diff --git a/hack/update-bazel.sh b/hack/update-bazel.sh
index b32b850967eb..a00bd54e3d08 100755
--- a/hack/update-bazel.sh
+++ b/hack/update-bazel.sh
@@ -17,8 +17,9 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-export KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+export KUBE_ROOT
 
-cd $KUBE_ROOT
-find $KUBE_ROOT/vendor -name 'BUILD' -delete
+cd "${KUBE_ROOT}"
+find "${KUBE_ROOT}/vendor" -name 'BUILD' -delete
 bazel run //:gazelle
diff --git a/hack/verify_clientset.sh b/hack/verify_clientset.sh
index 939c8734814e..8554bbac042f 100755
--- a/hack/verify_clientset.sh
+++ b/hack/verify_clientset.sh
@@ -18,11 +18,12 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")/..
+SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 DIFFROOT="${SCRIPT_ROOT}/pkg/client"
 TMP_DIFFROOT="${SCRIPT_ROOT}/_tmp/pkg"
 _tmp="${SCRIPT_ROOT}/_tmp"
 GOPATH=$(go env GOPATH)
+export GOPATH
 
 cleanup() {
     rm -rf "${_tmp}"
diff --git a/scripts/ci-build.sh b/scripts/ci-build.sh
index 132ec8260732..fbd9fca08251 100755
--- a/scripts/ci-build.sh
+++ b/scripts/ci-build.sh
@@ -18,6 +18,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-REPO_ROOT=$(dirname "${BASH_SOURCE}")/..
+REPO_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
-cd $REPO_ROOT && make manager clusterctl
+cd "$REPO_ROOT" && make manager clusterctl
diff --git a/scripts/ci-integration.sh b/scripts/ci-integration.sh
index 5d664c3369d2..777125b09691 100755
--- a/scripts/ci-integration.sh
+++ b/scripts/ci-integration.sh
@@ -38,7 +38,7 @@ install_kubectl() {
 }
 
 build_containers() {
-   VERSION=$(git describe --exact-match 2> /dev/null || git describe --match=$(git rev-parse --short=8 HEAD) --always --dirty --abbrev=8)
+   VERSION="$(git describe --exact-match 2> /dev/null || git describe --match="$(git rev-parse --short=8 HEAD)" --always --dirty --abbrev=8)"
    CONTROLLER_IMG="${CONTROLLER_REPO}:${VERSION}"
    EXAMPLE_PROVIDER_IMG="${EXAMPLE_PROVIDER_REPO}:${VERSION}"
    export CONTROLLER_IMG="${CONTROLLER_IMG}"
@@ -58,7 +58,8 @@ prepare_crd_yaml() {
 create_bootstrap() {
    go get sigs.k8s.io/kind
    kind create cluster --name "${BOOTSTRAP_CLUSTER_NAME}"
-   export KUBECONFIG="$(kind get kubeconfig-path --name="${BOOTSTRAP_CLUSTER_NAME}")"
+   KUBECONFIG="$(kind get kubeconfig-path --name="${BOOTSTRAP_CLUSTER_NAME}")"
+   export KUBECONFIG
 
    kind load docker-image "${CONTROLLER_IMG}" --name "${BOOTSTRAP_CLUSTER_NAME}"
    kind load docker-image "${EXAMPLE_PROVIDER_IMG}" --name "${BOOTSTRAP_CLUSTER_NAME}"
diff --git a/scripts/ci-is-vendor-in-sync.sh b/scripts/ci-is-vendor-in-sync.sh
index 71c11a718ab6..d4d04d935539 100755
--- a/scripts/ci-is-vendor-in-sync.sh
+++ b/scripts/ci-is-vendor-in-sync.sh
@@ -18,8 +18,8 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-REPO_ROOT=$(dirname "${BASH_SOURCE}")/..
+REPO_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
-cd $REPO_ROOT
+cd "$REPO_ROOT"
 find vendor -name 'BUILD.bazel' -delete
 dep check
diff --git a/scripts/ci-make.sh b/scripts/ci-make.sh
index 7c55a20df6b4..542f741cb9d6 100755
--- a/scripts/ci-make.sh
+++ b/scripts/ci-make.sh
@@ -18,6 +18,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-REPO_ROOT=$(dirname "${BASH_SOURCE}")/..
+REPO_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
-cd $REPO_ROOT && make lint-full docker-build
+cd "$REPO_ROOT" && make lint-full docker-build
diff --git a/scripts/ci-test.sh b/scripts/ci-test.sh
index 909cf601282e..a697bc3b86be 100755
--- a/scripts/ci-test.sh
+++ b/scripts/ci-test.sh
@@ -18,9 +18,9 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-REPO_ROOT=$(dirname "${BASH_SOURCE}")/..
+REPO_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
-cd $REPO_ROOT && \
+cd "$REPO_ROOT" && \
 	source ./scripts/fetch_ext_bins.sh && \
 	fetch_tools && \
 	setup_envs && \
diff --git a/scripts/fetch_ext_bins.sh b/scripts/fetch_ext_bins.sh
index 7b0f29173ece..fcb4aa7e702c 100755
--- a/scripts/fetch_ext_bins.sh
+++ b/scripts/fetch_ext_bins.sh
@@ -59,11 +59,9 @@ function header_text {
   echo "$header$*$reset"
 }
 
-rc=0
 tmp_root=/tmp
 
 kb_root_dir=$tmp_root/kubebuilder
-kb_orig=$(pwd)
 
 # Skip fetching and untaring the tools by setting the SKIP_FETCH_TOOLS variable
 # in your environment to any value: