diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index c0ed815ac5f..7822bc4d17a 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -33,8 +33,6 @@
 ./hack/jenkins/upload-to-gcs.sh
 ./hack/jenkins/verify-dockerized.sh
 ./hack/lib/init.sh
-./hack/lib/logging.sh
-./hack/lib/protoc.sh
 ./hack/lib/swagger.sh
 ./hack/lib/test.sh
 ./hack/lib/version.sh
diff --git a/hack/lib/logging.sh b/hack/lib/logging.sh
index e8de267d216..ac44d0d44a2 100644
--- a/hack/lib/logging.sh
+++ b/hack/lib/logging.sh
@@ -20,7 +20,7 @@ KUBE_VERBOSE="${KUBE_VERBOSE:-5}"
 # Handler for when we exit automatically on an error.
 # Borrowed from https://gist.github.com/ahendrix/7030300
 kube::log::errexit() {
-  local err="${PIPESTATUS[@]}"
+  local err="${PIPESTATUS[*]}"
 
   # If the shell we are in doesn't have errexit set (common in subshells) then
   # don't dump stacks.
@@ -60,7 +60,7 @@ kube::log::stack() {
   if [[ ${#FUNCNAME[@]} -gt ${stack_skip} ]]; then
     echo "Call stack:" >&2
     local i
-    for ((i=1 ; i <= ${#FUNCNAME[@]} - ${stack_skip} ; i++))
+    for ((i=1 ; i <= ${#FUNCNAME[@]} - stack_skip ; i++))
     do
       local frame_no=$((i - 1 + stack_skip))
       local source_file=${BASH_SOURCE[${frame_no}]}
diff --git a/hack/lib/protoc.sh b/hack/lib/protoc.sh
index 304f070417f..dac437ecdb7 100644
--- a/hack/lib/protoc.sh
+++ b/hack/lib/protoc.sh
@@ -19,7 +19,7 @@ set -o nounset
 set -o pipefail
 
 # The root of the build/dist directory
-KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE}")/../.." && pwd -P)"
+KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)"
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
 # Generates $1/api.pb.go from the protobuf file $1/api.proto
@@ -35,8 +35,8 @@ function kube::protoc::generate_proto() {
   kube::protoc::check_protoc
 
   local package=${1}
-  kube::protoc::protoc ${package}
-  kube::protoc::format ${package}
+  kube::protoc::protoc "${package}"
+  kube::protoc::format "${package}"
 }
 
 # Checks that the current protoc version is at least version 3.0.0-beta1
@@ -62,7 +62,7 @@ function kube::protoc::protoc() {
   PATH="${gogopath}:${PATH}" protoc \
     --proto_path="${package}" \
     --proto_path="${KUBE_ROOT}/vendor" \
-    --gogo_out=plugins=grpc:${package} ${package}/api.proto
+    --gogo_out=plugins=grpc:"${package}" "${package}/api.proto"
 }
 
 # Formats $1/api.pb.go, adds the boilerplate comments and run gofmt on it
@@ -71,20 +71,20 @@ function kube::protoc::format() {
   local package=${1}
 
   # Update boilerplate for the generated file.
-  echo "$(cat hack/boilerplate/boilerplate.generatego.txt ${package}/api.pb.go)" > ${package}/api.pb.go
+  cat hack/boilerplate/boilerplate.generatego.txt "${package}/api.pb.go" > tmpfile && mv tmpfile "${package}/api.pb.go"
 
   # Run gofmt to clean up the generated code.
   kube::golang::verify_go_version
-  gofmt -l -s -w ${package}/api.pb.go
+  gofmt -l -s -w "${package}/api.pb.go"
 }
 
 # Compares the contents of $1 and $2
 # Echo's $3 in case of error and exits 1
 function kube::protoc::diff() {
   local ret=0
-  diff -I "gzipped FileDescriptorProto" -I "0x" -Naupr ${1} ${2} || ret=$?
+  diff -I "gzipped FileDescriptorProto" -I "0x" -Naupr "${1}" "${2}" || ret=$?
   if [[ ${ret} -ne 0 ]]; then
-    echo ${3}
+    echo "${3}"
     exit 1
   fi
 }