diff --git a/CMakeLists.txt b/CMakeLists.txt
index bd5a9edb6b..a78b8d5e47 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -638,7 +638,13 @@ include(InstallHelpers)
 add_glob_target(
   TARGET lintsh
   COMMAND ${SHELLCHECK_PRG}
-  FILES scripts/vim-patch.sh
+  FLAGS -x -a
+  GLOB_DIRS scripts ci
+  GLOB_PAT *.sh
+  EXCLUDE
+    scripts/pvscheck.sh
+    ci/common
+    ci/snap
   TOUCH_STRATEGY SINGLE
   )
 
diff --git a/ci/before_cache.sh b/ci/before_cache.sh
index 9bc9bb45e9..3daeb04793 100755
--- a/ci/before_cache.sh
+++ b/ci/before_cache.sh
@@ -4,7 +4,9 @@ set -e
 set -o pipefail
 
 CI_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source-path=SCRIPTDIR
 source "${CI_DIR}/common/build.sh"
+# shellcheck source-path=SCRIPTDIR
 source "${CI_DIR}/common/suite.sh"
 
 mkdir -p "${HOME}/.cache"
diff --git a/ci/before_script.sh b/ci/before_script.sh
index 08e0cb9103..066789af36 100755
--- a/ci/before_script.sh
+++ b/ci/before_script.sh
@@ -4,6 +4,7 @@ set -e
 set -o pipefail
 
 CI_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source-path=SCRIPTDIR
 source "${CI_DIR}/common/build.sh"
 
 # Test some of the configuration variables.
diff --git a/ci/common/build.sh b/ci/common/build.sh
index 6e7ea2c8f8..e30d0337b5 100644
--- a/ci/common/build.sh
+++ b/ci/common/build.sh
@@ -7,7 +7,7 @@ _stat() {
 }
 
 top_make() {
-  printf '%78s\n' | tr ' ' '='
+  printf '%78s\n' ' ' | tr ' ' '='
   ninja "$@"
 }
 
@@ -33,6 +33,7 @@ build_deps() {
   # update CMake configuration and update to newer deps versions.
   cd "${DEPS_BUILD_DIR}"
   echo "Configuring with '${DEPS_CMAKE_FLAGS}'."
+  # shellcheck disable=SC2086
   CC= cmake -G Ninja ${DEPS_CMAKE_FLAGS} "${CI_BUILD_DIR}/cmake.deps/"
 
   if ! top_make; then
@@ -51,10 +52,10 @@ build_nvim() {
 
   mkdir -p "${BUILD_DIR}"
   cd "${BUILD_DIR}"
-  echo "Configuring with '${CMAKE_FLAGS} $@'."
+  echo "Configuring with '${CMAKE_FLAGS} $*'."
+  # shellcheck disable=SC2086
   cmake -G Ninja ${CMAKE_FLAGS} "$@" "${CI_BUILD_DIR}"
 
-
   echo "Building nvim."
   if ! top_make nvim ; then
     exit 1
diff --git a/ci/common/suite.sh b/ci/common/suite.sh
index 0320ac15c3..c81261d2e7 100644
--- a/ci/common/suite.sh
+++ b/ci/common/suite.sh
@@ -9,12 +9,12 @@ fail() {
   local test_name="$1"
   local message="$2"
 
-  : ${message:=Test $test_name failed}
+  : "${message:=Test $test_name failed}"
 
   local full_msg="$test_name :: $message"
   echo "${full_msg}" >> "${FAIL_SUMMARY_FILE}"
   echo "Failed: $full_msg"
-  FAILED=1
+  export FAILED=1
 }
 
 ended_successfully() {
diff --git a/ci/common/test.sh b/ci/common/test.sh
index 7db39a0e5f..326ec162c3 100644
--- a/ci/common/test.sh
+++ b/ci/common/test.sh
@@ -57,6 +57,7 @@ check_core_dumps() {
 
 check_logs() {
   # Iterate through each log to remove an useless warning.
+  # shellcheck disable=SC2044
   for log in $(find "${1}" -type f -name "${2}"); do
     sed -i "${log}" \
       -e '/Warning: noted but unhandled ioctl/d' \
@@ -66,6 +67,7 @@ check_logs() {
 
