diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
index db958f84b..dd2277b0e 100755
--- a/.github/workflows/release_prep.sh
+++ b/.github/workflows/release_prep.sh
@@ -8,8 +8,8 @@ TAG=${GITHUB_REF_NAME}
 # The prefix is chosen to match what GitHub generates for source archives
 PREFIX="rules_foreign_cc-${TAG}"
 ARCHIVE="rules_foreign_cc-$TAG.tar.gz"
-git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip > $ARCHIVE
-SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}')
+git archive --format=tar --prefix="${PREFIX}"/ "${TAG}" | gzip > "$ARCHIVE"
+SHA="$(shasum -a 256 "$ARCHIVE" | awk '{print $1}')"
 
 cat << EOF
 ## Using Bzlmod with Bazel 6
@@ -23,7 +23,7 @@ bazel_dep(name = "rules_foreign_cc", version = "${TAG}")
 
 ## Using WORKSPACE
 
-Paste this snippet into your `WORKSPACE.bazel` file:
+Paste this snippet into your \`WORKSPACE.bazel\` file:
 
 \`\`\`starlark
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
diff --git a/docs/tools/workspace_status.sh b/docs/tools/workspace_status.sh
index 5ceb3f76e..3b83a143f 100755
--- a/docs/tools/workspace_status.sh
+++ b/docs/tools/workspace_status.sh
@@ -4,4 +4,4 @@ set -euo pipefail
 
 echo STABLE_SCM_SHORT_VERSION "$(git rev-parse --short HEAD)"
 echo STABLE_SCM_VERSION "$(git rev-parse HEAD)"
-echo STABLE_RELEASE "$(cat ../version.bzl | grep VERSION | sed 's/VERSION = "//' | sed 's/"//')"
+echo STABLE_RELEASE "$(grep VERSION ../version.bzl | sed 's/VERSION = "//' | sed 's/"//')"
diff --git a/foreign_cc/private/runnable_binary_wrapper.sh b/foreign_cc/private/runnable_binary_wrapper.sh
index 125b92826..2354022f2 100644
--- a/foreign_cc/private/runnable_binary_wrapper.sh
+++ b/foreign_cc/private/runnable_binary_wrapper.sh
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+# shellcheck disable=SC1090
+
 # --- begin runfiles.bash initialization v3 ---
 # Copy-pasted from the Bazel Bash runfiles library v3.
 set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
@@ -46,7 +48,7 @@ done < <(find . -name "*${SHARED_LIB_SUFFIX}" -print0)
 SHARED_LIBS_DIRS_ARRAY=()
 if [ ${#SHARED_LIBS_ARRAY[@]} -ne 0 ]; then
     for lib in "${SHARED_LIBS_ARRAY[@]}"; do
-        SHARED_LIBS_DIRS_ARRAY+=($(dirname $(realpath $lib)))
+        SHARED_LIBS_DIRS_ARRAY+=("$(dirname "$(realpath "$lib")")")
     done
 fi
 
@@ -57,7 +59,7 @@ if [ ${#SHARED_LIBS_DIRS_ARRAY[@]} -ne 0 ]; then
     # Allow unbound variable here, in case LD_LIBRARY_PATH or similar is not already set
     set +u
     for dir in "${SHARED_LIBS_DIRS_ARRAY[@]}"; do
-        export ${LIB_PATH_VAR}="$dir":"${!LIB_PATH_VAR}"
+        export "${LIB_PATH_VAR}"="${dir}:${!LIB_PATH_VAR}"
     done
     set -u
 fi