested-sandboxing "$start"
 cp "${_NIX_TEST_BUILD_DIR}/common/subst-vars.sh" "$start/common"
 # N.B. redefine
 _NIX_TEST_SOURCE_DIR="$start"
@@ -20,6 +20,7 @@ cd "$start"
 
 source ./nested-sandboxing/command.sh
 
+# shellcheck disable=SC2016
 expectStderr 100 runNixBuild badStoreUrl 2 | grepQuiet '`sandbox-build-dir` must not contain'
 
 runNixBuild goodStoreUrl 5
diff --git a/tests/functional/nested-sandboxing/command.sh b/tests/functional/nested-sandboxing/command.sh
index 7c04e82f5..c01133d93 100644
--- a/tests/functional/nested-sandboxing/command.sh
+++ b/tests/functional/nested-sandboxing/command.sh
@@ -1,17 +1,20 @@
+# shellcheck shell=bash
 set -eu -o pipefail
 
-export NIX_BIN_DIR=$(dirname $(type -p nix))
+NIX_BIN_DIR=$(dirname "$(type -p nix)")
+export NIX_BIN_DIR
 # TODO Get Nix and its closure more flexibly
-export EXTRA_SANDBOX="/nix/store $(dirname $NIX_BIN_DIR)"
+EXTRA_SANDBOX="/nix/store $(dirname "$NIX_BIN_DIR")"
+export EXTRA_SANDBOX
 
 badStoreUrl () {
     local altitude=$1
-    echo $TEST_ROOT/store-$altitude
+    echo "$TEST_ROOT"/store-"$altitude"
 }
 
 goodStoreUrl () {
     local altitude=$1
-    echo $("badStoreUrl" "$altitude")?store=/foo-$altitude
+    echo "$("badStoreUrl" "$altitude")"?store=/foo-"$altitude"
 }
 
 # The non-standard sandbox-build-dir helps ensure that we get the same behavior
diff --git a/tests/functional/nix-build.sh b/tests/functional/nix-build.sh
index 091e429e0..33973c628 100755
--- a/tests/functional/nix-build.sh
+++ b/tests/functional/nix-build.sh
@@ -6,30 +6,30 @@ TODO_NixOS
 
 clearStoreIfPossible
 
-outPath=$(nix-build dependencies.nix -o $TEST_ROOT/result)
-test "$(cat $TEST_ROOT/result/foobar)" = FOOBAR
+outPath=$(nix-build dependencies.nix -o "$TEST_ROOT"/result)
+test "$(cat "$TEST_ROOT"/result/foobar)" = FOOBAR
 
 # The result should be retained by a GC.
 echo A
-target=$(readLink $TEST_ROOT/result)
+target=$(readLink "$TEST_ROOT"/result)
 echo B
-echo target is $target
+echo target is "$target"
 nix-store --gc
-test -e $target/foobar
+test -e "$target"/foobar
 
 # But now it should be gone.
-rm $TEST_ROOT/result
+rm "$TEST_ROOT"/result
 nix-store --gc
-if test -e $target/foobar; then false; fi
+if test -e "$target"/foobar; then false; fi
 
-outPath2=$(nix-build $(nix-instantiate dependencies.nix) --no-out-link)
-[[ $outPath = $outPath2 ]]
+outPath2=$(nix-build "$(nix-instantiate dependencies.nix)" --no-out-link)
+[[ $outPath = "$outPath2" ]]
 
-outPath2=$(nix-build $(nix-instantiate dependencies.nix)!out --no-out-link)
-[[ $outPath = $outPath2 ]]
+outPath2=$(nix-build "$(nix-instantiate dependencies.nix)"!out --no-out-link)
+[[ $outPath = "$outPath2" ]]
 
-outPath2=$(nix-store -r $(nix-instantiate --add-root $TEST_ROOT/indirect dependencies.nix)!out)
-[[ $outPath = $outPath2 ]]
+outPath2=$(nix-store -r "$(nix-instantiate --add-root "$TEST_ROOT"/indirect dependencies.nix)"!out)
+[[ $outPath = "$outPath2" ]]
 
 # The order of the paths on stdout must correspond to the -A options
 # https://github.com/NixOS/nix/issues/4197
@@ -39,9 +39,11 @@ input1="$(nix-build nix-build-examples.nix -A input1 --no-out-link)"
 input2="$(nix-build nix-build-examples.nix -A input2 --no-out-link)"
 body="$(nix-build nix-build-examples.nix -A body --no-out-link)"
 
+# shellcheck disable=SC2046,SC2005
 outPathsA="$(echo $(nix-build nix-build-examples.nix -A input0 -A input1 -A input2 -A body --no-out-link))"
 [[ "$outPathsA" = "$input0 $input1 $input2 $body" ]]
 
 # test a different ordering to make sure it fails, not just in 23 out of 24 permutations
+# shellcheck disable=SC2046,SC2005
 outPathsB="$(echo $(nix-build nix-build-examples.nix -A body -A input1 -A input2 -A input0 --no-out-link))"
 [[ "$outPathsB" = "$body $input1 $input2 $input0" ]]
diff --git a/tests/functional/nix-channel.sh b/tests/functional/nix-channel.sh
index d0b772850..f23d4bbde 100755
--- a/tests/functional/nix-channel.sh
+++ b/tests/functional/nix-channel.sh
@@ -4,7 +4,7 @@ source common.sh
 
 clearProfiles
 
-rm -f $TEST_HOME/.nix-channels $TEST_HOME/.nix-profile
+rm -f "$TEST_HOME"/.nix-channels "$TEST_HOME"/.nix-profile
 
 # Test add/list/remove.
 nix-channel --add http://foo/bar xyzzy
@@ -12,8 +12,8 @@ nix-channel --list | grepQuiet http://foo/bar
 nix-channel --remove xyzzy
 [[ $(nix-channel --list-generations | wc -l) == 1 ]]
 
-[ -e $TEST_HOME/.nix-channels ]
-[ "$(cat $TEST_HOME/.nix-channels)" = '' ]
+[ -e "$TEST_HOME"/.nix-channels ]
+[ "$(cat "$TEST_HOME"/.nix-channels)" = '' ]
 
 # Test the XDG Base Directories support
 
@@ -25,47 +25,47 @@ nix-channel --remove xyzzy
 
 unset NIX_CONFIG
 
-[ -e $TEST_HOME/.local/state/nix/channels ]
-[ "$(cat $TEST_HOME/.local/state/nix/channels)" = '' ]
+[ -e "$TEST_HOME"/.local/state/nix/channels ]
+[ "$(cat "$TEST_HOME"/.local/state/nix/channels)" = '' ]
 
 # Create a channel.
-rm -rf $TEST_ROOT/foo
-mkdir -p $TEST_ROOT/foo
+rm -rf "$TEST_ROOT"/foo
+mkdir -p "$TEST_ROOT"/foo
 drvPath=$(nix-instantiate dependencies.nix)
-nix copy --to file://$TEST_ROOT/foo?compression="bzip2" $(nix-store -r "$drvPath")
-rm -rf $TEST_ROOT/nixexprs
-mkdir -p $TEST_ROOT/nixexprs
-cp "${config_nix}" dependencies.nix dependencies.builder*.sh $TEST_ROOT/nixexprs/
-ln -s dependencies.nix $TEST_ROOT/nixexprs/default.nix
-(cd $TEST_ROOT && tar cvf - nixexprs) | bzip2 > $TEST_ROOT/foo/nixexprs.tar.bz2
+nix copy --to file://"$TEST_ROOT"/foo?compression="bzip2" "$(nix-store -r "$drvPath")"
+rm -rf "$TEST_ROOT"/nixexprs
+mkdir -p "$TEST_ROOT"/nixexprs
+cp "${config_nix}" dependencies.nix dependencies.builder*.sh "$TEST_ROOT"/nixexprs/
+ln -s dependencies.nix "$TEST_ROOT"/nixexprs/default.nix
+(cd "$TEST_ROOT" && tar cvf - nixexprs) | bzip2 > "$TEST_ROOT"/foo/nixexprs.tar.bz2
 
 # Test the update action.
-nix-channel --add file://$TEST_ROOT/foo
+nix-channel --add file://"$TEST_ROOT"/foo
 nix-channel --update
 [[ $(nix-channel --list-generations | wc -l) == 2 ]]
 
