diff --git a/packages/devops/scripts/ci/utils.sh b/packages/devops/scripts/ci/utils.sh
index 8002798022..23813a8ad4 100755
--- a/packages/devops/scripts/ci/utils.sh
+++ b/packages/devops/scripts/ci/utils.sh
@@ -12,15 +12,15 @@ function log_with_color() {
 }
 
 function log_error() {
-    log_with_color "$1" $COLOR_RED
+    log_with_color "$1" "$COLOR_RED"
 }
 
 function log_warn() {
-    log_with_color "$1" $COLOR_YELLOW
+    log_with_color "$1" "$COLOR_YELLOW"
 }
 
 function log_success() {
-    log_with_color "$1" $COLOR_GREEN
+    log_with_color "$1" "$COLOR_GREEN"
 }
 
 function get_max_length() {
@@ -30,11 +30,11 @@ function get_max_length() {
     for item in "${array[@]}"; do
         length=${#item}
         if (( length > max )); then
-            max=$length
+            max="$length"
         fi
     done
 
-    echo $max
+    echo "$max"
 }
 
 function get_branch_name() {
@@ -44,5 +44,5 @@ function get_branch_name() {
         branch_name=$(git rev-parse --abbrev-ref HEAD)
     fi
 
-    echo $branch_name
+    echo "$branch_name"
 }
\ No newline at end of file
diff --git a/packages/devops/scripts/ci/validateNewMigrations.sh b/packages/devops/scripts/ci/validateNewMigrations.sh
index 41c7eaa5e7..f0b8661179 100755
--- a/packages/devops/scripts/ci/validateNewMigrations.sh
+++ b/packages/devops/scripts/ci/validateNewMigrations.sh
@@ -4,7 +4,7 @@ set -e
 DIR=$(dirname "$0")
 ROOT="${DIR}/../../../../"
 
-. ${DIR}/utils.sh
+. "$DIR/utils.sh"
 
 function get_date_command() {
   if [[ $(uname) = Darwin ]]; then
@@ -35,7 +35,7 @@ function check_migration_outdated() {
   day=${migration_name:39:2}
   migration_timestamp=$($date_command -d "${year}-${month}-${day}" +%s)
 
-  if (( $migration_timestamp < $included_migrations_timestamp )); then
+  if (( migration_timestamp < included_migrations_timestamp )); then
     log_error "❌ New migration should be created after $valid_migration_date. Invalid migration name: '$migration_name'"
   fi
 }
@@ -44,7 +44,7 @@ function validate_migrations(){
     local current_branch_name=$1
     local origin_branch_name=$2
     local migrations_dir="${ROOT}/packages/database/src/migrations"
-    local new_migration_names_in_string=$(git diff --diff-filter=A --name-only $origin_branch_name $current_branch_name $migrations_dir)
+    local new_migration_names_in_string=$(git diff --diff-filter=A --name-only "$origin_branch_name" "$current_branch_name" "$migrations_dir")
     local errors="";
 
     while read -r migration_name; do
@@ -55,7 +55,7 @@ function validate_migrations(){
     done <<< "$new_migration_names_in_string"
 
     if [[ $errors != '' ]]; then
-        echo $errors;
+        echo "$errors";
         exit 1;
     fi
 }
@@ -74,11 +74,11 @@ fi
 git remote remove origin
 git remote add origin https://github.com/beyondessential/tupaia.git
 # Remove this sub module because it uses ssh 
-git rm $ROOT/packages/data-api/scripts/pg-mv-fast-refresh
+git rm "$ROOT/packages/data-api/scripts/pg-mv-fast-refresh"
 
 git fetch --quiet
 git fetch origin $origin_branch_name:$origin_branch_name --quiet
-validate_migrations $current_branch_name $origin_branch_name
+validate_migrations "$current_branch_name" "$origin_branch_name"
 
 log_success "✔ New migrations are valid!"
-exit 0
\ No newline at end of file
+exit 0
diff --git a/packages/devops/scripts/deployment/startBackEnds.sh b/packages/devops/scripts/deployment/startBackEnds.sh
index 857d345c67..df367ebb06 100755
--- a/packages/devops/scripts/deployment/startBackEnds.sh
+++ b/packages/devops/scripts/deployment/startBackEnds.sh
@@ -1,18 +1,18 @@
 #!/bin/bash -le
 
