diff --git a/ci/gh-util.sh b/ci/gh-util.sh
index 00c40f2e6e..d7c9ec52d2 100755
--- a/ci/gh-util.sh
+++ b/ci/gh-util.sh
@@ -59,7 +59,7 @@ list_issues_for_pr()
 
     [[ -z "${pr}" ]] && die "need PR"
 
-    local commits=$(gh pr view ${pr} --repo ${repo} --json commits --jq .commits[].messageBody)
+    local commits=$(gh pr view "${pr}" --repo "${repo}" --json commits --jq .commits[].messageBody)
 
     [[ -z "${commits}" ]] && die "cannot determine commits for PR ${pr}"
 
@@ -105,7 +105,7 @@ list_labels_for_issue()
 
     [[ -z "${issue}" ]] && die "need issue number"
 
-    local labels=$(gh issue view ${issue} --repo kata-containers/kata-containers --json labels)
+    local labels=$(gh issue view "${issue}" --repo kata-containers/kata-containers --json labels)
 
     [[ -z "${labels}" ]] && die "cannot determine labels for issue ${issue}"
 
diff --git a/ci/openshift-ci/bisect-range.sh b/ci/openshift-ci/bisect-range.sh
index 04da17f1f5..cdf1ed2920 100755
--- a/ci/openshift-ci/bisect-range.sh
+++ b/ci/openshift-ci/bisect-range.sh
@@ -19,7 +19,7 @@ TAGS=$(echo "${TAGS}" | jq '.Tags' | jq "map(select(endswith(\"${ARCH}\")))" | j
 # Sort by git
 SORTED=""
 [[ -n "${BAD}" ]] && LOG_ARGS="${GOOD}~1..${BAD}" || LOG_ARGS="${GOOD}~1.."
-for TAG in $(git log --merges --pretty=format:%H --reverse ${LOG_ARGS}); do
+for TAG in $(git log --merges --pretty=format:%H --reverse "${LOG_ARGS}"); do
 	[[ "${TAGS}" =~ "${TAG}" ]] && SORTED+="
 kata-containers-${TAG}-${ARCH}"
 done
diff --git a/ci/openshift-ci/cleanup.sh b/ci/openshift-ci/cleanup.sh
index feceeee5c3..6bd68660f8 100755
--- a/ci/openshift-ci/cleanup.sh
+++ b/ci/openshift-ci/cleanup.sh
@@ -7,11 +7,11 @@
 # This script tries to removes most of the resources added by `test.sh` script
 # from the cluster.
 
-scripts_dir=$(dirname $0)
+scripts_dir=$(dirname "$0")
 deployments_dir=${scripts_dir}/cluster/deployments
 configs_dir=${scripts_dir}/configs
 
-source ${scripts_dir}/lib.sh
+source "${scripts_dir}/lib.sh"
 
 # Set to 'yes' if you want to configure SELinux to permissive on the cluster
 # workers.
diff --git a/ci/openshift-ci/cluster/deploy_webhook.sh b/ci/openshift-ci/cluster/deploy_webhook.sh
index cee518a246..266abd9c25 100755
--- a/ci/openshift-ci/cluster/deploy_webhook.sh
+++ b/ci/openshift-ci/cluster/deploy_webhook.sh
@@ -13,7 +13,7 @@ set -e
 set -o nounset
 set -o pipefail
 
-script_dir="$(realpath $(dirname $0))"
+script_dir="$(realpath $(dirname "$0"))"
 webhook_dir="${script_dir}/../../../tools/testing/kata-webhook"
 source "${script_dir}/../lib.sh"
 KATA_RUNTIME=${KATA_RUNTIME:-kata-ci}
diff --git a/ci/openshift-ci/cluster/install_kata.sh b/ci/openshift-ci/cluster/install_kata.sh
index 0a743507e9..1ab4ffbf38 100755
--- a/ci/openshift-ci/cluster/install_kata.sh
+++ b/ci/openshift-ci/cluster/install_kata.sh
@@ -7,11 +7,11 @@
 # This script installs the built kata-containers in the test cluster,
 # and configure a runtime.
 