 # Do a query.
-nix-env -qa \* --meta --xml --out-path > $TEST_ROOT/meta.xml
-grepQuiet 'meta.*description.*Random test package' $TEST_ROOT/meta.xml
-grepQuiet 'item.*attrPath="foo".*name="dependencies-top"' $TEST_ROOT/meta.xml
+nix-env -qa \* --meta --xml --out-path > "$TEST_ROOT"/meta.xml
+grepQuiet 'meta.*description.*Random test package' "$TEST_ROOT"/meta.xml
+grepQuiet 'item.*attrPath="foo".*name="dependencies-top"' "$TEST_ROOT"/meta.xml
 
 # Do an install.
 nix-env -i dependencies-top
-[ -e $TEST_HOME/.nix-profile/foobar ]
+[ -e "$TEST_HOME"/.nix-profile/foobar ]
 
 # Test updating from a tarball
-nix-channel --add file://$TEST_ROOT/foo/nixexprs.tar.bz2 bar
+nix-channel --add file://"$TEST_ROOT"/foo/nixexprs.tar.bz2 bar
 nix-channel --update
 
 # Do a query.
-nix-env -qa \* --meta --xml --out-path > $TEST_ROOT/meta.xml
-grepQuiet 'meta.*description.*Random test package' $TEST_ROOT/meta.xml
-grepQuiet 'item.*attrPath="bar".*name="dependencies-top"' $TEST_ROOT/meta.xml
-grepQuiet 'item.*attrPath="foo".*name="dependencies-top"' $TEST_ROOT/meta.xml
+nix-env -qa \* --meta --xml --out-path > "$TEST_ROOT"/meta.xml
+grepQuiet 'meta.*description.*Random test package' "$TEST_ROOT"/meta.xml
+grepQuiet 'item.*attrPath="bar".*name="dependencies-top"' "$TEST_ROOT"/meta.xml
+grepQuiet 'item.*attrPath="foo".*name="dependencies-top"' "$TEST_ROOT"/meta.xml
 
 # Do an install.
 nix-env -i dependencies-top
-[ -e $TEST_HOME/.nix-profile/foobar ]
+[ -e "$TEST_HOME"/.nix-profile/foobar ]
 
 # Test evaluation through a channel symlink (#9882).
 drvPath=$(nix-instantiate '<foo/dependencies.nix>')
@@ -73,9 +73,9 @@ drvPath=$(nix-instantiate '<foo/dependencies.nix>')
 # Add a test for the special case behaviour of 'nixpkgs' in the
 # channels for root (see EvalSettings::getDefaultNixPath()).
 if ! isTestOnNixOS; then
-    nix-channel --add file://$TEST_ROOT/foo nixpkgs
+    nix-channel --add file://"$TEST_ROOT"/foo nixpkgs
     nix-channel --update
-    mv $TEST_HOME/.local/state/nix/profiles $TEST_ROOT/var/nix/profiles/per-user/root
+    mv "$TEST_HOME"/.local/state/nix/profiles "$TEST_ROOT"/var/nix/profiles/per-user/root
     drvPath2=$(nix-instantiate '<nixpkgs>')
     [[ "$drvPath" = "$drvPath2" ]]
 fi
diff --git a/tests/functional/nix-collect-garbage-d.sh b/tests/functional/nix-collect-garbage-d.sh
index 119efe629..44de90711 100755
--- a/tests/functional/nix-collect-garbage-d.sh
+++ b/tests/functional/nix-collect-garbage-d.sh
@@ -29,7 +29,7 @@ testCollectGarbageD
 
 # Run the same test, but forcing the profiles an arbitrary location.
 rm ~/.nix-profile
-ln -s $TEST_ROOT/blah ~/.nix-profile
+ln -s "$TEST_ROOT"/blah ~/.nix-profile
 testCollectGarbageD
 
 # Run the same test, but forcing the profiles at their legacy location under
diff --git a/tests/functional/nix-copy-ssh-common.sh b/tests/functional/nix-copy-ssh-common.sh
index 5eea9612d..8154585af 100644
--- a/tests/functional/nix-copy-ssh-common.sh
+++ b/tests/functional/nix-copy-ssh-common.sh
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 proto=$1
 shift
 (( $# == 0 ))
@@ -7,7 +8,7 @@ TODO_NixOS
 clearStore
 clearCache
 
-mkdir -p $TEST_ROOT/stores
+mkdir -p "$TEST_ROOT"/stores
 
 # Create path to copy back and forth
 outPath=$(nix-build --no-out-link dependencies.nix)
@@ -37,17 +38,17 @@ if [[ "$proto" == "ssh-ng" ]]; then
     args+=(--no-check-sigs)
 fi
 
-[ ! -f ${remoteRoot}${outPath}/foobar ]
-nix copy "${args[@]}" --to "$remoteStore" $outPath
-[ -f ${remoteRoot}${outPath}/foobar ]
+[ ! -f "${remoteRoot}""${outPath}"/foobar ]
+nix copy "${args[@]}" --to "$remoteStore" "$outPath"
+[ -f "${remoteRoot}""${outPath}"/foobar ]
 
 # Copy back from store
 
 clearStore
 
-[ ! -f $outPath/foobar ]
-nix copy --no-check-sigs --from "$remoteStore" $outPath
-[ -f $outPath/foobar ]
+[ ! -f "$outPath"/foobar ]
+nix copy --no-check-sigs --from "$remoteStore" "$outPath"
+[ -f "$outPath"/foobar ]
 
 # Check --substitute-on-destination, avoid corrupted store
 
diff --git a/tests/functional/nix-copy-ssh-ng.sh b/tests/functional/nix-copy-ssh-ng.sh
index 41958c2c3..f74f3bb86 100755
--- a/tests/functional/nix-copy-ssh-ng.sh
+++ b/tests/functional/nix-copy-ssh-ng.sh
@@ -14,5 +14,5 @@ outPath=$(nix-build --no-out-link dependencies.nix)
 nix store info --store "$remoteStore"
 
 # Regression test for https://github.com/NixOS/nix/issues/6253
-nix copy --to "$remoteStore" $outPath --no-check-sigs &
-nix copy --to "$remoteStore" $outPath --no-check-sigs
+nix copy --to "$remoteStore" "$outPath" --no-check-sigs &
+nix copy --to "$remoteStore" "$outPath" --no-check-sigs
diff --git a/tests/functional/nix-profile.sh b/tests/functional/nix-profile.sh
index b1cfef6b0..922162d4b 100755
--- a/tests/functional/nix-profile.sh
+++ b/tests/functional/nix-profile.sh
@@ -12,9 +12,10 @@ restartDaemon
 
 # Make a flake.
 flake1Dir=$TEST_ROOT/flake1
-mkdir -p $flake1Dir
+mkdir -p "$flake1Dir"
 
-cat > $flake1Dir/flake.nix <<EOF
+# shellcheck disable=SC2154,SC1039
+cat > "$flake1Dir"/flake.nix <<EOF
 {
   description = "Bla bla";
 
@@ -43,20 +44,21 @@ cat > $flake1Dir/flake.nix <<EOF
 }
 EOF
 
-printf World > $flake1Dir/who
-printf 1.0 > $flake1Dir/version
-printf false > $flake1Dir/ca.nix
+printf World > "$flake1Dir"/who
+printf 1.0 > "$flake1Dir"/version
+printf false > "$flake1Dir"/ca.nix
 
-cp "${config_nix}" $flake1Dir/
+cp "${config_nix}" "$flake1Dir"/
 
 # Test upgrading from nix-env.
 nix-env -f ./user-envs.nix -i foo-1.0
 nix profile list | grep -A2 'Name:.*foo' | grep 'Store paths:.*foo-1.0'
-nix profile add $flake1Dir -L
+nix profile add "$flake1Dir" -L
 nix profile list | grep -A4 'Name:.*flake1' | grep 'Locked flake URL:.*narHash'
-[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello World" ]]
-[ -e $TEST_HOME/.nix-profile/share/man ]
-(! [ -e $TEST_HOME/.nix-profile/include ])
+[[ $("$TEST_HOME"/.nix-profile/bin/hello) = "Hello World" ]]
+[ -e "$TEST_HOME"/.nix-profile/share/man ]
+# shellcheck disable=SC2235
+(! [ -e "$TEST_HOME"/.nix-profile/include ])
 nix profile history
 nix profile history | grep "packages.$system.default: ∅ -> 1.0"
 nix profile diff-closures | grep 'env-manifest.nix: ε → ∅'
@@ -64,32 +66,32 @@ nix profile diff-closures | grep 'env-manifest.nix: ε → ∅'
 # Test XDG Base Directories support
 export NIX_CONFIG="use-xdg-base-directories = true"
 nix profile remove flake1 2>&1 | grep 'removed 1 packages'
-nix profile add $flake1Dir
-[[ $($TEST_HOME/.local/state/nix/profile/bin/hello) = "Hello World" ]]
+nix profile add "$flake1Dir"
+[[ $("$TEST_HOME"/.local/state/nix/profile/bin/hello) = "Hello World" ]]
 unset NIX_CONFIG
 