 DIR=$(dirname "$0")
-TUPAIA_DIR=$DIR/../../../..
-PACKAGES=$(${TUPAIA_DIR}/scripts/bash/getDeployablePackages.sh)
+TUPAIA_DIR="$DIR/../../../.."
+PACKAGES=$("$TUPAIA_DIR/scripts/bash/getDeployablePackages.sh")
 
 # Initialise NVM (which sets the path for access to npm, yarn etc. as well)
 . $HOME/.nvm/nvm.sh
 
 # Start back end server packages
-for PACKAGE in ${PACKAGES[@]}; do
+for PACKAGE in "${PACKAGES[@]}"; do
     if [[ $PACKAGE = *server ]]; then
         if [[ $PACKAGE = central-server ]]; then
             # reset cwd back to `/tupaia`
-            cd ${TUPAIA_DIR}
+            cd "$TUPAIA_DIR"
 
             # ensure that the analytics table is fully built
             echo 'Building analytics table'
@@ -26,13 +26,13 @@ for PACKAGE in ${PACKAGES[@]}; do
 
         # It's a server, start the pm2 process
         echo "Starting ${PACKAGE}"
-        cd ${TUPAIA_DIR}/packages/$PACKAGE
+        cd "$TUPAIA_DIR/packages/$PACKAGE"
         REPLICATION_PM2_CONFIG=''
         if [[ $PACKAGE = web-config-server || $PACKAGE = report-server ]] ; then
             # as many replicas as cpu cores - 1
             REPLICATION_PM2_CONFIG='-i -1'
         fi
-        pm2 start --name $PACKAGE dist --wait-ready --listen-timeout 15000 --time $REPLICATION_PM2_CONFIG
+        pm2 start --name "$PACKAGE" dist --wait-ready --listen-timeout 15000 --time "$REPLICATION_PM2_CONFIG"
     fi
 done
 
diff --git a/scripts/bash/backendStartDev.sh b/scripts/bash/backendStartDev.sh
index 348374d57e..ca821c8f8b 100755
--- a/scripts/bash/backendStartDev.sh
+++ b/scripts/bash/backendStartDev.sh
@@ -49,14 +49,14 @@ echo -e "${BOLD}Starting server...${RESET}"
 
 if [[ $include_internal = true ]]; then
     echo 'Internal dependencies are under watch for hot reload'
-    for PACKAGE in $(${DIR}/getInternalDependencies.sh .); do
-        watch_flags="${watch_flags} --watch ../${PACKAGE}/dist"
+    for PACKAGE in $("$DIR/getInternalDependencies.sh" .); do
+        watch_flags="$watch_flags --watch ../$PACKAGE/dist"
     done
     # add the watch flags to the server start process, as well as a 1 second delay to debounce the
     # many restarts that otherwise happen during the initial build of internal dependencies
-    start_server="${start_server} --delay 1 ${watch_flags}"
-    ${CONCURRENTLY_BIN} "${DIR}/buildInternalDependencies.sh --watch --packagePath ." "eval ${start_server}"
+    start_server="$start_server --delay 1 $watch_flags"
+    "$CONCURRENTLY_BIN" "$DIR/buildInternalDependencies.sh --watch --packagePath ." "eval $start_server"
 else
     echo -e "Starting server without internal dependency build and watch. To include internal dependencies, add the ${BOLD}-i${RESET} flag - it’s much faster than it used to be!"
-    eval ${start_server}
+    eval "$start_server"
 fi
diff --git a/scripts/bash/buildInternalDependencies.sh b/scripts/bash/buildInternalDependencies.sh
index db9e54f3bb..52a560ac8e 100755
--- a/scripts/bash/buildInternalDependencies.sh
+++ b/scripts/bash/buildInternalDependencies.sh
@@ -5,7 +5,7 @@ DIR=$(dirname "$0")
 . "$DIR/ansiControlSequences.sh"
 
 CONCURRENT_BUILD_BATCH_SIZE=1
-CONCURRENTLY_BIN="${DIR}/../../node_modules/.bin/concurrently"
+CONCURRENTLY_BIN="$DIR/../../node_modules/.bin/concurrently"
 
 USAGE="Usage: ${BOLD}buildInternalDependencies.sh${RESET} [${BOLD}--watch${RESET}] [${BOLD}--packagePath${RESET}|${BOLD}-p${RESET}]"
 
@@ -40,19 +40,19 @@ build_commands=()
 build_prefixes=()
 
