diff --git a/build/common.sh b/build/common.sh
index 4ca61a979ca..4080946358c 100755
--- a/build/common.sh
+++ b/build/common.sh
@@ -38,10 +38,12 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 
 # Constants
 readonly KUBE_BUILD_IMAGE_REPO=kube-build
-readonly KUBE_BUILD_IMAGE_CROSS_TAG="$(cat "${KUBE_ROOT}/build/build-image/cross/VERSION")"
+KUBE_BUILD_IMAGE_CROSS_TAG="$(cat "${KUBE_ROOT}/build/build-image/cross/VERSION")"
+readonly KUBE_BUILD_IMAGE_CROSS_TAG
 
 readonly KUBE_DOCKER_REGISTRY="${KUBE_DOCKER_REGISTRY:-registry.k8s.io}"
-readonly KUBE_BASE_IMAGE_REGISTRY="${KUBE_BASE_IMAGE_REGISTRY:-registry.k8s.io/build-image}"
+KUBE_BASE_IMAGE_REGISTRY="${KUBE_BASE_IMAGE_REGISTRY:-registry.k8s.io/build-image}"
+readonly KUBE_BASE_IMAGE_REGISTRY
 
 # This version number is used to cause everyone to rebuild their data containers
 # and build image.  This is especially useful for automated build systems like
@@ -49,12 +51,15 @@ readonly KUBE_BASE_IMAGE_REGISTRY="${KUBE_BASE_IMAGE_REGISTRY:-registry.k8s.io/b
 #
 # Increment/change this number if you change the build image (anything under
 # build/build-image) or change the set of volumes in the data container.
-readonly KUBE_BUILD_IMAGE_VERSION_BASE="$(cat "${KUBE_ROOT}/build/build-image/VERSION")"
+KUBE_BUILD_IMAGE_VERSION_BASE="$(cat "${KUBE_ROOT}/build/build-image/VERSION")"
+readonly KUBE_BUILD_IMAGE_VERSION_BASE
 readonly KUBE_BUILD_IMAGE_VERSION="${KUBE_BUILD_IMAGE_VERSION_BASE}-${KUBE_BUILD_IMAGE_CROSS_TAG}"
 
 # Make it possible to override the `kube-cross` image, and tag independent of `KUBE_BASE_IMAGE_REGISTRY`
-readonly KUBE_CROSS_IMAGE="${KUBE_CROSS_IMAGE:-"${KUBE_BASE_IMAGE_REGISTRY}/kube-cross"}"
-readonly KUBE_CROSS_VERSION="${KUBE_CROSS_VERSION:-"${KUBE_BUILD_IMAGE_CROSS_TAG}"}"
+KUBE_CROSS_IMAGE="${KUBE_CROSS_IMAGE:-"${KUBE_BASE_IMAGE_REGISTRY}/kube-cross"}"
+readonly KUBE_CROSS_IMAGE
+KUBE_CROSS_VERSION="${KUBE_CROSS_VERSION:-"${KUBE_BUILD_IMAGE_CROSS_TAG}"}"
+readonly KUBE_CROSS_VERSION
 
 # Here we map the output directories across both the local and remote _output
 # directories:
diff --git a/cluster/gce/util.sh b/cluster/gce/util.sh
index 9431ebbf285..f86a4ca3f82 100755
--- a/cluster/gce/util.sh
+++ b/cluster/gce/util.sh
@@ -2631,7 +2631,7 @@ function delete-subnetworks() {
       # This value should be kept in sync with number of regions.
       local parallelism=9
       gcloud compute networks subnets list --network="${NETWORK}" --project "${NETWORK_PROJECT}" --format='value(region.basename())' | \
-        xargs -i -P ${parallelism} gcloud --quiet compute networks subnets delete "${NETWORK}" --project "${NETWORK_PROJECT}" --region="{}" || true
+        xargs -I {} -P ${parallelism} gcloud --quiet compute networks subnets delete "${NETWORK}" --project "${NETWORK_PROJECT}" --region="{}" || true
     elif [[ "${CREATE_CUSTOM_NETWORK:-}" == "true" ]]; then
       echo "Deleting custom subnet..."
       gcloud --quiet compute networks subnets delete "${SUBNETWORK}" --project "${NETWORK_PROJECT}" --region="${REGION}" || true
diff --git a/hack/lib/test.sh b/hack/lib/test.sh
index 2a38f8f1bc5..9089f00bd18 100644
--- a/hack/lib/test.sh
+++ b/hack/lib/test.sh
@@ -18,11 +18,12 @@
 
