diff --git a/build/build-image/rsyncd.sh b/build/build-image/rsyncd.sh
index 21546e59d48..8c00838be10 100755
--- a/build/build-image/rsyncd.sh
+++ b/build/build-image/rsyncd.sh
@@ -45,7 +45,7 @@ mkdir -p "${CONFDIR}"
 if [[ -f "${PIDFILE}" ]]; then
   PID=$(cat "${PIDFILE}")
   echo "Cleaning up old PID file: ${PIDFILE}"
-  kill $PID &> /dev/null || true
+  kill "${PID}" &> /dev/null || true
   rm "${PIDFILE}"
 fi
 
diff --git a/build/copy-output.sh b/build/copy-output.sh
index 8b189224347..5829e81f49b 100755
--- a/build/copy-output.sh
+++ b/build/copy-output.sh
@@ -19,7 +19,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/build/common.sh"
 
 kube::build::verify_prereqs
diff --git a/build/make-build-image.sh b/build/make-build-image.sh
index 8ad0e3bbd31..9c7ba3a603f 100755
--- a/build/make-build-image.sh
+++ b/build/make-build-image.sh
@@ -24,7 +24,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT="$(dirname "${BASH_SOURCE}")/.."
+KUBE_ROOT="$(dirname "${BASH_SOURCE[0]}")/.."
 source "${KUBE_ROOT}/build/common.sh"
 
 kube::build::verify_prereqs
diff --git a/build/make-clean.sh b/build/make-clean.sh
index af59f33d137..b3f567490a6 100755
--- a/build/make-clean.sh
+++ b/build/make-clean.sh
@@ -19,7 +19,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/build/common.sh"
 
 kube::build::verify_prereqs false
diff --git a/build/package-tarballs.sh b/build/package-tarballs.sh
index 9432015b85b..0a5b778a446 100755
--- a/build/package-tarballs.sh
+++ b/build/package-tarballs.sh
@@ -18,7 +18,7 @@ set -o nounset
 set -o pipefail
 
 # Complete the release with the standard env
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/build/common.sh"
 source "${KUBE_ROOT}/build/lib/release.sh"
 
diff --git a/build/release-images.sh b/build/release-images.sh
index 3e02293eb75..1f15bd01e3a 100755
--- a/build/release-images.sh
+++ b/build/release-images.sh
@@ -21,7 +21,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/build/common.sh"
 source "${KUBE_ROOT}/build/lib/release.sh"
 
diff --git a/build/release-in-a-container.sh b/build/release-in-a-container.sh
index a160fe927b6..e21d2ad17d9 100755
--- a/build/release-in-a-container.sh
+++ b/build/release-in-a-container.sh
@@ -18,7 +18,7 @@ set -o nounset
 set -o pipefail
 
 # Complete the release with the standard env
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 # Check and error if not "in-a-container"
 if [[ ! -f /.dockerenv ]]; then
@@ -46,4 +46,4 @@ if [[ $KUBE_RELEASE_RUN_TESTS =~ ^[yY]$ ]]; then
   make test
 fi
 
-$KUBE_ROOT/build/package-tarballs.sh
+"${KUBE_ROOT}/build/package-tarballs.sh"
diff --git a/build/release.sh b/build/release.sh
index 9e7876b46c6..20010d29aaa 100755
--- a/build/release.sh
+++ b/build/release.sh
@@ -25,7 +25,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/build/common.sh"
 source "${KUBE_ROOT}/build/lib/release.sh"
 
diff --git a/build/run.sh b/build/run.sh
index b0465fb6b38..3ecc2dacb77 100755
--- a/build/run.sh
+++ b/build/run.sh
@@ -22,7 +22,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "$KUBE_ROOT/build/common.sh"
 
 KUBE_RUN_COPY_OUTPUT="${KUBE_RUN_COPY_OUTPUT:-y}"
diff --git a/build/shell.sh b/build/shell.sh
index 7572cedbc80..63efc92a61e 100755
--- a/build/shell.sh
+++ b/build/shell.sh
@@ -22,7 +22,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/build/common.sh"
 
 KUBE_RUN_COPY_OUTPUT="${KUBE_RUN_COPY_OUTPUT:-n}" "${KUBE_ROOT}/build/run.sh" bash "$@"
diff --git a/build/util.sh b/build/util.sh
index 32152ff9214..cfa88fc5299 100644
--- a/build/util.sh
+++ b/build/util.sh
@@ -16,17 +16,17 @@
 
 # Common utility functions for build scripts
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 function kube::release::semantic_version() {
   # This takes:
   # Client Version: version.Info{Major:"1", Minor:"1+", GitVersion:"v1.1.0-alpha.0.2328+3c0a05de4a38e3", GitCommit:"3c0a05de4a38e355d147dbfb4d85bad6d2d73bb9", GitTreeState:"clean"}
   # and spits back the GitVersion piece in a way that is somewhat
   # resilient to the other fields changing (we hope)
-  ${KUBE_ROOT}/cluster/kubectl.sh version --client | sed "s/, */\\
-/g" | egrep "^GitVersion:" | cut -f2 -d: | cut -f2 -d\"
+  "${KUBE_ROOT}/cluster/kubectl.sh" version --client | sed "s/, */\\
+/g" | grep -E "^GitVersion:" | cut -f2 -d: | cut -f2 -d\"
 }
 
 function kube::release::semantic_image_tag_version() {
-    printf "$(kube::release::semantic_version)" | tr + _
+    printf "%s" "$(kube::release::semantic_version)" | tr + _
 }
diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index c0cd214d0a6..c35cbe8600d 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -1,16 +1,5 @@
-./build/build-image/rsyncd.sh
 ./build/common.sh
-./build/copy-output.sh
 ./build/lib/release.sh
-./build/make-build-image.sh
-./build/make-clean.sh
-./build/package-tarballs.sh
-./build/release-images.sh
-./build/release-in-a-container.sh
-./build/release.sh
-./build/run.sh
-./build/shell.sh
-./build/util.sh
 ./cluster/addons/addon-manager/kube-addons.sh
 ./cluster/addons/fluentd-elasticsearch/es-image/run.sh
 ./cluster/addons/fluentd-elasticsearch/fluentd-es-image/run.sh