 # Build dependencies
-for PACKAGE in $(${DIR}/getInternalDependencies.sh ${package_path}); do
-    build_commands+=("\"NODE_ENV=production yarn workspace @tupaia/${PACKAGE} build-dev $build_args\"")
+for PACKAGE in $("$DIR/getInternalDependencies.sh" "$package_path"); do
+    build_commands+=("\"NODE_ENV=production yarn workspace @tupaia/$PACKAGE build-dev $build_args\"")
     build_prefixes+=("${PACKAGE},")
 done
 
 if [[ $watch = true ]]; then
     echo -e "${BOLD}Concurrently building and watching all internal dependencies${RESET}"
-    echo "> ${CONCURRENTLY_BIN} --names \"${build_prefixes[*]}\" ${build_commands[@]}"
+    echo "> $CONCURRENTLY_BIN --names \"${build_prefixes[*]}\" ${build_commands[@]}"
     echo
-    eval   "${CONCURRENTLY_BIN} --names \"${build_prefixes[*]}\" ${build_commands[@]}"
+    eval   "$CONCURRENTLY_BIN --names \"${build_prefixes[*]}\" ${build_commands[@]}"
 else
     echo -e "${BOLD}Concurrently building internal dependencies in batches of ${CONCURRENT_BUILD_BATCH_SIZE}${RESET}"
-    echo "> ${CONCURRENTLY_BIN} -m $CONCURRENT_BUILD_BATCH_SIZE --names \"${build_prefixes[*]}\" -k ${build_commands[*]}"
+    echo "> $CONCURRENTLY_BIN -m $CONCURRENT_BUILD_BATCH_SIZE --names \"${build_prefixes[*]}\" -k ${build_commands[*]}"
     echo
-    eval   "${CONCURRENTLY_BIN} -m $CONCURRENT_BUILD_BATCH_SIZE --names \"${build_prefixes[*]}\" -k ${build_commands[*]}"
+    eval   "$CONCURRENTLY_BIN -m $CONCURRENT_BUILD_BATCH_SIZE --names \"${build_prefixes[*]}\" -k ${build_commands[*]}"
 fi
diff --git a/scripts/bash/buildNonInternalDependencies.sh b/scripts/bash/buildNonInternalDependencies.sh
index 9dc7436dbb..22a7e79b61 100755
--- a/scripts/bash/buildNonInternalDependencies.sh
+++ b/scripts/bash/buildNonInternalDependencies.sh
@@ -10,8 +10,8 @@ build_prefixes=()
 
 # Build dependencies
 for PACKAGE in $PACKAGES; do
-    build_commands+=("\"yarn workspace @tupaia/${PACKAGE} build\"")
-    build_prefixes+=("${PACKAGE},")
+    build_commands+=("\"yarn workspace @tupaia/$PACKAGE build\"")
+    build_prefixes+=("$PACKAGE,")
 done
 
 eval "yarn concurrently -m $CONCURRENT_BUILD_BATCH_SIZE --names \"${build_prefixes[*]}\" -k ${build_commands[*]}"
diff --git a/scripts/bash/downloadEnvironmentVariables.sh b/scripts/bash/downloadEnvironmentVariables.sh
index 060cb3a3bc..0ba82578eb 100755
--- a/scripts/bash/downloadEnvironmentVariables.sh
+++ b/scripts/bash/downloadEnvironmentVariables.sh
@@ -10,8 +10,8 @@ COLLECTION_PATH='Engineering/Tupaia General/Environment Variables'
 
 # Log in to bitwarden
 echo -e "${BLUE}==>️${RESET} ${BOLD}Logging into Bitwarden${RESET}"
-bw login --check || bw login $BITWARDEN_EMAIL $BITWARDEN_PASSWORD
-eval "$(bw unlock $BITWARDEN_PASSWORD | grep -o -m 1 'export BW_SESSION=.*$')"
+bw login --check || bw login "$BITWARDEN_EMAIL" "$BITWARDEN_PASSWORD"
+eval "$(bw unlock "$BITWARDEN_PASSWORD" | grep -o -m 1 'export BW_SESSION=.*$')"
 
 COLLECTION_ID=$(bw get collection "$COLLECTION_PATH" | jq .id)
 
