diff --git a/deploy/common.sh b/deploy/common.sh
index acbe51cc9..faab78994 100644
--- a/deploy/common.sh
+++ b/deploy/common.sh
@@ -8,7 +8,7 @@ readonly KUBECTL="${GCE_PD_KUBECTL:-kubectl}"
 # Common functions
 
 function ensure_var(){
-    if [[ -z "${!1}" ]];
+    if [[ -z "${!1:-}" ]];
     then
         echo "${1} is unset"
         exit 1
@@ -26,5 +26,5 @@ function get_needed_roles()
 function ensure_kustomize()
 {
   ensure_var PKGDIR
-  ${PKGDIR}/deploy/kubernetes/install-kustomize.sh
+  "${PKGDIR}/deploy/kubernetes/install-kustomize.sh"
 }
diff --git a/deploy/kubernetes/delete-driver.sh b/deploy/kubernetes/delete-driver.sh
index 9ab6ffba7..0e72cf236 100755
--- a/deploy/kubernetes/delete-driver.sh
+++ b/deploy/kubernetes/delete-driver.sh
@@ -17,11 +17,11 @@ source "${PKGDIR}/deploy/common.sh"
 
 ensure_kustomize
 
-${KUSTOMIZE_PATH} build ${PKGDIR}/deploy/kubernetes/overlays/${DEPLOY_VERSION} | ${KUBECTL} delete -v="${VERBOSITY}" --ignore-not-found -f -
+${KUSTOMIZE_PATH} build "${PKGDIR}/deploy/kubernetes/overlays/${DEPLOY_VERSION}" | ${KUBECTL} delete -v="${VERBOSITY}" --ignore-not-found -f -
 ${KUBECTL} delete secret cloud-sa -v="${VERBOSITY}" --ignore-not-found
 
-if [[ ${NAMESPACE} != "" && ${NAMESPACE} != "default" ]] && \
-  ${KUBECTL} get namespace ${NAMESPACE} -v="${VERBOSITY}";
+if [[ "${NAMESPACE}" != "" && "${NAMESPACE}" != "default" ]] && \
+  ${KUBECTL} get namespace "${NAMESPACE}" -v="${VERBOSITY}";
 then
-    ${KUBECTL} delete namespace ${NAMESPACE} -v="${VERBOSITY}"
+    ${KUBECTL} delete namespace "${NAMESPACE}" -v="${VERBOSITY}"
 fi
diff --git a/deploy/kubernetes/deploy-driver.sh b/deploy/kubernetes/deploy-driver.sh
index a671a4f91..7dfe8e47e 100755
--- a/deploy/kubernetes/deploy-driver.sh
+++ b/deploy/kubernetes/deploy-driver.sh
@@ -23,13 +23,13 @@ source "${PKGDIR}/deploy/common.sh"
 
 print_usage()
 {
-    echo "deploy-driver.sh [--skip-sa-check]\n"
-    echo "\t--skip-sa-check: don't check the service account for required roles"
+    printf "deploy-driver.sh [--skip-sa-check]\n"
+    printf "\t--skip-sa-check: don't check the service account for required roles"
     echo
 }
 
 skip_sa_check=
-while [ ! -z "${1-}" ]; do
+while [ -n "${1-}" ]; do
   case $1 in
     --skip-sa-check ) shift
                       skip_sa_check=true
@@ -49,20 +49,20 @@ function check_service_account()
 {
 	# Using bash magic to parse JSON for IAM
 	# Grepping for a line with client email returning anything quoted after the colon
-	readonly IAM_NAME=$(grep -Po '"client_email": *\K"[^"]*"' ${GCE_PD_SA_DIR}/cloud-sa.json | tr -d '"')
-	readonly PROJECT=$(grep -Po '"project_id": *\K"[^"]*"' ${GCE_PD_SA_DIR}/cloud-sa.json | tr -d '"')
-	readonly GOTTEN_BIND_ROLES=$(gcloud projects get-iam-policy ${PROJECT} --flatten="bindings[].members" --format='table(bindings.role)' --filter="bindings.members:${IAM_NAME}")
+	readonly IAM_NAME=$(grep -Po '"client_email": *\K"[^"]*"' "${GCE_PD_SA_DIR}/cloud-sa.json" | tr -d '"')
+	readonly PROJECT=$(grep -Po '"project_id": *\K"[^"]*"' "${GCE_PD_SA_DIR}/cloud-sa.json" | tr -d '"')
+	readonly GOTTEN_BIND_ROLES=$(gcloud projects get-iam-policy "${PROJECT}" --flatten="bindings[].members" --format='table(bindings.role)' --filter="bindings.members:${IAM_NAME}")
 	readonly BIND_ROLES=$(get_needed_roles)
 	MISSING_ROLES=false
 	for role in ${BIND_ROLES}
 	do
-		if ! grep -q $role <<<${GOTTEN_BIND_ROLES} ; 
+		if ! grep -q "$role" <<<"${GOTTEN_BIND_ROLES}" ;
 		then
 			echo "Missing role: $role"
 			MISSING_ROLES=true
 		fi
 	done
-	if [ "${MISSING_ROLES}" = true ]; 
+	if [ "${MISSING_ROLES}" = true ];
 	then
 		echo "Cannot deploy with missing roles in service account, please run setup-project.sh to setup Service Account"
 		exit 1
@@ -75,25 +75,25 @@ if [ "$skip_sa_check" != true ]; then
   check_service_account
 fi
 
-if ! ${KUBECTL} get namespace ${NAMESPACE} -v="${VERBOSITY}";
+if ! ${KUBECTL} get namespace "${NAMESPACE}" -v="${VERBOSITY}";
 then
-  ${KUBECTL} create namespace ${NAMESPACE} -v="${VERBOSITY}"
+  ${KUBECTL} create namespace "${NAMESPACE}" -v="${VERBOSITY}"
 fi
 
-if ! ${KUBECTL} get secret cloud-sa -v="${VERBOSITY}" -n ${NAMESPACE};
+if ! ${KUBECTL} get secret cloud-sa -v="${VERBOSITY}" -n "${NAMESPACE}";
 then
-  ${KUBECTL} create secret generic cloud-sa -v="${VERBOSITY}" --from-file="${GCE_PD_SA_DIR}/cloud-sa.json" -n ${NAMESPACE}
+  ${KUBECTL} create secret generic cloud-sa -v="${VERBOSITY}" --from-file="${GCE_PD_SA_DIR}/cloud-sa.json" -n "${NAMESPACE}"
 fi
 
 # GKE Required Setup
 if ! ${KUBECTL} get clusterrolebinding -v="${VERBOSITY}" cluster-admin-binding;
 then
-  ${KUBECTL} create clusterrolebinding cluster-admin-binding -v="${VERBOSITY}" --clusterrole cluster-admin --user $(gcloud config get-value account)
+  ${KUBECTL} create clusterrolebinding cluster-admin-binding -v="${VERBOSITY}" --clusterrole cluster-admin --user "$(gcloud config get-value account)"
 fi
 
 # Debug log: print ${KUBECTL} version
 ${KUBECTL} version
 
 readonly tmp_spec=/tmp/gcp-compute-persistent-disk-csi-driver-specs-generated.yaml
-${KUSTOMIZE_PATH} build ${PKGDIR}/deploy/kubernetes/overlays/${DEPLOY_VERSION} | tee $tmp_spec
+${KUSTOMIZE_PATH} build "${PKGDIR}/deploy/kubernetes/overlays/${DEPLOY_VERSION}" | tee $tmp_spec
 ${KUBECTL} apply -v="${VERBOSITY}" -f $tmp_spec
diff --git a/deploy/kubernetes/install-kustomize.sh b/deploy/kubernetes/install-kustomize.sh
index 46ac78e38..0c92fe769 100755
--- a/deploy/kubernetes/install-kustomize.sh
+++ b/deploy/kubernetes/install-kustomize.sh
@@ -11,11 +11,11 @@ readonly INSTALL_DIR="${GOPATH}/src/sigs.k8s.io/gcp-compute-persistent-disk-csi-
 readonly KUSTOMIZE_PATH="${INSTALL_DIR}/kustomize"
 
 if [ ! -f "${INSTALL_DIR}" ]; then
-  mkdir -p ${INSTALL_DIR}
+  mkdir -p "${INSTALL_DIR}"
 fi
 if [ -f "kustomize" ]; then
   rm kustomize
 fi
 echo "installing latest version of kustomize"
 curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"  | bash
-mv kustomize ${INSTALL_DIR}
+mv kustomize "${INSTALL_DIR}"
diff --git a/deploy/setup-project.sh b/deploy/setup-project.sh
index 3d4cc99da..778b4b905 100755
--- a/deploy/setup-project.sh
+++ b/deploy/setup-project.sh
@@ -42,7 +42,7 @@ readonly IAM_NAME="${GCE_PD_SA_NAME}@${IAM_PROJECT}.iam.gserviceaccount.com"
 # Check if SA exists
 CREATE_SA=true
 SA_JSON=$(gcloud iam service-accounts list --filter="name:${IAM_NAME}" --format="json")
-if [ "[]" != "${SA_JSON}" ]; 
+if [ "[]" != "${SA_JSON}" ];
 then
 	CREATE_SA=false
 	echo "Service account ${IAM_NAME} exists. Would you like to create a new one (y) or reuse the existing one (n)"
@@ -54,7 +54,7 @@ then
     fi
 fi
 
-if [ "${CREATE_SA}" = true ]; 
+if [ "${CREATE_SA}" = true ];
 then
 	# Delete Service Account Key
 	if [ -f "${GCE_PD_SA_DIR}/cloud-sa.json" ];
@@ -88,7 +88,7 @@ fi
 # Bind service account to roles
 for role in ${BIND_ROLES}
 do
-  gcloud projects add-iam-policy-binding "${PROJECT}" --member serviceAccount:"${IAM_NAME}" --role ${role}
+  gcloud projects add-iam-policy-binding "${PROJECT}" --member serviceAccount:"${IAM_NAME}" --role "${role}"
 done
 
 # Export key if needed
diff --git a/hack/verify-all.sh b/hack/verify-all.sh
index 05d0ff7d2..3edf8ce3c 100755
--- a/hack/verify-all.sh
+++ b/hack/verify-all.sh
@@ -20,7 +20,7 @@ set -o pipefail
 
 PKG_ROOT=$(git rev-parse --show-toplevel)
 
-${PKG_ROOT}/hack/verify-gofmt.sh
-${PKG_ROOT}/hack/verify-govet.sh
+"${PKG_ROOT}/hack/verify-gofmt.sh"
+"${PKG_ROOT}/hack/verify-govet.sh"
 
-make -C "${PKG_ROOT}" all
\ No newline at end of file
+make -C "${PKG_ROOT}" all
diff --git a/test/run-e2e-local.sh b/test/run-e2e-local.sh
index d83727897..be0455a1e 100755
--- a/test/run-e2e-local.sh
+++ b/test/run-e2e-local.sh
@@ -5,4 +5,4 @@ set -o errexit
 
 readonly PKGDIR=sigs.k8s.io/gcp-compute-persistent-disk-csi-driver
 
-ginkgo --v "test/e2e/tests" -- --project ${PROJECT} --service-account ${IAM_NAME} --v=4 --logtostderr
\ No newline at end of file
+ginkgo --v "test/e2e/tests" -- --project "${PROJECT}" --service-account "${IAM_NAME}" --v=4 --logtostderr
diff --git a/test/run-k8s-integration-ci.sh b/test/run-k8s-integration-ci.sh
old mode 100755
new mode 100644
index 5dc67d503..6bec334a6
--- a/test/run-k8s-integration-ci.sh
+++ b/test/run-k8s-integration-ci.sh
@@ -26,13 +26,13 @@ readonly teardown_driver=${GCE_PD_TEARDOWN_DRIVER:-true}
 
 export GCE_PD_VERBOSITY=9
 
-make -C ${PKGDIR} test-k8s-integration
+make -C "${PKGDIR}" test-k8s-integration
 
 base_cmd="${PKGDIR}/bin/k8s-integration-test \
             --run-in-prow=true --service-account-file=${E2E_GOOGLE_APPLICATION_CREDENTIALS} \
             --do-driver-build=${do_driver_build} --teardown-driver=${teardown_driver} --boskos-resource-type=${boskos_resource_type} \
             --storageclass-files=sc-standard.yaml,sc-balanced.yaml,sc-ssd.yaml --snapshotclass-file=pd-volumesnapshotclass.yaml \
-            --test-focus="External.Storage" --deployment-strategy=${deployment_strategy} --test-version=${test_version} \
+            --test-focus='External.Storage' --deployment-strategy=${deployment_strategy} --test-version=${test_version} \
             --num-nodes=3 --image-type=${image_type}"
 
 if [ "$use_gke_managed_driver" = false ]; then
@@ -57,4 +57,4 @@ else
   base_cmd="${base_cmd} --gce-region=${gce_region}"
 fi
 
-eval $base_cmd
+eval "$base_cmd"
diff --git a/test/run-k8s-integration-local.sh b/test/run-k8s-integration-local.sh
index ddf099c99..d8711e5a3 100755
--- a/test/run-k8s-integration-local.sh
+++ b/test/run-k8s-integration-local.sh
@@ -12,7 +12,7 @@ source "${PKGDIR}/deploy/common.sh"
 
 ensure_var GCE_PD_SA_DIR
 
-make -C ${PKGDIR} test-k8s-integration
+make -C "${PKGDIR}" test-k8s-integration
 