 # Test conflicting package add.
-nix profile add $flake1Dir 2>&1 | grep "warning: 'flake1' is already added"
+nix profile add "$flake1Dir" 2>&1 | grep "warning: 'flake1' is already added"
 
 # Test upgrading a package.
-printf NixOS > $flake1Dir/who
-printf 2.0 > $flake1Dir/version
+printf NixOS > "$flake1Dir"/who
+printf 2.0 > "$flake1Dir"/version
 nix profile upgrade flake1
-[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello NixOS" ]]
+[[ $("$TEST_HOME"/.nix-profile/bin/hello) = "Hello NixOS" ]]
 nix profile history | grep "packages.$system.default: 1.0, 1.0-man -> 2.0, 2.0-man"
 
 # Test upgrading package using regular expression.
-printf 2.1 > $flake1Dir/version
+printf 2.1 > "$flake1Dir"/version
 nix profile upgrade --regex '.*'
-[[ $(readlink $TEST_HOME/.nix-profile/bin/hello) =~ .*-profile-test-2\.1/bin/hello ]]
+[[ $(readlink "$TEST_HOME"/.nix-profile/bin/hello) =~ .*-profile-test-2\.1/bin/hello ]]
 nix profile rollback
 
 # Test upgrading all packages
-printf 2.2 > $flake1Dir/version
+printf 2.2 > "$flake1Dir"/version
 nix profile upgrade --all
-[[ $(readlink $TEST_HOME/.nix-profile/bin/hello) =~ .*-profile-test-2\.2/bin/hello ]]
+[[ $(readlink "$TEST_HOME"/.nix-profile/bin/hello) =~ .*-profile-test-2\.2/bin/hello ]]
 nix profile rollback
-printf 1.0 > $flake1Dir/version
+printf 1.0 > "$flake1Dir"/version
 
 # Test --all exclusivity.
 assertStderr nix --offline profile upgrade --all foo << EOF
@@ -117,98 +119,102 @@ nix profile rollback
 nix profile diff-closures
 
 # Test rollback.
-printf World > $flake1Dir/who
+printf World > "$flake1Dir"/who
 nix profile upgrade flake1
-printf NixOS > $flake1Dir/who
+printf NixOS > "$flake1Dir"/who
 nix profile upgrade flake1
 nix profile rollback
-[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello World" ]]
+[[ $("$TEST_HOME"/.nix-profile/bin/hello) = "Hello World" ]]
 
 # Test uninstall.
-[ -e $TEST_HOME/.nix-profile/bin/foo ]
+[ -e "$TEST_HOME"/.nix-profile/bin/foo ]
+# shellcheck disable=SC2235
 nix profile remove foo 2>&1 | grep 'removed 1 packages'
-(! [ -e $TEST_HOME/.nix-profile/bin/foo ])
+# shellcheck disable=SC2235
+(! [ -e "$TEST_HOME"/.nix-profile/bin/foo ])
 nix profile history | grep 'foo: 1.0 -> ∅'
 nix profile diff-closures | grep 'Version 3 -> 4'
 
 # Test installing a non-flake package.
 nix profile add --file ./simple.nix ''
-[[ $(cat $TEST_HOME/.nix-profile/hello) = "Hello World!" ]]
+[[ $(cat "$TEST_HOME"/.nix-profile/hello) = "Hello World!" ]]
 nix profile remove simple 2>&1 | grep 'removed 1 packages'
-nix profile add $(nix-build --no-out-link ./simple.nix)
-[[ $(cat $TEST_HOME/.nix-profile/hello) = "Hello World!" ]]
+nix profile add "$(nix-build --no-out-link ./simple.nix)"
+[[ $(cat "$TEST_HOME"/.nix-profile/hello) = "Hello World!" ]]
 
 # Test packages with same name from different sources
-mkdir $TEST_ROOT/simple-too
-cp ./simple.nix "${config_nix}" simple.builder.sh $TEST_ROOT/simple-too
-nix profile add --file $TEST_ROOT/simple-too/simple.nix ''
+mkdir "$TEST_ROOT"/simple-too
+cp ./simple.nix "${config_nix}" simple.builder.sh "$TEST_ROOT"/simple-too
+nix profile add --file "$TEST_ROOT"/simple-too/simple.nix ''
 nix profile list | grep -A4 'Name:.*simple' | grep 'Name:.*simple-1'
 nix profile remove simple 2>&1 | grep 'removed 1 packages'
 nix profile remove simple-1 2>&1 | grep 'removed 1 packages'
 
 # Test wipe-history.
 nix profile wipe-history
-[[ $(nix profile history | grep Version | wc -l) -eq 1 ]]
+[[ $(nix profile history | grep -c Version) -eq 1 ]]
 
 # Test upgrade to CA package.
-printf true > $flake1Dir/ca.nix
-printf 3.0 > $flake1Dir/version
+printf true > "$flake1Dir"/ca.nix
+printf 3.0 > "$flake1Dir"/version
 nix profile upgrade flake1
 nix profile history | grep "packages.$system.default: 1.0, 1.0-man -> 3.0, 3.0-man"
 
 # Test new install of CA package.
 nix profile remove flake1 2>&1 | grep 'removed 1 packages'
-printf 4.0 > $flake1Dir/version
-printf Utrecht > $flake1Dir/who
-nix profile add $flake1Dir
-[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello Utrecht" ]]
-[[ $(nix path-info --json $(realpath $TEST_HOME/.nix-profile/bin/hello) | jq -r .[].ca) =~ fixed:r:sha256: ]]
+printf 4.0 > "$flake1Dir"/version
+printf Utrecht > "$flake1Dir"/who
+nix profile add "$flake1Dir"
+[[ $("$TEST_HOME"/.nix-profile/bin/hello) = "Hello Utrecht" ]]
+[[ $(nix path-info --json "$(realpath "$TEST_HOME"/.nix-profile/bin/hello)" | jq -r .[].ca) =~ fixed:r:sha256: ]]
 
 # Override the outputs.
 nix profile remove simple flake1
 nix profile add "$flake1Dir^*"
-[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello Utrecht" ]]
-[ -e $TEST_HOME/.nix-profile/share/man ]
-[ -e $TEST_HOME/.nix-profile/include ]
+[[ $("$TEST_HOME"/.nix-profile/bin/hello) = "Hello Utrecht" ]]
+[ -e "$TEST_HOME"/.nix-profile/share/man ]
+[ -e "$TEST_HOME"/.nix-profile/include ]
 
-printf Nix > $flake1Dir/who
+printf Nix > "$flake1Dir"/who
 nix profile list
 nix profile upgrade flake1
-[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello Nix" ]]
-[ -e $TEST_HOME/.nix-profile/share/man ]
-[ -e $TEST_HOME/.nix-profile/include ]
+[[ $("$TEST_HOME"/.nix-profile/bin/hello) = "Hello Nix" ]]
+[ -e "$TEST_HOME"/.nix-profile/share/man ]
+[ -e "$TEST_HOME"/.nix-profile/include ]
 
 nix profile remove flake1 2>&1 | grep 'removed 1 packages'
 nix profile add "$flake1Dir^man"
-(! [ -e $TEST_HOME/.nix-profile/bin/hello ])
-[ -e $TEST_HOME/.nix-profile/share/man ]
-(! [ -e $TEST_HOME/.nix-profile/include ])
+# shellcheck disable=SC2235
+(! [ -e "$TEST_HOME"/.nix-profile/bin/hello ])
+[ -e "$TEST_HOME"/.nix-profile/share/man ]
+# shellcheck disable=SC2235
+(! [ -e "$TEST_HOME"/.nix-profile/include ])
 