   # Now do it again, but only consider files with size > 0.
   local err=""
+  # shellcheck disable=SC2044
   for log in $(find "${1}" -type f -name "${2}" -size +0); do
     cat "${log}"
     err=1
@@ -97,7 +99,7 @@ unittests() {(
 
 functionaltests() {(
   ulimit -c unlimited || true
-  if ! build_make ${FUNCTIONALTEST}; then
+  if ! build_make "${FUNCTIONALTEST}"; then
     fail 'functionaltests' 'Functional tests failed'
   fi
   submit_coverage functionaltest
@@ -132,7 +134,7 @@ check_runtime_files() {(
       fail "$test_name" "It appears that $file is only a part of the file name"
     fi
     if ! test "$tst" "$INSTALL_PREFIX/share/nvim/runtime/$file" ; then
-      fail "$test_name" "$(printf "$message" "$file")"
+      fail "$test_name" "$(printf "%s%s" "$message" "$file")"
     fi
   done
 )}
diff --git a/ci/run_tests.sh b/ci/run_tests.sh
index da72d09506..20d758fd6d 100755
--- a/ci/run_tests.sh
+++ b/ci/run_tests.sh
@@ -4,8 +4,11 @@ set -e
 set -o pipefail
 
 CI_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source-path=SCRIPTDIR
 source "${CI_DIR}/common/build.sh"
+# shellcheck source-path=SCRIPTDIR
 source "${CI_DIR}/common/test.sh"
+# shellcheck source-path=SCRIPTDIR
 source "${CI_DIR}/common/suite.sh"
 
 rm -f "$END_MARKER"
diff --git a/scripts/download-unicode-files.sh b/scripts/download-unicode-files.sh
index 4482cefa34..687b946e6f 100755
--- a/scripts/download-unicode-files.sh
+++ b/scripts/download-unicode-files.sh
@@ -3,11 +3,12 @@
 set -e
 data_files="UnicodeData.txt CaseFolding.txt EastAsianWidth.txt"
 emoji_files="emoji-data.txt"
+files="'$data_files $emoji_files'"
 
 UNIDIR_DEFAULT=src/unicode
 DOWNLOAD_URL_BASE_DEFAULT='http://unicode.org/Public'
 
-if test x$1 = 'x--help' ; then
+if test "$1" = '--help' ; then
   echo 'Usage:'
   echo "  $0[ TARGET_DIRECTORY[ URL_BASE]]"
   echo
@@ -16,6 +17,7 @@ if test x$1 = 'x--help' ; then
   echo
   echo "Default target directory is $PWD/${UNIDIR_DEFAULT}."
   echo "Default URL base is ${DOWNLOAD_URL_BASE_DEFAULT}."
+  exit 0
 fi
 
 UNIDIR=${1:-$UNIDIR_DEFAULT}
@@ -23,21 +25,12 @@ DOWNLOAD_URL_BASE=${2:-$DOWNLOAD_URL_BASE_DEFAULT}
 
 for filename in $data_files ; do
   curl -L -o "$UNIDIR/$filename" "$DOWNLOAD_URL_BASE/UNIDATA/$filename"
-  (
-    cd "$UNIDIR"
-    git add $filename
-  )
+  git -C "$UNIDIR" add "$filename"
 done
 
 for filename in $emoji_files ; do
   curl -L -o "$UNIDIR/$filename" "$DOWNLOAD_URL_BASE/UNIDATA/emoji/$filename"
-  (
-    cd "$UNIDIR"
-    git add $filename
-  )
+  git -C "$UNIDIR" add $filename
 done
 
-(
-  cd "$UNIDIR"
-  git commit -m "feat: update unicode tables" -- $files
-)
+git -C "$UNIDIR" commit -m "feat: update unicode tables" .
diff --git a/scripts/genappimage.sh b/scripts/genappimage.sh
index cc88ab5559..9944b5eb31 100755
--- a/scripts/genappimage.sh
+++ b/scripts/genappimage.sh
@@ -8,7 +8,8 @@
 
 # App arch, used by generate_appimage.
 if [ -z "$ARCH" ]; then
-  export ARCH="$(arch)"
+  ARCH="$(arch)"
+  export ARCH
 fi
 
 TAG=$1
@@ -34,8 +35,9 @@ make install
 
 # App version, used by generate_appimage.
 VERSION=$("$ROOT_DIR"/build/bin/nvim --version | head -n 1 | grep -o 'v.*')
+export VERSION
 
-cd "$APP_BUILD_DIR"
+cd "$APP_BUILD_DIR" || exit
 
 # Only downloads linuxdeploy if the remote file is different from local
 if [ -e "$APP_BUILD_DIR"/linuxdeploy-x86_64.AppImage ]; then
@@ -53,7 +55,7 @@ chmod +x "$APP_BUILD_DIR"/linuxdeploy-x86_64.AppImage
 mkdir "$APP_DIR/usr/share/metainfo/"
 cp "$ROOT_DIR/runtime/nvim.appdata.xml" "$APP_DIR/usr/share/metainfo/"
 
-cd "$APP_DIR"
+cd "$APP_DIR" || exit
 
 ########################################################################
 # AppDir complete. Now package it as an AppImage.
@@ -71,7 +73,7 @@ exec "$(dirname "$(readlink  -f "${0}")")/usr/bin/nvim" ${@+"$@"}
 EOF
 chmod 755 AppRun
 
-cd "$APP_BUILD_DIR" # Get out of AppImage directory.
+cd "$APP_BUILD_DIR" || exit # Get out of AppImage directory.
 