-scripts_dir=$(dirname $0)
+scripts_dir=$(dirname "$0")
 deployments_dir=${scripts_dir}/deployments
 configs_dir=${scripts_dir}/configs
 
-source ${scripts_dir}/../lib.sh
+source "${scripts_dir}/../lib.sh"
 
 # Set to 'yes' if you want to configure SELinux to permissive on the cluster
 # workers.
@@ -69,7 +69,7 @@ wait_for_reboot() {
 	# Get the boot ID to compared it changed over time.
 	for node in "${workers[@]}"; do
 		BOOTIDS[${node}]=$(oc get -o jsonpath='{.status.nodeInfo.bootID}'\
-			node/${node})
+			"node/${node}")
 		echo "Wait ${node} reboot"
 	done
 
@@ -86,7 +86,7 @@ wait_for_reboot() {
 		for i in "${!workers[@]}"; do
 			current_id=$(oc get \
 				-o jsonpath='{.status.nodeInfo.bootID}' \
-				node/${workers[i]})
+				"node/${workers[i]}")
 			if [[ "${current_id}" != ${BOOTIDS[${workers[i]}]} ]]; then
 				echo "${workers[i]} rebooted"
 				unset workers[i]
@@ -135,8 +135,8 @@ wait_mcp_update() {
 enable_sandboxedcontainers_extension() {
 	info "Enabling the RHCOS extension for Sandboxed Containers"
 	local deployment_file="${deployments_dir}/machineconfig_sandboxedcontainers_extension.yaml"
-	oc apply -f ${deployment_file}
-	oc get -f ${deployment_file} || \
+	oc apply -f "${deployment_file}"
+	oc get -f "${deployment_file}" || \
 		die "Sandboxed Containers extension machineconfig not found"
 	wait_mcp_update || die "Failed to update the machineconfigpool"
 }
@@ -174,7 +174,7 @@ wait_for_app_pods_message() {
 	local i
 	SECONDS=0
 	while :; do
-		pods=($(oc get pods -l app="${app}" --no-headers=true ${namespace} | awk '{print $1}'))
+		pods=($(oc get pods -l app="${app}" --no-headers=true "${namespace}" | awk '{print $1}'))
 		[[ "${#pods}" -ge "${pod_count}" ]] && break
 		if [[ "${SECONDS}" -gt "${timeout}" ]]; then
 			printf "Unable to find ${pod_count} pods for '-l app=\"${app}\"' in ${SECONDS}s (%s)" "${pods[@]}"
@@ -183,7 +183,7 @@ wait_for_app_pods_message() {
 	done
 	for pod in "${pods[@]}"; do
 		while :; do
-			local log=$(oc logs ${namespace} "${pod}")
+			local log=$(oc logs "${namespace}" "${pod}")
 			echo "${log}" | grep "${message}" -q && echo "Found $(echo "${log}" | grep "${message}") in ${pod}'s log (${SECONDS})" && break;
 			if [[ "${SECONDS}" -gt "${timeout}" ]]; then
 				echo -n "Message '${message}' not present in '${pod}' pod of the '-l app=\"${app}\"' "
@@ -200,18 +200,18 @@ wait_for_app_pods_message() {
 oc config set-context --current --namespace=default
 
 worker_nodes=$(oc get nodes |  awk '{if ($3 == "worker") { print $1 } }')
-num_nodes=$(echo ${worker_nodes} | wc -w)
+num_nodes=$(echo "${worker_nodes}" | wc -w)
 [[ ${num_nodes} -ne 0 ]] || \
 	die "No worker nodes detected. Something is wrong with the cluster"
 
 if [[ "${KATA_WITH_SYSTEM_QEMU}" == "yes" ]]; then
 	# QEMU is deployed on the workers via RCHOS extension.
 	enable_sandboxedcontainers_extension
-	oc apply -f ${deployments_dir}/configmap_installer_qemu.yaml
+	oc apply -f "${deployments_dir}/configmap_installer_qemu.yaml"
 fi
 
 if [[ "${KATA_WITH_HOST_KERNEL}" == "yes" ]]; then
-	oc apply -f ${deployments_dir}/configmap_installer_kernel.yaml
+	oc apply -f "${deployments_dir}/configmap_installer_kernel.yaml"
 fi
 