@@ -19,7 +19,7 @@ echo
 
 # Can provide one or more packages as command line arguments, or will default to all
 if [[ -z $2 ]]; then
-    PACKAGES=$(${DIR}/getPackagesWithEnvFiles.sh)
+    PACKAGES=$("$DIR/getPackagesWithEnvFiles.sh")
     echo -e "${BLUE}==>️${RESET} ${BOLD}Fetching environment variables for all packages${RESET}"
 else
     PACKAGES=${@:2}
@@ -28,31 +28,31 @@ fi
 
 
 load_env_file_from_bw () {
-    FILE_NAME=$1
-    BASE_FILE_PATH=$2 
-    NEW_FILE_NAME=$3
-    ENV_FILE_PATH=${BASE_FILE_PATH}/${NEW_FILE_NAME}.env
+    FILE_NAME="$1"
+    BASE_FILE_PATH="$2"
+    NEW_FILE_NAME="$3"
+    ENV_FILE_PATH="${BASE_FILE_PATH}/${NEW_FILE_NAME}.env"
 
     echo -en "${YELLOW}🚚 Fetching variables for ${BOLD}${FILE_NAME}...${RESET}"
 
     # checkout deployment specific env vars, or dev as fallback
-    DEPLOYMENT_ENV_VARS=$(bw list items --search ${FILE_NAME}.${DEPLOYMENT_NAME}.env | jq --raw-output "map(select(.collectionIds[] | contains ($COLLECTION_ID))) | .[] .notes")
+    DEPLOYMENT_ENV_VARS=$(bw list items --search "$FILE_NAME.$DEPLOYMENT_NAME.env" | jq --raw-output "map(select(.collectionIds[] | contains ($COLLECTION_ID))) | .[] .notes")
 
     if [[ -n $DEPLOYMENT_ENV_VARS ]]; then
-        echo "$DEPLOYMENT_ENV_VARS" > ${ENV_FILE_PATH}
+        echo "$DEPLOYMENT_ENV_VARS" > "$ENV_FILE_PATH"
     else
-        DEV_ENV_VARS=$(bw list items --search ${FILE_NAME}.dev.env | jq --raw-output "map(select(.collectionIds[] | contains ($COLLECTION_ID))) | .[] .notes")
-        echo "$DEV_ENV_VARS" > ${ENV_FILE_PATH}
+        DEV_ENV_VARS=$(bw list items --search "$FILE_NAME.dev.env" | jq --raw-output "map(select(.collectionIds[] | contains ($COLLECTION_ID))) | .[] .notes")
+        echo "$DEV_ENV_VARS" > "$ENV_FILE_PATH"
     fi
 
     # Replace any instances of the placeholder [deployment-name] in the .env file with the actual
     # deployment name (e.g. [deployment-name]-api.tupaia.org -> specific-deployment-api.tupaia.org)
-    sed -i -e "s/\[deployment-name\]/${DEPLOYMENT_NAME}/g" "${ENV_FILE_PATH}"
+    sed -i -e "s/\[deployment-name\]/${DEPLOYMENT_NAME}/g" "$ENV_FILE_PATH"
    
     if [[ $DEPLOYMENT_NAME = *-e2e || $DEPLOYMENT_NAME = e2e ]]; then
         # Update e2e environment variables
         if [[ ${FILE_NAME} == aggregation ]]; then
-            sed -i -e 's/^AGGREGATION_URL_PREFIX="?dev-"?$/AGGREGATION_URL_PREFIX=e2e-/g' ${ENV_FILE_PATH}
+            sed -i -e 's/^AGGREGATION_URL_PREFIX="?dev-"?$/AGGREGATION_URL_PREFIX=e2e-/g' "$ENV_FILE_PATH"
         fi
     fi
 
@@ -60,7 +60,7 @@ load_env_file_from_bw () {
         # Update dev specific environment variables
         # (removes ###DEV_ONLY### prefixes, leaving the key=value pair uncommented)
         # (after removing prefix, if there are duplicate keys, dotenv uses the last one in the file)
-        sed -i -e 's/^###DEV_ONLY###//g' ${ENV_FILE_PATH}
+        sed -i -e 's/^###DEV_ONLY###//g' "$ENV_FILE_PATH"
     fi
 
     echo -en "$CLEAR_LINE"
@@ -71,20 +71,20 @@ load_env_file_from_bw () {
 for PACKAGE in $PACKAGES; do
     # Only download the env file if there is an example file in the package. If there isn’t, this
     # means it is a package that doesn’t need env vars
-    has_example_env_in_package=$(find $DIR/../../packages/$PACKAGE -type f -name '*.env.example' | wc -l)
+    has_example_env_in_package=$(find "$DIR/../../packages/$PACKAGE" -type f -name '*.env.example' | wc -l)
     if [[ $has_example_env_in_package -eq 1 ]]; then
-        load_env_file_from_bw $PACKAGE $DIR/../../packages/$PACKAGE ""
+        load_env_file_from_bw "$PACKAGE" "$DIR/../../packages/$PACKAGE" ''
     fi
 done
  