 # Set the name of the file generated by appimage
 export OUTPUT=nvim.appimage
@@ -85,7 +87,7 @@ fi
 #   - Expects: $ARCH, $APP, $VERSION env vars
 #   - Expects: ./$APP.AppDir/ directory
 #   - Produces: ./nvim.appimage
-./linuxdeploy-x86_64.AppImage --appdir $APP.AppDir -d $ROOT_DIR/runtime/nvim.desktop -i \
+./linuxdeploy-x86_64.AppImage --appdir $APP.AppDir -d "$ROOT_DIR"/runtime/nvim.desktop -i \
 "$ROOT_DIR/runtime/nvim.png" --output appimage
 
 # Moving the final executable to a different folder so it isn't in the
diff --git a/scripts/git-log-pretty-since.sh b/scripts/git-log-pretty-since.sh
index a0aa4354b6..95dcee23f5 100755
--- a/scripts/git-log-pretty-since.sh
+++ b/scripts/git-log-pretty-since.sh
@@ -16,9 +16,9 @@ __SINCE=$1
 __INVMATCH=$2
 
 is_merge_commit() {
-  git rev-parse $1 >/dev/null 2>&1 \
+  git rev-parse "$1" >/dev/null 2>&1 \
     || { echo "ERROR: invalid commit: $1"; exit 1; }
-  git log $1^2 >/dev/null 2>&1 && return 0 || return 1
+  git log "$1"^2 >/dev/null 2>&1 && return 0 || return 1
 }
 
 # Removes parens from issue/ticket/PR numbers.
@@ -40,13 +40,13 @@ _format_ticketnums() {
 }
 
 for commit in $(git log --format='%H' --first-parent "$__SINCE"..HEAD); do
-  if is_merge_commit ${commit} ; then
-      if [ -z "$__INVMATCH" ] || ! git log --oneline ${commit}^1..${commit}^2 \
+  if is_merge_commit "${commit}" ; then
+      if [ -z "$__INVMATCH" ] || ! git log --oneline "${commit}^1..${commit}^2" \
            | >/dev/null 2>&1 grep -E "$__INVMATCH" ; then
-        git log -1 --oneline ${commit}
-        git log --format='    %h %s' ${commit}^1..${commit}^2
+        git log -1 --oneline "${commit}"
+        git log --format='    %h %s' "${commit}^1..${commit}^2"
       fi
   else
-    git log -1 --oneline ${commit}
+    git log -1 --oneline "${commit}"
   fi
 done | _format_ticketnums
diff --git a/scripts/release.sh b/scripts/release.sh
index 380503662d..4321d96f62 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -59,8 +59,8 @@ _do_release_commit() {
   $__sed -i.bk 's/(NVIM_VERSION_PRERELEASE) "-dev"/\1 ""/' CMakeLists.txt
   if grep '(NVIM_API_PRERELEASE true)' CMakeLists.txt > /dev/null; then
     $__sed -i.bk 's/(NVIM_API_PRERELEASE) true/\1 false/' CMakeLists.txt
-    build/bin/nvim --api-info > test/functional/fixtures/api_level_$__API_LEVEL.mpack
-    git add test/functional/fixtures/api_level_$__API_LEVEL.mpack
+    build/bin/nvim --api-info > "test/functional/fixtures/api_level_$__API_LEVEL.mpack"
+    git add "test/functional/fixtures/api_level_${__API_LEVEL}.mpack"
   fi
 
   $__sed -i.bk 's,(<releases>),\1\
diff --git a/scripts/update_terminfo.sh b/scripts/update_terminfo.sh
index 8a0937cc8c..775048f246 100755
--- a/scripts/update_terminfo.sh
+++ b/scripts/update_terminfo.sh
@@ -35,7 +35,7 @@ readonly -A entries=(
 db="$(mktemp -du)"
 
 print_bold() {
-  printf "\\e[1m$*\\e[0m"
+  printf "\\e[1m%b\\e[0m" "$*"
 }
 
 cd "$(git rev-parse --show-toplevel)"