 apply_kata_deploy
@@ -221,10 +221,10 @@ if [[ ${SELINUX_PERMISSIVE} == "yes" ]]; then
 	info "Configuring SELinux"
 	if [[ -z "${SELINUX_CONF_BASE64}" ]]; then
 		export SELINUX_CONF_BASE64=$(echo \
-			$(cat ${configs_dir}/selinux.conf|base64) | \
+			$(cat "${configs_dir}/selinux.conf"|base64) | \
 			sed -e 's/\s//g')
 	fi
-	envsubst < ${deployments_dir}/machineconfig_selinux.yaml.in | \
+	envsubst < "${deployments_dir}"/machineconfig_selinux.yaml.in | \
 		oc apply -f -
 	oc get machineconfig/51-kata-selinux || \
 		die "SELinux machineconfig not found"
@@ -241,5 +241,5 @@ fi
 
 # FIXME: Remove when https://github.com/kata-containers/kata-containers/pull/8417 is resolved
 # Selinux context is currently not handled by kata-deploy
-oc apply -f ${deployments_dir}/relabel_selinux.yaml
+oc apply -f "${deployments_dir}/relabel_selinux.yaml"
 wait_for_app_pods_message restorecon "${num_nodes}" "NSENTER_FINISHED_WITH:" 120 "kube-system" || echo "Failed to treat selinux, proceeding anyway..."
diff --git a/ci/openshift-ci/run_smoke_test.sh b/ci/openshift-ci/run_smoke_test.sh
index 4a16d1137d..08480a41fc 100755
--- a/ci/openshift-ci/run_smoke_test.sh
+++ b/ci/openshift-ci/run_smoke_test.sh
@@ -7,8 +7,8 @@
 # Run a smoke test.
 #
 
-script_dir=$(dirname $0)
-source ${script_dir}/lib.sh
+script_dir=$(dirname "$0")
+source "${script_dir}/lib.sh"
 
 pod='http-server'
 
@@ -42,7 +42,7 @@ hello_msg='Hello World'
 oc exec ${pod} -- sh -c "echo ${hello_msg} > ${hello_file}"
 
 info "Creating the service and route"
-if oc apply -f ${script_dir}/smoke/service.yaml; then
+if oc apply -f "${script_dir}/smoke/service.yaml"; then
     # Likely on OCP, use service
     is_ocp=1
     host=$(oc get route/http-server-route -o jsonpath={.spec.host})
@@ -84,9 +84,9 @@ rm -f "${tempfile}"
 #
 info "Deleting the service/route"
 if [[ "${is_ocp}" -eq 0 ]]; then
-    oc delete -f ${script_dir}/smoke/service_kubernetes.yaml
+    oc delete -f "${script_dir}/smoke/service_kubernetes.yaml"
 else
-    oc delete -f ${script_dir}/smoke/service.yaml
+    oc delete -f "${script_dir}/smoke/service.yaml"
 fi
 info "Deleting the ${pod} pod"
 oc delete pod/${pod} || test_status=$?
diff --git a/ci/openshift-ci/test.sh b/ci/openshift-ci/test.sh
index 0c04b84365..89ce5bc173 100755
--- a/ci/openshift-ci/test.sh
+++ b/ci/openshift-ci/test.sh
@@ -8,8 +8,8 @@
 # The kata shim to be used
 export KATA_RUNTIME=${KATA_RUNTIME:-kata-qemu}
 
-script_dir=$(dirname $0)
-source ${script_dir}/lib.sh
+script_dir=$(dirname "$0")
+source "${script_dir}/lib.sh"
 
 suite=$1
 if [[ -z "$1" ]]; then
@@ -23,10 +23,10 @@ oc version || die "Test cluster is unreachable"
 
 info "Install and configure kata into the test cluster"
 export SELINUX_PERMISSIVE="no"
-${script_dir}/cluster/install_kata.sh || die "Failed to install kata-containers"
+"${script_dir}/cluster/install_kata.sh" || die "Failed to install kata-containers"
 
 info "Run test suite: ${suite}"
 test_status='PASS'
-${script_dir}/run_${suite}_test.sh || test_status='FAIL'
+"${script_dir}/run_${suite}_test.sh" || test_status='FAIL'
 info "Test suite: ${suite}: ${test_status}"
 [[ "${test_status}" == "PASS" ]]