diff --git a/build/golang/build.sh b/build/golang/build.sh
index e8f9df5..cf70e1c 100755
--- a/build/golang/build.sh
+++ b/build/golang/build.sh
@@ -13,8 +13,8 @@ fi
 # will have awkward ownership.  So we switch to a user with the
 # same user and group IDs as source directory.  We have to set a
 # few things up so that sudo works without complaining later on.
-uid=$(stat --format="%u" $SRC_PATH)
-gid=$(stat --format="%g" $SRC_PATH)
+uid=$(stat --format="%u" "$SRC_PATH")
+gid=$(stat --format="%g" "$SRC_PATH")
 echo "weave:x:$uid:$gid::$SRC_PATH:/bin/sh" >>/etc/passwd
 echo "weave:*:::::::" >>/etc/shadow
 echo "weave	ALL=(ALL)	NOPASSWD: ALL" >>/etc/sudoers
diff --git a/build/haskell/build.sh b/build/haskell/build.sh
index bd52905..e80d2ab 100755
--- a/build/haskell/build.sh
+++ b/build/haskell/build.sh
@@ -9,4 +9,4 @@ if [ -z "${SRC_PATH:-}" ]; then
     exit 1
 fi
 
-make -C $SRC_PATH BUILD_IN_CONTAINER=false $*
+make -C "$SRC_PATH" BUILD_IN_CONTAINER=false "$@"
diff --git a/push-images b/push-images
index 9f1f16b..1871c37 100755
--- a/push-images
+++ b/push-images
@@ -28,7 +28,7 @@ done
 
 push_image() {
     local image="$1"
-    docker push ${image}:${IMAGE_TAG}
+    docker push "${image}:${IMAGE_TAG}"
 }
 
 for image in ${IMAGES}; do
@@ -38,12 +38,12 @@ for image in ${IMAGES}; do
     echo "Will push ${image}:${IMAGE_TAG}"
     push_image "${image}" &
 
-    if [ -z "NO_DOCKER_HUB" ]; then
+    if [ -z "$NO_DOCKER_HUB" ]; then
         # remove the quey prefix and push to docker hub
         docker_hub_image=${image#$QUAY_PREFIX}
-        docker tag ${image}:${IMAGE_TAG} ${docker_hub_image}:${IMAGE_TAG}
+        docker tag "${image}:${IMAGE_TAG}" "${docker_hub_image}:${IMAGE_TAG}"
         echo "Will push ${docker_hub_image}:${IMAGE_TAG}"
-        docker push ${docker_hub_image}:${IMAGE_TAG}
+        docker push "${docker_hub_image}:${IMAGE_TAG}"
     fi
 done