 # test priority
 nix profile remove flake1 2>&1 | grep 'removed 1 packages'
 
 # Make another flake.
 flake2Dir=$TEST_ROOT/flake2
-printf World > $flake1Dir/who
-cp -r $flake1Dir $flake2Dir
-printf World2 > $flake2Dir/who
+printf World > "$flake1Dir"/who
+cp -r "$flake1Dir" "$flake2Dir"
+printf World2 > "$flake2Dir"/who
 
-nix profile add $flake1Dir
-[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello World" ]]
-expect 1 nix profile add $flake2Dir
+nix profile add "$flake1Dir"
+[[ $("$TEST_HOME"/.nix-profile/bin/hello) = "Hello World" ]]
+expect 1 nix profile add "$flake2Dir"
 diff -u <(
-    nix --offline profile install $flake2Dir 2>&1 1> /dev/null \
+    nix --offline profile install "$flake2Dir" 2>&1 1> /dev/null \
         | grep -vE "^warning: " \
         | grep -vE "^error \(ignored\): " \
         || true
 ) <(cat << EOF
 error: An existing package already provides the following file:
 
-         $(nix build --no-link --print-out-paths ${flake1Dir}"#default.out")/bin/hello
+         $(nix build --no-link --print-out-paths "${flake1Dir}""#default.out")/bin/hello
 
        This is the conflicting file from the new package:
 
-         $(nix build --no-link --print-out-paths ${flake2Dir}"#default.out")/bin/hello
+         $(nix build --no-link --print-out-paths "${flake2Dir}""#default.out")/bin/hello
 
        To remove the existing package:
 
@@ -225,11 +231,11 @@ error: An existing package already provides the following file:
          nix profile add path:${flake2Dir}#packages.${system}.default --priority 6
 EOF
 )
-[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello World" ]]
-nix profile add $flake2Dir --priority 100
-[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello World" ]]
-nix profile add $flake2Dir --priority 0
-[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello World2" ]]
+[[ $("$TEST_HOME"/.nix-profile/bin/hello) = "Hello World" ]]
+nix profile add "$flake2Dir" --priority 100
+[[ $("$TEST_HOME"/.nix-profile/bin/hello) = "Hello World" ]]
+nix profile add "$flake2Dir" --priority 0
+[[ $("$TEST_HOME"/.nix-profile/bin/hello) = "Hello World2" ]]
 # nix profile add $flake1Dir --priority 100
 # [[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello World" ]]
 
@@ -237,14 +243,15 @@ nix profile add $flake2Dir --priority 0
 # flake references.
 # Regression test for https://github.com/NixOS/nix/issues/8284
 clearProfiles
-nix profile add $(nix build $flake1Dir --no-link --print-out-paths)
+# shellcheck disable=SC2046
+nix profile add $(nix build "$flake1Dir" --no-link --print-out-paths)
 expect 1 nix profile add --impure --expr "(builtins.getFlake ''$flake2Dir'').packages.$system.default"
 
 # Test upgrading from profile version 2.
 clearProfiles
-mkdir -p $TEST_ROOT/import-profile
-outPath=$(nix build --no-link --print-out-paths $flake1Dir/flake.nix^out)
-printf '{ "version": 2, "elements": [ { "active": true, "attrPath": "legacyPackages.x86_64-linux.hello", "originalUrl": "flake:nixpkgs", "outputs": null, "priority": 5, "storePaths": [ "%s" ], "url": "github:NixOS/nixpkgs/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" } ] }' "$outPath" > $TEST_ROOT/import-profile/manifest.json
-nix build --profile $TEST_HOME/.nix-profile $(nix store add-path $TEST_ROOT/import-profile) --no-link
+mkdir -p "$TEST_ROOT"/import-profile
+outPath=$(nix build --no-link --print-out-paths "$flake1Dir"/flake.nix^out)
+printf '{ "version": 2, "elements": [ { "active": true, "attrPath": "legacyPackages.x86_64-linux.hello", "originalUrl": "flake:nixpkgs", "outputs": null, "priority": 5, "storePaths": [ "%s" ], "url": "github:NixOS/nixpkgs/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" } ] }' "$outPath" > "$TEST_ROOT"/import-profile/manifest.json
+nix build --profile "$TEST_HOME"/.nix-profile "$(nix store add-path "$TEST_ROOT"/import-profile)" --no-link
 nix profile list | grep -A4 'Name:.*hello' | grep "Store paths:.*$outPath"
 nix profile remove hello 2>&1 | grep 'removed 1 packages, kept 0 packages'
diff --git a/tests/functional/nix-shell.sh b/tests/functional/nix-shell.sh
index bc49333b5..cf650e2c3 100755
--- a/tests/functional/nix-shell.sh
+++ b/tests/functional/nix-shell.sh
@@ -16,16 +16,19 @@ export NIX_PATH=nixpkgs="$shellDotNix"
 export IMPURE_VAR=foo
 export SELECTED_IMPURE_VAR=baz
 
+# shellcheck disable=SC2016
 output=$(nix-shell --pure "$shellDotNix" -A shellDrv --run \
     'echo "$IMPURE_VAR - $VAR_FROM_STDENV_SETUP - $VAR_FROM_NIX - $TEST_inNixShell"')
 
 [ "$output" = " - foo - bar - true" ]
 
+# shellcheck disable=SC2016
 output=$(nix-shell --pure "$shellDotNix" -A shellDrv --option nix-shell-always-looks-for-shell-nix false --run \
     'echo "$IMPURE_VAR - $VAR_FROM_STDENV_SETUP - $VAR_FROM_NIX - $TEST_inNixShell"')
 [ "$output" = " - foo - bar - true" ]
 
 # Test --keep
+# shellcheck disable=SC2016
 output=$(nix-shell --pure --keep SELECTED_IMPURE_VAR "$shellDotNix" -A shellDrv --run \
     'echo "$IMPURE_VAR - $VAR_FROM_STDENV_SETUP - $VAR_FROM_NIX - $SELECTED_IMPURE_VAR"')
 
@@ -34,6 +37,7 @@ output=$(nix-shell --pure --keep SELECTED_IMPURE_VAR "$shellDotNix" -A shellDrv
 # test NIX_BUILD_TOP
 testTmpDir=$(pwd)/nix-shell
 mkdir -p "$testTmpDir"
+# shellcheck disable=SC2016
 output=$(TMPDIR="$testTmpDir" nix-shell --pure "$shellDotNix" -A shellDrv --run 'echo $NIX_BUILD_TOP')
 [[ "$output" =~ ${testTmpDir}.* ]] || {
     echo "expected $output =~ ${testTmpDir}.*" >&2
@@ -41,105 +45,111 @@ output=$(TMPDIR="$testTmpDir" nix-shell --pure "$shellDotNix" -A shellDrv --run
 }
 
 # Test nix-shell on a .drv
-[[ $(nix-shell --pure $(nix-instantiate "$shellDotNix" -A shellDrv) --run \
+# shellcheck disable=SC2016
+[[ $(nix-shell --pure "$(nix-instantiate "$shellDotNix" -A shellDrv)" --run \
     'echo "$IMPURE_VAR - $VAR_FROM_STDENV_SETUP - $VAR_FROM_NIX - $TEST_inNixShell"') = " - foo - bar - false" ]]
-
-[[ $(nix-shell --pure $(nix-instantiate "$shellDotNix" -A shellDrv) --run \
+# shellcheck disable=SC2016
+[[ $(nix-shell --pure "$(nix-instantiate "$shellDotNix" -A shellDrv)" --run \
     'echo "$IMPURE_VAR - $VAR_FROM_STDENV_SETUP - $VAR_FROM_NIX - $TEST_inNixShell"') = " - foo - bar - false" ]]
 
 # Test nix-shell on a .drv symlink
 
 # Legacy: absolute path and .drv extension required
-nix-instantiate "$shellDotNix" -A shellDrv --add-root $TEST_ROOT/shell.drv
-[[ $(nix-shell --pure $TEST_ROOT/shell.drv --run \
+nix-instantiate "$shellDotNix" -A shellDrv --add-root "$TEST_ROOT"/shell.drv
+# shellcheck disable=SC2016
+[[ $(nix-shell --pure "$TEST_ROOT"/shell.drv --run \
     'echo "$IMPURE_VAR - $VAR_FROM_STDENV_SETUP - $VAR_FROM_NIX"') = " - foo - bar" ]]
 
