diff --git a/build/common.sh b/build/common.sh
index 4080946358c..dd7ee878cae 100755
--- a/build/common.sh
+++ b/build/common.sh
@@ -150,6 +150,7 @@ kube::build::get_docker_wrapped_binaries() {
 #   KUBE_RSYNC_CONTAINER_NAME
 #   DOCKER_MOUNT_ARGS
 #   LOCAL_OUTPUT_BUILD_CONTEXT
+# shellcheck disable=SC2120 # optional parameters
 function kube::build::verify_prereqs() {
   local -r require_docker=${1:-true}
   kube::log::status "Verifying Prerequisites...."
diff --git a/cluster/get-kube.sh b/cluster/get-kube.sh
index d3075f687e6..15342d26602 100755
--- a/cluster/get-kube.sh
+++ b/cluster/get-kube.sh
@@ -190,6 +190,7 @@ if [[ -z "${KUBERNETES_SKIP_RELEASE_VALIDATION-}" ]]; then
   if [[ ${KUBE_VERSION} =~ ${KUBE_RELEASE_VERSION_REGEX} ]]; then
     # Use KUBERNETES_RELEASE_URL for Releases and Pre-Releases
     # ie. 1.18.0 or 1.19.0-beta.0
+    # shellcheck disable=SC2269 # this line is a noop but it helps with reading
     KUBERNETES_RELEASE_URL="${KUBERNETES_RELEASE_URL}"
   elif [[ ${KUBE_VERSION} =~ ${KUBE_CI_VERSION_REGEX} ]]; then
     # Override KUBERNETES_RELEASE_URL to point to the CI bucket;
diff --git a/hack/lib/util.sh b/hack/lib/util.sh
index ce89e5f5104..ad284906209 100755
--- a/hack/lib/util.sh
+++ b/hack/lib/util.sh
@@ -656,6 +656,7 @@ function kube::util::join {
 #  CFSSL_BIN: The path of the installed cfssl binary
 #  CFSSLJSON_BIN: The path of the installed cfssljson binary
 #
+# shellcheck disable=SC2120 # optional parameters
 function kube::util::ensure-cfssl {
   if command -v cfssl &>/dev/null && command -v cfssljson &>/dev/null; then
     CFSSL_BIN=$(command -v cfssl)
diff --git a/hack/local-up-cluster.sh b/hack/local-up-cluster.sh
index 69dacaa5ead..3296d2ddbd4 100755
--- a/hack/local-up-cluster.sh
+++ b/hack/local-up-cluster.sh
@@ -186,7 +186,7 @@ do
     esac
 done
 
-if [ "x${GO_OUT}" == "x" ]; then
+if [ -z "${GO_OUT}" ]; then
     make -C "${KUBE_ROOT}" WHAT="cmd/kubectl cmd/kube-apiserver cmd/kube-controller-manager cmd/cloud-controller-manager cmd/kubelet cmd/kube-proxy cmd/kube-scheduler"
 else
     echo "skipped the build."