 # A set of helpers for tests
 
-readonly reset=$(tput sgr0)
-readonly  bold=$(tput bold)
-readonly black=$(tput setaf 0)
-readonly   red=$(tput setaf 1)
-readonly green=$(tput setaf 2)
+reset=$(tput sgr0)
+bold=$(tput bold)
+black=$(tput setaf 0)
+red=$(tput setaf 1)
+green=$(tput setaf 2)
+readonly reset bold black red green
 
 kube::test::clear_all() {
   if kube::test::if_supports_resource "rc" ; then
diff --git a/hack/lib/util.sh b/hack/lib/util.sh
index fba83b2fa82..02cf4e3aa7d 100755
--- a/hack/lib/util.sh
+++ b/hack/lib/util.sh
@@ -603,11 +603,9 @@ function kube::util::list_staging_repos() {
 
 # Determines if docker can be run, failures may simply require that the user be added to the docker group.
 function kube::util::ensure_docker_daemon_connectivity {
-  IFS=" " read -ra DOCKER <<< "${DOCKER_OPTS}"
-  # Expand ${DOCKER[@]} only if it's not unset. This is to work around
-  # Bash 3 issue with unbound variable.
-  DOCKER=(docker ${DOCKER[@]:+"${DOCKER[@]}"})
-  if ! "${DOCKER[@]}" info > /dev/null 2>&1 ; then
+  DOCKER_OPTS=${DOCKER_OPTS:-""}
+  IFS=" " read -ra docker_opts <<< "${DOCKER_OPTS}"
+  if ! docker "${docker_opts[@]:+"${docker_opts[@]}"}" info > /dev/null 2>&1 ; then
     cat <<'EOF' >&2
 Can't connect to 'docker' daemon.  please fix and retry.
 
diff --git a/hack/make-rules/make-help.sh b/hack/make-rules/make-help.sh
index 270b17d6c03..a9d750b3919 100755
--- a/hack/make-rules/make-help.sh
+++ b/hack/make-rules/make-help.sh
@@ -18,8 +18,9 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-readonly red=$(tput setaf 1)
-readonly reset=$(tput sgr0)
+red=$(tput setaf 1)
+reset=$(tput sgr0)
+readonly red reset
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/../..
 ALL_TARGETS=$(make -C "${KUBE_ROOT}" PRINT_HELP=y -rpn | sed -n -e '/^$/ { n ; /^[^ .#][^ ]*:/ { s/:.*$// ; p ; } ; }' | sort)
diff --git a/hack/verify-e2e-test-ownership.sh b/hack/verify-e2e-test-ownership.sh
index 6cf1a9cbe0a..606ebf3e806 100755
--- a/hack/verify-e2e-test-ownership.sh
+++ b/hack/verify-e2e-test-ownership.sh
@@ -41,7 +41,8 @@ fi
 pushd "${KUBE_ROOT}" > /dev/null
 
 # Setup a tmpdir to hold generated scripts and results
-readonly tmpdir=$(mktemp -d -t verify-e2e-test-ownership.XXXX)
+tmpdir=$(mktemp -d -t verify-e2e-test-ownership.XXXX)
+readonly tmpdir
 trap 'rm -rf ${tmpdir}' EXIT
 
 # input
diff --git a/hack/verify-generated-swagger-docs.sh b/hack/verify-generated-swagger-docs.sh
index 4931baefab3..bda93a84533 100755
--- a/hack/verify-generated-swagger-docs.sh
+++ b/hack/verify-generated-swagger-docs.sh
@@ -70,7 +70,7 @@ ret=0
 pushd "${KUBE_ROOT}" > /dev/null 2>&1
   # Test for diffs
   _output=""
-  for file in ${TARGET_FILES[*]}; do
+  for file in "${TARGET_FILES[@]}"; do
     _output="${_output}$(diff -Naupr -I 'Auto generated by' "${KUBE_ROOT}/${file}" "${_kubetmp}/${file}")" || ret=1
   done
 
diff --git a/hack/verify-shellcheck.sh b/hack/verify-shellcheck.sh
index c6a506e8db9..258c1831169 100755
--- a/hack/verify-shellcheck.sh
+++ b/hack/verify-shellcheck.sh
@@ -39,6 +39,10 @@ disabled=(
   # this lint disallows non-constant source, which we use extensively without
   # any known bugs
   1090
+  # this lint warns when shellcheck cannot find a sourced file
+  # this wouldn't be a bad idea to warn on, but it fails on lots of path
+  # dependent sourcing, so just disable enforcing it
+  1091
   # this lint prefers command -v to which, they are not the same
   2230
 )