 # New behaviour: just needs to resolve to a derivation in the store
-nix-instantiate "$shellDotNix" -A shellDrv --add-root $TEST_ROOT/shell
-[[ $(nix-shell --pure $TEST_ROOT/shell --run \
+nix-instantiate "$shellDotNix" -A shellDrv --add-root "$TEST_ROOT"/shell
+# shellcheck disable=SC2016
+[[ $(nix-shell --pure "$TEST_ROOT"/shell --run \
     'echo "$IMPURE_VAR - $VAR_FROM_STDENV_SETUP - $VAR_FROM_NIX"') = " - foo - bar" ]]
 
 # Test nix-shell -p
+# shellcheck disable=SC2016
 output=$(NIX_PATH=nixpkgs="$shellDotNix" nix-shell --pure -p foo bar --run 'echo "$(foo) $(bar)"')
 [ "$output" = "foo bar" ]
 
 # Test nix-shell -p --arg x y
+# shellcheck disable=SC2016
 output=$(NIX_PATH=nixpkgs="$shellDotNix" nix-shell --pure -p foo --argstr fooContents baz --run 'echo "$(foo)"')
 [ "$output" = "baz" ]
 
 # Test nix-shell shebang mode
-sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.sh > $TEST_ROOT/shell.shebang.sh
-chmod a+rx $TEST_ROOT/shell.shebang.sh
+sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.sh > "$TEST_ROOT"/shell.shebang.sh
+chmod a+rx "$TEST_ROOT"/shell.shebang.sh
 
-output=$($TEST_ROOT/shell.shebang.sh abc def)
+output=$("$TEST_ROOT"/shell.shebang.sh abc def)
 [ "$output" = "foo bar abc def" ]
 
 # Test nix-shell shebang mode with an alternate working directory
-sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.expr > $TEST_ROOT/shell.shebang.expr
-chmod a+rx $TEST_ROOT/shell.shebang.expr
+sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.expr > "$TEST_ROOT"/shell.shebang.expr
+chmod a+rx "$TEST_ROOT"/shell.shebang.expr
 # Should fail due to expressions using relative path
-! $TEST_ROOT/shell.shebang.expr bar
-cp shell.nix "${config_nix}" $TEST_ROOT
+ "$TEST_ROOT"/shell.shebang.expr bar && exit 1
+cp shell.nix "${config_nix}" "$TEST_ROOT"
 # Should succeed
 echo "cwd: $PWD"
-output=$($TEST_ROOT/shell.shebang.expr bar)
+output=$("$TEST_ROOT"/shell.shebang.expr bar)
 [ "$output" = foo ]
 
 # Test nix-shell shebang mode with an alternate working directory
-sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.legacy.expr > $TEST_ROOT/shell.shebang.legacy.expr
-chmod a+rx $TEST_ROOT/shell.shebang.legacy.expr
+sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.legacy.expr > "$TEST_ROOT"/shell.shebang.legacy.expr
+chmod a+rx "$TEST_ROOT"/shell.shebang.legacy.expr
 # Should fail due to expressions using relative path
 mkdir -p "$TEST_ROOT/somewhere-unrelated"
-output="$(cd "$TEST_ROOT/somewhere-unrelated"; $TEST_ROOT/shell.shebang.legacy.expr bar;)"
+output="$(cd "$TEST_ROOT/somewhere-unrelated"; "$TEST_ROOT"/shell.shebang.legacy.expr bar;)"
 [[ $(realpath "$output") = $(realpath "$TEST_ROOT/somewhere-unrelated") ]]
 
 # Test nix-shell shebang mode again with metacharacters in the filename.
 # First word of filename is chosen to not match any file in the test root.
-sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.sh > $TEST_ROOT/spaced\ \\\'\"shell.shebang.sh
-chmod a+rx $TEST_ROOT/spaced\ \\\'\"shell.shebang.sh
+sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.sh > "$TEST_ROOT"/spaced\ \\\'\"shell.shebang.sh
+chmod a+rx "$TEST_ROOT"/spaced\ \\\'\"shell.shebang.sh
 
-output=$($TEST_ROOT/spaced\ \\\'\"shell.shebang.sh abc def)
+output=$("$TEST_ROOT"/spaced\ \\\'\"shell.shebang.sh abc def)
 [ "$output" = "foo bar abc def" ]
 
 # Test nix-shell shebang mode for ruby
 # This uses a fake interpreter that returns the arguments passed
 # This, in turn, verifies the `rc` script is valid and the `load()` script (given using `-e`) is as expected.
-sed -e "s|@SHELL_PROG@|$(type -P nix-shell)|" shell.shebang.rb > $TEST_ROOT/shell.shebang.rb
-chmod a+rx $TEST_ROOT/shell.shebang.rb
+sed -e "s|@SHELL_PROG@|$(type -P nix-shell)|" shell.shebang.rb > "$TEST_ROOT"/shell.shebang.rb
+chmod a+rx "$TEST_ROOT"/shell.shebang.rb
 
-output=$($TEST_ROOT/shell.shebang.rb abc ruby)
+output=$("$TEST_ROOT"/shell.shebang.rb abc ruby)
 [ "$output" = '-e load(ARGV.shift) -- '"$TEST_ROOT"'/shell.shebang.rb abc ruby' ]
 
 # Test nix-shell shebang mode for ruby again with metacharacters in the filename.
 # Note: fake interpreter only space-separates args without adding escapes to its output.
-sed -e "s|@SHELL_PROG@|$(type -P nix-shell)|" shell.shebang.rb > $TEST_ROOT/spaced\ \\\'\"shell.shebang.rb
-chmod a+rx $TEST_ROOT/spaced\ \\\'\"shell.shebang.rb
+sed -e "s|@SHELL_PROG@|$(type -P nix-shell)|" shell.shebang.rb > "$TEST_ROOT"/spaced\ \\\'\"shell.shebang.rb
+chmod a+rx "$TEST_ROOT"/spaced\ \\\'\"shell.shebang.rb
 
-output=$($TEST_ROOT/spaced\ \\\'\"shell.shebang.rb abc ruby)
+output=$("$TEST_ROOT"/spaced\ \\\'\"shell.shebang.rb abc ruby)
+# shellcheck disable=SC1003
 [ "$output" = '-e load(ARGV.shift) -- '"$TEST_ROOT"'/spaced \'\''"shell.shebang.rb abc ruby' ]
 
 # Test nix-shell shebang quoting
-sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.nix > $TEST_ROOT/shell.shebang.nix
-chmod a+rx $TEST_ROOT/shell.shebang.nix
-$TEST_ROOT/shell.shebang.nix
+sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.nix > "$TEST_ROOT"/shell.shebang.nix
+chmod a+rx "$TEST_ROOT"/shell.shebang.nix
+"$TEST_ROOT"/shell.shebang.nix
 
-mkdir $TEST_ROOT/lookup-test $TEST_ROOT/empty
+mkdir "$TEST_ROOT"/lookup-test "$TEST_ROOT"/empty
 
-echo "import $shellDotNix" > $TEST_ROOT/lookup-test/shell.nix
-cp "${config_nix}" $TEST_ROOT/lookup-test/
-echo 'abort "do not load default.nix!"' > $TEST_ROOT/lookup-test/default.nix
+echo "import $shellDotNix" > "$TEST_ROOT"/lookup-test/shell.nix
+cp "${config_nix}" "$TEST_ROOT"/lookup-test/
+echo 'abort "do not load default.nix!"' > "$TEST_ROOT"/lookup-test/default.nix
 
-nix-shell $TEST_ROOT/lookup-test -A shellDrv --run 'echo "it works"' | grepQuiet "it works"
+nix-shell "$TEST_ROOT"/lookup-test -A shellDrv --run 'echo "it works"' | grepQuiet "it works"
 # https://github.com/NixOS/nix/issues/4529
 nix-shell -I "testRoot=$TEST_ROOT" '<testRoot/lookup-test>' -A shellDrv --run 'echo "it works"' | grepQuiet "it works"
 
