diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index 07f643d7a34..a155d98493c 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -178,10 +178,6 @@
 ./staging/src/k8s.io/apiextensions-apiserver/hack/build-image.sh
 ./staging/src/k8s.io/apiextensions-apiserver/hack/update-codegen.sh
 ./staging/src/k8s.io/apiextensions-apiserver/hack/verify-codegen.sh
-./staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts/gencerts.sh
-./staging/src/k8s.io/apiserver/pkg/util/webhook/gencerts.sh
-./staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/gen.sh
-./staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/gencerts.sh
 ./staging/src/k8s.io/code-generator/generate-groups.sh
 ./staging/src/k8s.io/code-generator/generate-internal-groups.sh
 ./staging/src/k8s.io/code-generator/hack/update-codegen.sh
diff --git a/staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts/gencerts.sh b/staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts/gencerts.sh
index 98503f69f44..34493b966d5 100755
--- a/staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts/gencerts.sh
+++ b/staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts/gencerts.sh
@@ -90,12 +90,12 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+// This file was generated using openssl by the gencerts.sh script
+// and holds raw certificates for the webhook tests.
+
+package testcerts
 EOF
 
-echo "// This file was generated using openssl by the gencerts.sh script" >> $outfile
-echo "// and holds raw certificates for the webhook tests." >> $outfile
-echo "" >> $outfile
-echo "package testcerts" >> $outfile
 for file in CAKey CACert BadCAKey BadCACert ServerKey ServerCert ClientKey ClientCert; do
 	data=$(cat ${file}.pem)
 	echo "" >> $outfile
@@ -103,7 +103,7 @@ for file in CAKey CACert BadCAKey BadCACert ServerKey ServerCert ClientKey Clien
 done
 
 # Clean up after we're done.
-rm *.pem
-rm *.csr
-rm *.srl
-rm *.conf
+rm ./*.pem
+rm ./*.csr
+rm ./*.srl
+rm ./*.conf
diff --git a/staging/src/k8s.io/apiserver/pkg/util/webhook/gencerts.sh b/staging/src/k8s.io/apiserver/pkg/util/webhook/gencerts.sh
index a042ab62af8..de407730117 100755
--- a/staging/src/k8s.io/apiserver/pkg/util/webhook/gencerts.sh
+++ b/staging/src/k8s.io/apiserver/pkg/util/webhook/gencerts.sh
@@ -88,12 +88,12 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+// This file was generated using openssl by the gencerts.sh script
+// and holds raw certificates for the webhook tests.
+
+package webhook
 EOF
 
-echo "// This file was generated using openssl by the gencerts.sh script" >> $outfile
-echo "// and holds raw certificates for the webhook tests." >> $outfile
-echo "" >> $outfile
-echo "package webhook" >> $outfile
 for file in caKey caCert badCAKey badCACert serverKey serverCert clientKey clientCert; do
 	data=$(cat ${file}.pem)
 	echo "" >> $outfile
@@ -101,7 +101,7 @@ for file in caKey caCert badCAKey badCACert serverKey serverCert clientKey clien
 done
 
 # Clean up after we're done.
-rm *.pem
-rm *.csr
-rm *.srl
-rm *.conf
+rm ./*.pem
+rm ./*.csr
+rm ./*.srl
+rm ./*.conf
diff --git a/staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/gen.sh b/staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/gen.sh
index 922e64e5a24..d7b3df81677 100755
--- a/staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/gen.sh
+++ b/staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/gen.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env bash -e
+#!/usr/bin/env bash
 
 # Copyright 2018 The Kubernetes Authors.
 #
@@ -14,14 +14,16 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-rm *.pem
+set -e
 
-for N in `seq 1 3`; do
-    ssh-keygen -t rsa -b 2048 -f rsa_$N.pem -N ''
+rm ./*.pem
+
+for N in $(seq 1 3); do
+    ssh-keygen -t rsa -b 2048 -f rsa_"$N".pem -N ''
 done
 
-for N in `seq 1 3`; do
-    ssh-keygen -t ecdsa -b 521 -f ecdsa_$N.pem -N ''
+for N in $(seq 1 3); do
+    ssh-keygen -t ecdsa -b 521 -f ecdsa_"$N".pem -N ''
 done
 
-rm *.pub
+rm ./*.pub
diff --git a/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/gencerts.sh b/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/gencerts.sh
index 1e5fb1fd503..b20f17c5e8b 100755
--- a/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/gencerts.sh
+++ b/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/gencerts.sh
@@ -83,12 +83,12 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+// This file was generated using openssl by the gencerts.sh script
+// and holds raw certificates for the webhook tests.
+
+package webhook
 EOF
 
-echo "// This file was generated using openssl by the gencerts.sh script" >> $outfile
-echo "// and holds raw certificates for the webhook tests." >> $outfile
-echo "" >> $outfile
-echo "package webhook" >> $outfile
 for file in caKey caCert badCAKey badCACert serverKey serverCert clientKey clientCert; do
 	data=$(cat ${file}.pem)
 	echo "" >> $outfile
@@ -96,7 +96,7 @@ for file in caKey caCert badCAKey badCACert serverKey serverCert clientKey clien
 done
 
 # Clean up after we're done.
-rm *.pem
-rm *.csr
-rm *.srl
-rm *.conf
+rm ./*.pem
+rm ./*.csr
+rm ./*.srl
+rm ./*.conf