 
 # Get all *.env.example files in the env directory
-file_names=$(find $DIR/../../env -type f -name '*.env.example' -exec basename {} \;)
+file_names=$(find "$DIR/../../env" -type f -name '*.env.example' -exec basename {} \;)
 
 # For each file, get its basename without the .env.example extension
 for file_name in $file_names; do
     env_name="${file_name%.env.example}"
-    load_env_file_from_bw $env_name $DIR/../../env $env_name
+    load_env_file_from_bw "$env_name" "$DIR/../../env" "$env_name"
 done
 
 
diff --git a/scripts/bash/getInternalDependencies.sh b/scripts/bash/getInternalDependencies.sh
index 432321e658..3e4dc87978 100755
--- a/scripts/bash/getInternalDependencies.sh
+++ b/scripts/bash/getInternalDependencies.sh
@@ -60,9 +60,9 @@ internal_dependencies=("${array_without_gaps[@]}")
 unset array_without_gaps
 
 # recursively build up an array of all internal dependencies this package depends on
-for dependency in ${internal_dependencies[@]}; do
+for dependency in "${internal_dependencies[@]}"; do
 
-  nested_dependencies=($(${DIR}/getInternalDependencies.sh "${package_path}/../${dependency}" ${dependencies_already_visited[@]} ${internal_dependencies[@]} ))
+  nested_dependencies=($("$DIR/getInternalDependencies.sh" "$package_path/../$dependency" "${dependencies_already_visited[@]}" "${internal_dependencies[@]}" ))
   if [[ ${#nested_dependencies[@]} -eq 0 ]]; then
     continue
   fi
@@ -74,7 +74,7 @@ done
 # remove any duplicates
 for i in "${!internal_dependencies[@]}"; do
   for j in "${!internal_dependencies[@]}"; do
-    if [[ i -ne j ]] && [[ ${internal_dependencies[i]} = ${internal_dependencies[j]} ]]; then
+    if [[ i -ne j ]] && [[ ${internal_dependencies[i]} = "${internal_dependencies[j]}" ]]; then
       unset 'internal_dependencies[i]'
     fi
   done
@@ -86,6 +86,6 @@ internal_dependencies=("${array_without_gaps[@]}")
 unset array_without_gaps
 
 # echo out result for calling script to pick up
-echo ${internal_dependencies[@]}
+echo "${internal_dependencies[@]}"
 exit 0
 
diff --git a/scripts/bash/getPackagesWithEnvFiles.sh b/scripts/bash/getPackagesWithEnvFiles.sh
index a96f62cad8..37ff570c95 100755
--- a/scripts/bash/getPackagesWithEnvFiles.sh
+++ b/scripts/bash/getPackagesWithEnvFiles.sh
@@ -4,7 +4,7 @@ set -e
 DIR=$(dirname "$0")
 
 # packages with .env files are (currently) all deployable, plus auth, data-api, and database
-PACKAGES=$(${DIR}/getDeployablePackages.sh)
-PACKAGES+=" data-api"
-echo $PACKAGES
+PACKAGES=$("$DIR/getDeployablePackages.sh")
+PACKAGES+=' data-api'
+echo "$PACKAGES"
 exit 0
diff --git a/scripts/bash/mergeEnvForDB.sh b/scripts/bash/mergeEnvForDB.sh
index 38e5a3bcbe..2fc19a2586 100755
--- a/scripts/bash/mergeEnvForDB.sh
+++ b/scripts/bash/mergeEnvForDB.sh
@@ -36,7 +36,7 @@ for file in $common_files; do
 done
 
 # Load environment variables from .env files
-merged_content="$(cat $common_files)" 
+merged_content="$(cat "$common_files")"
 
 # Process command line arguments, overwriting values if present
 for var in $(env); do
diff --git a/scripts/bash/validate.sh b/scripts/bash/validate.sh
index 129087182a..137af302a0 100755
--- a/scripts/bash/validate.sh
+++ b/scripts/bash/validate.sh
@@ -2,7 +2,7 @@
 set -e
 
 DIR=$(dirname "$0")
-. ${DIR}/../../packages/devops/scripts/ci/utils.sh
+. "$DIR/../../packages/devops/scripts/ci/utils.sh"
 
 yarn workspace @tupaia/devops validate-branch-name
 yarn workspace @tupaia/devops validate-tests