-expectStderr 1 nix-shell $TEST_ROOT/lookup-test -A shellDrv --run 'echo "it works"' --option nix-shell-always-looks-for-shell-nix false \
+expectStderr 1 nix-shell "$TEST_ROOT"/lookup-test -A shellDrv --run 'echo "it works"' --option nix-shell-always-looks-for-shell-nix false \
   | grepQuiet -F "do not load default.nix!" # we did, because we chose to enable legacy behavior
-expectStderr 1 nix-shell $TEST_ROOT/lookup-test -A shellDrv --run 'echo "it works"' --option nix-shell-always-looks-for-shell-nix false \
+expectStderr 1 nix-shell "$TEST_ROOT"/lookup-test -A shellDrv --run 'echo "it works"' --option nix-shell-always-looks-for-shell-nix false \
   | grepQuiet "Skipping .*lookup-test/shell\.nix.*, because the setting .*nix-shell-always-looks-for-shell-nix.* is disabled. This is a deprecated behavior\. Consider enabling .*nix-shell-always-looks-for-shell-nix.*"
 
 (
-  cd $TEST_ROOT/empty;
+  cd "$TEST_ROOT"/empty;
   expectStderr 1 nix-shell | \
     grepQuiet "error.*no argument specified and no .*shell\.nix.* or .*default\.nix.* file found in the working directory"
 )
@@ -147,29 +157,29 @@ expectStderr 1 nix-shell $TEST_ROOT/lookup-test -A shellDrv --run 'echo "it work
 expectStderr 1 nix-shell -I "testRoot=$TEST_ROOT" '<testRoot/empty>' |
   grepQuiet "error.*neither .*shell\.nix.* nor .*default\.nix.* found in .*/empty"
 
-cat >$TEST_ROOT/lookup-test/shebangscript <<EOF
+cat >"$TEST_ROOT"/lookup-test/shebangscript <<EOF
 #!$(type -P env) nix-shell
 #!nix-shell -A shellDrv -i bash
 [[ \$VAR_FROM_NIX == bar ]]
 echo "script works"
 EOF
-chmod +x $TEST_ROOT/lookup-test/shebangscript
+chmod +x "$TEST_ROOT"/lookup-test/shebangscript
 
-$TEST_ROOT/lookup-test/shebangscript | grepQuiet "script works"
+"$TEST_ROOT"/lookup-test/shebangscript | grepQuiet "script works"
 
 # https://github.com/NixOS/nix/issues/5431
-mkdir $TEST_ROOT/marco{,/polo}
-echo 'abort "marco/shell.nix must not be used, but its mere existence used to cause #5431"' > $TEST_ROOT/marco/shell.nix
-cat >$TEST_ROOT/marco/polo/default.nix <<EOF
+mkdir "$TEST_ROOT"/marco{,/polo}
+echo 'abort "marco/shell.nix must not be used, but its mere existence used to cause #5431"' > "$TEST_ROOT"/marco/shell.nix
+cat >"$TEST_ROOT"/marco/polo/default.nix <<EOF
 #!$(type -P env) nix-shell
 (import $TEST_ROOT/lookup-test/shell.nix {}).polo
 EOF
-chmod a+x $TEST_ROOT/marco/polo/default.nix
-(cd $TEST_ROOT/marco && ./polo/default.nix | grepQuiet "Polo")
+chmod a+x "$TEST_ROOT"/marco/polo/default.nix
+(cd "$TEST_ROOT"/marco && ./polo/default.nix | grepQuiet "Polo")
 
 # https://github.com/NixOS/nix/issues/11892
-mkdir $TEST_ROOT/issue-11892
-cat >$TEST_ROOT/issue-11892/shebangscript <<EOF
+mkdir "$TEST_ROOT"/issue-11892
+cat >"$TEST_ROOT"/issue-11892/shebangscript <<EOF
 #!$(type -P env) nix-shell
 #! nix-shell -I nixpkgs=$shellDotNix
 #! nix-shell -p 'callPackage (import ./my_package.nix) {}'
@@ -177,7 +187,7 @@ cat >$TEST_ROOT/issue-11892/shebangscript <<EOF
 set -euxo pipefail
 my_package
 EOF
-cat >$TEST_ROOT/issue-11892/my_package.nix <<EOF
+cat >"$TEST_ROOT"/issue-11892/my_package.nix <<EOF
 { stdenv, shell, ... }:
 stdenv.mkDerivation {
   name = "my_package";
@@ -191,8 +201,8 @@ stdenv.mkDerivation {
   '';
 }
 EOF
-chmod a+x $TEST_ROOT/issue-11892/shebangscript
-$TEST_ROOT/issue-11892/shebangscript \
+chmod a+x "$TEST_ROOT"/issue-11892/shebangscript
+"$TEST_ROOT"/issue-11892/shebangscript \
   | tee /dev/stderr \
   | grepQuiet "ok baz11892"
 
@@ -202,6 +212,7 @@ $TEST_ROOT/issue-11892/shebangscript \
 #####################
 
 # Test 'nix develop'.
+# shellcheck disable=SC2016
 nix develop -f "$shellDotNix" shellDrv -c bash -c '[[ -n $stdenv ]]'
 
 # Ensure `nix develop -c` preserves stdin
@@ -212,23 +223,24 @@ nix develop -f "$shellDotNix" shellDrv -c echo foo |& grepQuiet foo
 
 # Test 'nix print-dev-env'.
 
-nix print-dev-env -f "$shellDotNix" shellDrv > $TEST_ROOT/dev-env.sh
-nix print-dev-env -f "$shellDotNix" shellDrv --json > $TEST_ROOT/dev-env.json
+nix print-dev-env -f "$shellDotNix" shellDrv > "$TEST_ROOT"/dev-env.sh
+nix print-dev-env -f "$shellDotNix" shellDrv --json > "$TEST_ROOT"/dev-env.json
 
 # Test with raw drv
 
 shellDrv=$(nix-instantiate "$shellDotNix" -A shellDrv.out)
 
-nix develop $shellDrv -c bash -c '[[ -n $stdenv ]]'
+# shellcheck disable=SC2016
+nix develop "$shellDrv" -c bash -c '[[ -n $stdenv ]]'
 
-nix print-dev-env $shellDrv > $TEST_ROOT/dev-env2.sh
-nix print-dev-env $shellDrv --json > $TEST_ROOT/dev-env2.json
+nix print-dev-env "$shellDrv" > "$TEST_ROOT"/dev-env2.sh
+nix print-dev-env "$shellDrv" --json > "$TEST_ROOT"/dev-env2.json
 
-diff $TEST_ROOT/dev-env{,2}.sh
-diff $TEST_ROOT/dev-env{,2}.json
+diff "$TEST_ROOT"/dev-env{,2}.sh
+diff "$TEST_ROOT"/dev-env{,2}.json
 
 # Ensure `nix print-dev-env --json` contains variable assignments.
-[[ $(jq -r .variables.arr1.value[2] $TEST_ROOT/dev-env.json) = '3 4' ]]
+[[ $(jq -r .variables.arr1.value[2] "$TEST_ROOT"/dev-env.json) = '3 4' ]]
 
 # Run tests involving `source <(nix print-dev-env)` in subshells to avoid modifying the current
 # environment.
@@ -238,27 +250,32 @@ set -u
 # Ensure `source <(nix print-dev-env)` modifies the environment.
 (
     path=$PATH
-    source $TEST_ROOT/dev-env.sh
+    # shellcheck disable=SC1091
+    source "$TEST_ROOT"/dev-env.sh
     [[ -n $stdenv ]]
+    # shellcheck disable=SC2154
     [[ ${arr1[2]} = "3 4" ]]
+    # shellcheck disable=SC2154
     [[ ${arr2[1]} = $'\n' ]]
     [[ ${arr2[2]} = $'x\ny' ]]
     [[ $(fun) = blabla ]]
-    [[ $PATH = $(jq -r .variables.PATH.value $TEST_ROOT/dev-env.json):$path ]]
+    [[ $PATH = $(jq -r .variables.PATH.value "$TEST_ROOT"/dev-env.json):$path ]]
 )
 
 # Ensure `source <(nix print-dev-env)` handles the case when PATH is empty.
 (
     path=$PATH
+    # shellcheck disable=SC2123
     PATH=
-    source $TEST_ROOT/dev-env.sh
-    [[ $PATH = $(PATH=$path jq -r .variables.PATH.value $TEST_ROOT/dev-env.json) ]]
+    # shellcheck disable=SC1091
+    source "$TEST_ROOT"/dev-env.sh
+    [[ $PATH = $(PATH=$path jq -r .variables.PATH.value "$TEST_ROOT"/dev-env.json) ]]
 )
 