 # This version of the command creates a GKE cluster. It also downloads and builds a k8s release
 # so that it can run the test specified
@@ -76,8 +76,8 @@ make -C ${PKGDIR} test-k8s-integration
 # This version of the command does not build the driver or K8s, points to a
 # local K8s repo to get the e2e.test binary, and does not bring up or down the cluster
 
-${PKGDIR}/bin/k8s-integration-test --run-in-prow=false \
---staging-image=${GCE_PD_CSI_STAGING_IMAGE} --service-account-file=${GCE_PD_SA_DIR}/cloud-sa.json \
---deploy-overlay-name=dev --bringup-cluster=false --teardown-cluster=false --local-k8s-dir=$KTOP \
---storageclass-files=sc-standard.yaml,sc-balanced.yaml,sc-ssd.yaml --do-driver-build=false --test-focus="External.Storage" \
---gce-zone="us-central1-b" --num-nodes=${NUM_NODES:-3}
+"${PKGDIR}/bin/k8s-integration-test" --run-in-prow=false \
+--staging-image="${GCE_PD_CSI_STAGING_IMAGE}" --service-account-file="${GCE_PD_SA_DIR}/cloud-sa.json" \
+--deploy-overlay-name=dev --bringup-cluster=false --teardown-cluster=false --local-k8s-dir="$KTOP" \
+--storageclass-files=sc-standard.yaml,sc-balanced.yaml,sc-ssd.yaml --do-driver-build=false --test-focus='External.Storage' \
+--gce-zone="us-central1-b" --num-nodes="${NUM_NODES:-3}"
diff --git a/test/run-k8s-integration-migration-local.sh b/test/run-k8s-integration-migration-local.sh
index 3633e139a..58c42f1af 100755
--- a/test/run-k8s-integration-migration-local.sh
+++ b/test/run-k8s-integration-migration-local.sh
@@ -13,7 +13,7 @@ readonly test_version=${TEST_VERSION:-master}
 ensure_var GCE_PD_CSI_STAGING_IMAGE
 ensure_var GCE_PD_SA_DIR
 
-make -C ${PKGDIR} test-k8s-integration
+make -C "${PKGDIR}" test-k8s-integration
 
 # ${PKGDIR}/bin/k8s-integration-test --kube-version=master --run-in-prow=false \
 # --staging-image=${GCE_PD_CSI_STAGING_IMAGE} --service-account-file=${GCE_PD_SA_DIR}/cloud-sa.json \
@@ -25,8 +25,8 @@ make -C ${PKGDIR} test-k8s-integration
 # This version of the command does not build the driver or K8s, points to a
 # local K8s repo to get the e2e.test binary, and does not bring up or down the cluster
 #
-${PKGDIR}/bin/k8s-integration-test --run-in-prow=false \
---staging-image=${GCE_PD_CSI_STAGING_IMAGE} --service-account-file=${GCE_PD_SA_DIR}/cloud-sa.json \
---deploy-overlay-name=dev --test-focus=${GCE_PD_TEST_FOCUS} \
---bringup-cluster=false --teardown-cluster=false --local-k8s-dir=$KTOP --migration-test=true \
---do-driver-build=false --gce-zone=${GCE_PD_ZONE} --num-nodes=${NUM_NODES:-3}
\ No newline at end of file
+"${PKGDIR}/bin/k8s-integration-test" --run-in-prow=false \
+--staging-image="${GCE_PD_CSI_STAGING_IMAGE}" --service-account-file="${GCE_PD_SA_DIR}/cloud-sa.json" \
+--deploy-overlay-name=dev --test-focus="${GCE_PD_TEST_FOCUS}" \
+--bringup-cluster=false --teardown-cluster=false --local-k8s-dir="$KTOP" --migration-test=true \
+--do-driver-build=false --gce-zone="${GCE_PD_ZONE}" --num-nodes="${NUM_NODES:-3}"
diff --git a/test/run-k8s-integration-migration.sh b/test/run-k8s-integration-migration.sh
index 667206f22..7807d1dce 100755
--- a/test/run-k8s-integration-migration.sh
+++ b/test/run-k8s-integration-migration.sh
@@ -24,11 +24,11 @@ readonly GCE_PD_TEST_FOCUS="PersistentVolumes\sGCEPD|[V|v]olume\sexpand|\[sig-st
 
 # TODO(#167): Enable reconstructions tests
 
-make -C ${PKGDIR} test-k8s-integration
-${PKGDIR}/bin/k8s-integration-test --kube-version=${kube_version} \
+make -C "${PKGDIR}" test-k8s-integration
+"${PKGDIR}/bin/k8s-integration-test" --kube-version="${kube_version}" \
 --kube-feature-gates="CSIMigration=true,CSIMigrationGCE=true,ExpandCSIVolumes=true" --run-in-prow=true \
---deploy-overlay-name=${overlay_name} --service-account-file=${E2E_GOOGLE_APPLICATION_CREDENTIALS} \
---do-driver-build=${do_driver_build} --boskos-resource-type=${boskos_resource_type} \
---migration-test=true --test-focus=${GCE_PD_TEST_FOCUS} \
---gce-zone="us-central1-b" --deployment-strategy=${deployment_strategy} --test-version=${test_version} \
+--deploy-overlay-name="${overlay_name}" --service-account-file="${E2E_GOOGLE_APPLICATION_CREDENTIALS}" \
+--do-driver-build="${do_driver_build}" --boskos-resource-type="${boskos_resource_type}" \
+--migration-test=true --test-focus="${GCE_PD_TEST_FOCUS}" \
+--gce-zone="us-central1-b" --deployment-strategy="${deployment_strategy}" --test-version="${test_version}" \
 --num-nodes=3
diff --git a/test/run-k8s-integration.sh b/test/run-k8s-integration.sh
index 64c9f1956..6167fdd6d 100755
--- a/test/run-k8s-integration.sh
+++ b/test/run-k8s-integration.sh
@@ -26,13 +26,13 @@ readonly teardown_driver=${GCE_PD_TEARDOWN_DRIVER:-true}
 
 export GCE_PD_VERBOSITY=9
 
-make -C ${PKGDIR} test-k8s-integration
+make -C "${PKGDIR}" test-k8s-integration
 
 base_cmd="${PKGDIR}/bin/k8s-integration-test \
             --run-in-prow=true --service-account-file=${E2E_GOOGLE_APPLICATION_CREDENTIALS} \
             --do-driver-build=${do_driver_build} --teardown-driver=${teardown_driver} --boskos-resource-type=${boskos_resource_type} \
             --storageclass-files=sc-standard.yaml --snapshotclass-file=pd-volumesnapshotclass.yaml \
-            --test-focus="External.Storage" --deployment-strategy=${deployment_strategy} --test-version=${test_version} \
+            --test-focus='External.Storage' --deployment-strategy=${deployment_strategy} --test-version=${test_version} \
             --num-nodes=3 --image-type=${image_type}"
 
 if [ "$use_gke_managed_driver" = false ]; then
@@ -57,4 +57,4 @@ else
   base_cmd="${base_cmd} --gce-region=${gce_region}"
 fi
 
-eval $base_cmd
+eval "$base_cmd"
diff --git a/test/run-windows-k8s-integration.sh b/test/run-windows-k8s-integration.sh
index a56349a24..4c56c4992 100755
--- a/test/run-windows-k8s-integration.sh
+++ b/test/run-windows-k8s-integration.sh
@@ -17,13 +17,13 @@ readonly test_version=${TEST_VERSION:-master}
 readonly gce_zone=${GCE_CLUSTER_ZONE:-us-central1-b}
 readonly teardown_driver=${GCE_PD_TEARDOWN_DRIVER:-true}
 
-make -C ${PKGDIR} test-k8s-integration
+make -C "${PKGDIR}" test-k8s-integration
 
 base_cmd="${PKGDIR}/bin/k8s-integration-test \
             --platform=windows --bringup-cluster=false --teardown-cluster=false --teardown-driver=${teardown_driver}\
             --run-in-prow=true --deploy-overlay-name=${overlay_name} --service-account-file=${E2E_GOOGLE_APPLICATION_CREDENTIALS} \
             --do-driver-build=${do_driver_build} --gce-zone=${gce_zone} --test-version=${test_version}\
-            --storageclass-files=sc-windows.yaml --snapshotclass-file=pd-volumesnapshotclass.yaml --test-focus="External.Storage" \
+            --storageclass-files=sc-windows.yaml --snapshotclass-file=pd-volumesnapshotclass.yaml --test-focus='External.Storage' \
             --deployment-strategy=${deployment_strategy}"
 
-eval $base_cmd
+eval "$base_cmd"