 # Test nix-shell with ellipsis and no `inNixShell` argument (for backwards compat with old nixpkgs)
-cat >$TEST_ROOT/shell-ellipsis.nix <<EOF
+cat >"$TEST_ROOT"/shell-ellipsis.nix <<EOF
 { system ? "x86_64-linux", ... }@args:
 assert (!(args ? inNixShell));
 (import $shellDotNix { }).shellDrv
 EOF
-nix-shell $TEST_ROOT/shell-ellipsis.nix --run "true"
+nix-shell "$TEST_ROOT"/shell-ellipsis.nix --run "true"
diff --git a/tests/functional/nix_path.sh b/tests/functional/nix_path.sh
index 90cba1f0c..24ddcdd01 100755
--- a/tests/functional/nix_path.sh
+++ b/tests/functional/nix_path.sh
@@ -34,12 +34,13 @@ nix-instantiate --eval -E '<by-relative-path/simple.nix>' --restrict-eval
 
 unset NIX_PATH
 
-mkdir -p $TEST_ROOT/{from-nix-path-file,from-NIX_PATH,from-nix-path,from-extra-nix-path,from-I}
+mkdir -p "$TEST_ROOT"/{from-nix-path-file,from-NIX_PATH,from-nix-path,from-extra-nix-path,from-I}
 for i in from-nix-path-file from-NIX_PATH from-nix-path from-extra-nix-path from-I; do
-    touch $TEST_ROOT/$i/only-$i.nix
+    touch "$TEST_ROOT"/$i/only-$i.nix
 done
 
 # finding something that's not in any of the default paths fails
+# shellcheck disable=SC2091
 ( ! $(nix-instantiate --find-file test) )
 
 echo "nix-path = test=$TEST_ROOT/from-nix-path-file" >> "$test_nix_conf"
@@ -53,36 +54,36 @@ echo "nix-path = test=$TEST_ROOT/from-nix-path-file" >> "$test_nix_conf"
 (! NIX_PATH=test=$TEST_ROOT nix-instantiate --find-file test/only-from-nix-path-file.nix)
 
 # -I extends nix.conf
-[[ $(nix-instantiate -I test=$TEST_ROOT/from-I --find-file test/only-from-I.nix) = $TEST_ROOT/from-I/only-from-I.nix ]]
+[[ $(nix-instantiate -I test="$TEST_ROOT"/from-I --find-file test/only-from-I.nix) = $TEST_ROOT/from-I/only-from-I.nix ]]
 # if -I does not have the desired entry, the value from nix.conf is used
-[[ $(nix-instantiate -I test=$TEST_ROOT/from-I --find-file test/only-from-nix-path-file.nix) = $TEST_ROOT/from-nix-path-file/only-from-nix-path-file.nix ]]
+[[ $(nix-instantiate -I test="$TEST_ROOT"/from-I --find-file test/only-from-nix-path-file.nix) = $TEST_ROOT/from-nix-path-file/only-from-nix-path-file.nix ]]
 
 # -I extends NIX_PATH
-[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate -I test=$TEST_ROOT/from-I --find-file test/only-from-I.nix) = $TEST_ROOT/from-I/only-from-I.nix ]]
+[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate -I test="$TEST_ROOT"/from-I --find-file test/only-from-I.nix) = $TEST_ROOT/from-I/only-from-I.nix ]]
 # -I takes precedence over NIX_PATH
-[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate -I test=$TEST_ROOT/from-I --find-file test) = $TEST_ROOT/from-I ]]
+[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate -I test="$TEST_ROOT"/from-I --find-file test) = $TEST_ROOT/from-I ]]
 # if -I does not have the desired entry, the value from NIX_PATH is used
-[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate -I test=$TEST_ROOT/from-I --find-file test/only-from-NIX_PATH.nix) = $TEST_ROOT/from-NIX_PATH/only-from-NIX_PATH.nix ]]
+[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate -I test="$TEST_ROOT"/from-I --find-file test/only-from-NIX_PATH.nix) = $TEST_ROOT/from-NIX_PATH/only-from-NIX_PATH.nix ]]
 
 # --extra-nix-path extends NIX_PATH
-[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate --extra-nix-path test=$TEST_ROOT/from-extra-nix-path --find-file test/only-from-extra-nix-path.nix) = $TEST_ROOT/from-extra-nix-path/only-from-extra-nix-path.nix ]]
+[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate --extra-nix-path test="$TEST_ROOT"/from-extra-nix-path --find-file test/only-from-extra-nix-path.nix) = $TEST_ROOT/from-extra-nix-path/only-from-extra-nix-path.nix ]]
 # if --extra-nix-path does not have the desired entry, the value from NIX_PATH is used
-[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate --extra-nix-path test=$TEST_ROOT/from-extra-nix-path --find-file test/only-from-NIX_PATH.nix) = $TEST_ROOT/from-NIX_PATH/only-from-NIX_PATH.nix ]]
+[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate --extra-nix-path test="$TEST_ROOT"/from-extra-nix-path --find-file test/only-from-NIX_PATH.nix) = $TEST_ROOT/from-NIX_PATH/only-from-NIX_PATH.nix ]]
 
 # --nix-path overrides NIX_PATH
-[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate --nix-path test=$TEST_ROOT/from-nix-path --find-file test) = $TEST_ROOT/from-nix-path ]]
+[[ $(NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate --nix-path test="$TEST_ROOT"/from-nix-path --find-file test) = $TEST_ROOT/from-nix-path ]]
 # if --nix-path does not have the desired entry, it fails
-(! NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate --nix-path test=$TEST_ROOT/from-nix-path --find-file test/only-from-NIX_PATH.nix)
+(! NIX_PATH=test=$TEST_ROOT/from-NIX_PATH nix-instantiate --nix-path test="$TEST_ROOT"/from-nix-path --find-file test/only-from-NIX_PATH.nix)
 
 # --nix-path overrides nix.conf
-[[ $(nix-instantiate --nix-path test=$TEST_ROOT/from-nix-path --find-file test) = $TEST_ROOT/from-nix-path ]]
-(! nix-instantiate --nix-path test=$TEST_ROOT/from-nix-path --find-file test/only-from-nix-path-file.nix)
+[[ $(nix-instantiate --nix-path test="$TEST_ROOT"/from-nix-path --find-file test) = $TEST_ROOT/from-nix-path ]]
+(! nix-instantiate --nix-path test="$TEST_ROOT"/from-nix-path --find-file test/only-from-nix-path-file.nix)
 
 # --extra-nix-path extends nix.conf
-[[ $(nix-instantiate --extra-nix-path test=$TEST_ROOT/from-extra-nix-path --find-file test/only-from-extra-nix-path.nix) = $TEST_ROOT/from-extra-nix-path/only-from-extra-nix-path.nix ]]
+[[ $(nix-instantiate --extra-nix-path test="$TEST_ROOT"/from-extra-nix-path --find-file test/only-from-extra-nix-path.nix) = $TEST_ROOT/from-extra-nix-path/only-from-extra-nix-path.nix ]]
 # if --extra-nix-path does not have the desired entry, it is taken from nix.conf
-[[ $(nix-instantiate --extra-nix-path test=$TEST_ROOT/from-extra-nix-path --find-file test) = $TEST_ROOT/from-nix-path-file ]]
+[[ $(nix-instantiate --extra-nix-path test="$TEST_ROOT"/from-extra-nix-path --find-file test) = $TEST_ROOT/from-nix-path-file ]]
 
 # -I extends --nix-path
-[[ $(nix-instantiate --nix-path test=$TEST_ROOT/from-nix-path -I test=$TEST_ROOT/from-I --find-file test/only-from-I.nix) = $TEST_ROOT/from-I/only-from-I.nix ]]
-[[ $(nix-instantiate --nix-path test=$TEST_ROOT/from-nix-path -I test=$TEST_ROOT/from-I --find-file test/only-from-nix-path.nix) = $TEST_ROOT/from-nix-path/only-from-nix-path.nix ]]
+[[ $(nix-instantiate --nix-path test="$TEST_ROOT"/from-nix-path -I test="$TEST_ROOT"/from-I --find-file test/only-from-I.nix) = $TEST_ROOT/from-I/only-from-I.nix ]]
+[[ $(nix-instantiate --nix-path test="$TEST_ROOT"/from-nix-path -I test="$TEST_ROOT"/from-I --find-file test/only-from-nix-path.nix) = $TEST_ROOT/from-nix-path/only-from-nix-path.nix ]]
diff --git a/tests/functional/optimise-store.sh b/tests/functional/optimise-store.sh
index 05c4c41e4..332a308c2 100755
--- a/tests/functional/optimise-store.sh
+++ b/tests/functional/optimise-store.sh
@@ -4,28 +4,31 @@ source common.sh
 
 clearStoreIfPossible
 
+# shellcheck disable=SC2016
 outPath1=$(echo 'with import '"${config_nix}"'; mkDerivation { name = "foo1"; builder = builtins.toFile "builder" "mkdir $out; echo hello > $out/foo"; }' | nix-build - --no-out-link --auto-optimise-store)
+# shellcheck disable=SC2016
 outPath2=$(echo 'with import '"${config_nix}"'; mkDerivation { name = "foo2"; builder = builtins.toFile "builder" "mkdir $out; echo hello > $out/foo"; }' | nix-build - --no-out-link --auto-optimise-store)
 
 TODO_NixOS # ignoring the client-specified setting 'auto-optimise-store', because it is a restricted setting and you are not a trusted user
   # TODO: only continue when trusted user or root
 
-inode1="$(stat --format=%i $outPath1/foo)"
-inode2="$(stat --format=%i $outPath2/foo)"
+inode1="$(stat --format=%i "$outPath1"/foo)"
+inode2="$(stat --format=%i "$outPath2"/foo)"
 if [ "$inode1" != "$inode2" ]; then
     echo "inodes do not match"
     exit 1
 fi
 
-nlink="$(stat --format=%h $outPath1/foo)"
+nlink="$(stat --format=%h "$outPath1"/foo)"
 if [ "$nlink" != 3 ]; then
     echo "link count incorrect"
     exit 1
 fi
 
+# shellcheck disable=SC2016
 outPath3=$(echo 'with import '"${config_nix}"'; mkDerivation { name = "foo3"; builder = builtins.toFile "builder" "mkdir $out; echo hello > $out/foo"; }' | nix-build - --no-out-link)
 
-inode3="$(stat --format=%i $outPath3/foo)"
+inode3="$(stat --format=%i "$outPath3"/foo)"
 if [ "$inode1" = "$inode3" ]; then
     echo "inodes match unexpectedly"
     exit 1
@@ -34,8 +37,8 @@ fi
 # XXX: This should work through the daemon too
 NIX_REMOTE="" nix-store --optimise
 
-inode1="$(stat --format=%i $outPath1/foo)"
-inode3="$(stat --format=%i $outPath3/foo)"
+inode1="$(stat --format=%i "$outPath1"/foo)"
+inode3="$(stat --format=%i "$outPath3"/foo)"
 if [ "$inode1" != "$inode3" ]; then
     echo "inodes do not match"
     exit 1
@@ -43,7 +46,7 @@ fi
 
 nix-store --gc
 
-if [ -n "$(ls $NIX_STORE_DIR/.links)" ]; then
+if [ -n "$(ls "$NIX_STORE_DIR"/.links)" ]; then
     echo ".links directory not empty after GC"
     exit 1
 fi
diff --git a/tests/functional/output-normalization.sh b/tests/functional/output-normalization.sh
index c55f1b1d1..bd1668db9 100755
--- a/tests/functional/output-normalization.sh
+++ b/tests/functional/output-normalization.sh
@@ -6,7 +6,7 @@ testNormalization () {
     TODO_NixOS
     clearStore
     outPath=$(nix-build ./simple.nix --no-out-link)
-    test "$(stat -c %Y $outPath)" -eq 1
+    test "$(stat -c %Y "$outPath")" -eq 1
 }
 
 testNormalization
diff --git a/tests/functional/parallel.builder.sh b/tests/functional/parallel.builder.sh
index d092bc5a6..436246571 100644
--- a/tests/functional/parallel.builder.sh
+++ b/tests/functional/parallel.builder.sh
@@ -1,29 +1,31 @@
+# shellcheck shell=bash
+# shellcheck disable=SC2154
 echo "DOING $text"
 
 
 # increase counter
-while ! ln -s x $shared.lock 2> /dev/null; do
+while ! ln -s x "$shared".lock 2> /dev/null; do
     sleep 1
 done
-test -f $shared.cur || echo 0 > $shared.cur
-test -f $shared.max || echo 0 > $shared.max
-new=$(($(cat $shared.cur) + 1))
-if test $new -gt $(cat $shared.max); then
-    echo $new > $shared.max
+test -f "$shared".cur || echo 0 > "$shared".cur
+test -f "$shared".max || echo 0 > "$shared".max
+new=$(($(cat "$shared".cur) + 1))
+if test $new -gt "$(cat "$shared".max)"; then
+    echo $new > "$shared".max
 fi
-echo $new > $shared.cur
-rm $shared.lock
+echo $new > "$shared".cur
+rm "$shared".lock
 
 
-echo -n $(cat $inputs)$text > $out
+echo -n "$(cat "$inputs")""$text" > "$out"
 
-sleep $sleepTime
+sleep "$sleepTime"
 
 
 # decrease counter
-while ! ln -s x $shared.lock 2> /dev/null; do
+while ! ln -s x "$shared".lock 2> /dev/null; do
     sleep 1
 done
-test -f $shared.cur || echo 0 > $shared.cur
-echo $(($(cat $shared.cur) - 1)) > $shared.cur
-rm $shared.lock
+test -f "$shared".cur || echo 0 > "$shared".cur
+echo $(($(cat "$shared".cur) - 1)) > "$shared".cur
+rm "$shared".lock
diff --git a/tests/functional/parallel.sh b/tests/functional/parallel.sh
index 7e420688d..4d0bf0f1b 100644
--- a/tests/functional/parallel.sh
+++ b/tests/functional/parallel.sh
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 source common.sh
 
 
@@ -8,7 +9,7 @@ TODO_NixOS
 
 clearStore
 
-rm -f $_NIX_TEST_SHARED.cur $_NIX_TEST_SHARED.max
+rm -f "$_NIX_TEST_SHARED".cur "$_NIX_TEST_SHARED".max
 
 outPath=$(nix-build -j10000 parallel.nix --no-out-link)
 
@@ -17,8 +18,8 @@ echo "output path is $outPath"
 text=$(cat "$outPath")
 if test "$text" != "abacade"; then exit 1; fi
 
-if test "$(cat $_NIX_TEST_SHARED.cur)" != 0; then fail "wrong current process count"; fi
-if test "$(cat $_NIX_TEST_SHARED.max)" != 3; then fail "not enough parallelism"; fi
+if test "$(cat "$_NIX_TEST_SHARED".cur)" != 0; then fail "wrong current process count"; fi
+if test "$(cat "$_NIX_TEST_SHARED".max)" != 3; then fail "not enough parallelism"; fi
 
 
 # Second, test that parallel invocations of nix-build perform builds
@@ -27,7 +28,7 @@ echo "testing multiple nix-build -j1..."
 
 clearStore
 
-rm -f $_NIX_TEST_SHARED.cur $_NIX_TEST_SHARED.max
+rm -f "$_NIX_TEST_SHARED".cur "$_NIX_TEST_SHARED".max
 
 drvPath=$(nix-instantiate parallel.nix --argstr sleepTime 15)
 
@@ -54,5 +55,5 @@ wait $pid2 || fail "instance 2 failed: $?"
 wait $pid3 || fail "instance 3 failed: $?"
 wait $pid4 || fail "instance 4 failed: $?"
 
-if test "$(cat $_NIX_TEST_SHARED.cur)" != 0; then fail "wrong current process count"; fi
-if test "$(cat $_NIX_TEST_SHARED.max)" != 3; then fail "not enough parallelism"; fi
+if test "$(cat "$_NIX_TEST_SHARED".cur)" != 0; then fail "wrong current process count"; fi
+if test "$(cat "$_NIX_TEST_SHARED".max)" != 3; then fail "not enough parallelism"; fi