diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index 2f690713311..b0c4f595ece 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -34,7 +34,6 @@
 ./hack/jenkins/test-dockerized.sh
 ./hack/jenkins/upload-to-gcs.sh
 ./hack/jenkins/verify-dockerized.sh
-./hack/lib/golang.sh
 ./hack/lib/init.sh
 ./hack/lib/logging.sh
 ./hack/lib/protoc.sh
diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
index b9ab27efc36..9bef0029f29 100755
--- a/hack/lib/golang.sh
+++ b/hack/lib/golang.sh
@@ -345,12 +345,13 @@ kube::golang::unset_platform_envs() {
 # Create the GOPATH tree under $KUBE_OUTPUT
 kube::golang::create_gopath_tree() {
   local go_pkg_dir="${KUBE_GOPATH}/src/${KUBE_GO_PACKAGE}"
-  local go_pkg_basedir=$(dirname "${go_pkg_dir}")
+  local go_pkg_basedir
+  go_pkg_basedir=$(dirname "${go_pkg_dir}")
 
   mkdir -p "${go_pkg_basedir}"
 
   # TODO: This symlink should be relative.
-  if [[ ! -e "${go_pkg_dir}" || "$(readlink ${go_pkg_dir})" != "${KUBE_ROOT}" ]]; then
+  if [[ ! -e "${go_pkg_dir}" || "$(readlink "${go_pkg_dir}")" != "${KUBE_ROOT}" ]]; then
     ln -snf "${KUBE_ROOT}" "${go_pkg_dir}"
   fi
 
@@ -427,10 +428,11 @@ kube::golang::setup_env() {
   # cross-compiling, and `go install -o <file>` only works for a single pkg.
   local subdir
   subdir=$(kube::realpath . | sed "s|${KUBE_ROOT}||")
-  cd "${KUBE_GOPATH}/src/${KUBE_GO_PACKAGE}/${subdir}"
+  cd "${KUBE_GOPATH}/src/${KUBE_GO_PACKAGE}/${subdir}" || return 1
 
   # Set GOROOT so binaries that parse code can work properly.
-  export GOROOT=$(go env GOROOT)
+  GOROOT=$(go env GOROOT)
+  export GOROOT
 
   # Unset GOBIN in case it already exists in the current session.
   unset GOBIN
@@ -479,10 +481,11 @@ kube::golang::outfile_for_binary() {
   local binary=$1
   local platform=$2
   local output_path="${KUBE_GOPATH}/bin"
+  local bin
+  bin=$(basename "${binary}")
   if [[ "${platform}" != "${host_platform}" ]]; then
     output_path="${output_path}/${platform//\//_}"
   fi
-  local bin=$(basename "${binary}")
   if [[ ${GOOS} == "windows" ]]; then
     bin="${bin}.exe"
   fi
@@ -493,7 +496,7 @@ kube::golang::outfile_for_binary() {
 # Returns 0 if the binary can be built with coverage, 1 otherwise.
 # NB: this ignores whether coverage is globally enabled or not.
 kube::golang::is_instrumented_package() {
-  return $(kube::util::array_contains "$1" "${KUBE_COVERAGE_INSTRUMENTED_PACKAGES[@]}")
+  return "$(kube::util::array_contains "$1" "${KUBE_COVERAGE_INSTRUMENTED_PACKAGES[@]}")"
 }
 
 # Argument: the name of a Kubernetes package (e.g. k8s.io/kubernetes/cmd/kube-scheduler)
@@ -501,7 +504,8 @@ kube::golang::is_instrumented_package() {
 kube::golang::path_for_coverage_dummy_test() {
   local package="$1"
   local path="${KUBE_GOPATH}/src/${package}"
-  local name=$(basename "${package}")
+  local name
+  name=$(basename "${package}")
   echo "${path}/zz_generated_${name}_test.go"
 }
 
@@ -510,8 +514,9 @@ kube::golang::path_for_coverage_dummy_test() {
 # This unit test will invoke the package's standard entry point when run.
 kube::golang::create_coverage_dummy_test() {
   local package="$1"
-  local name="$(basename "${package}")"
-  cat <<EOF > $(kube::golang::path_for_coverage_dummy_test "${package}")
+  local name
+  name="$(basename "${package}")"
+  cat <<EOF > "$(kube::golang::path_for_coverage_dummy_test "${package}")"
 package main
 import (
   "testing"
@@ -539,7 +544,7 @@ EOF
 # It is not an error to call this for a nonexistent test.
 kube::golang::delete_coverage_dummy_test() {
   local package="$1"
-  rm -f $(kube::golang::path_for_coverage_dummy_test "${package}")
+  rm -f "$(kube::golang::path_for_coverage_dummy_test "${package}")"
 }
 
 # Arguments: a list of kubernetes packages to build.
@@ -572,7 +577,7 @@ kube::golang::build_some_binaries() {
       fi
     done
     if [[ "${#uncovered[@]}" != 0 ]]; then
-      V=2 kube::log::info "Building ${uncovered[@]} without coverage..."
+      V=2 kube::log::info "Building ${uncovered[*]} without coverage..."
       go install "${build_args[@]}" "${uncovered[@]}"
     else
       V=2 kube::log::info "Nothing to build without coverage."
@@ -594,11 +599,11 @@ kube::golang::build_binaries_for_platform() {
 
   for binary in "${binaries[@]}"; do
     if [[ "${binary}" =~ ".test"$ ]]; then
-      tests+=(${binary})
+      tests+=("${binary}")
     elif kube::golang::is_statically_linked_library "${binary}"; then
-      statics+=(${binary})
+      statics+=("${binary}")
     else
-      nonstatics+=(${binary})
+      nonstatics+=("${binary}")
     fi
   done
 
@@ -625,10 +630,11 @@ kube::golang::build_binaries_for_platform() {
   fi
 
   for test in "${tests[@]:+${tests[@]}}"; do
-    local outfile=$(kube::golang::outfile_for_binary "${test}" "${platform}")
-    local testpkg="$(dirname ${test})"
+    local outfile testpkg
+    outfile=$(kube::golang::outfile_for_binary "${test}" "${platform}")
+    testpkg=$(dirname "${test}")
 
-    mkdir -p "$(dirname ${outfile})"
+    mkdir -p "$(dirname "${outfile}")"
     go test -c \
       ${goflags:+"${goflags[@]}"} \
       -gcflags "${gogcflags:-}" \
@@ -645,13 +651,13 @@ kube::golang::get_physmem() {
 
   # Linux kernel version >=3.14, in kb
   if mem=$(grep MemAvailable /proc/meminfo | awk '{ print $2 }'); then
-    echo $(( ${mem} / 1048576 ))
+    echo $(( mem / 1048576 ))
     return
   fi
 
   # Linux, in kb
   if mem=$(grep MemTotal /proc/meminfo | awk '{ print $2 }'); then
-    echo $(( ${mem} / 1048576 ))
+    echo $(( mem / 1048576 ))
     return
   fi
 
@@ -660,7 +666,7 @@ kube::golang::get_physmem() {
   # platform case, which is a Dockerized build), but this is provided
   # for completeness.
   if mem=$(sysctl -n hw.memsize 2>/dev/null); then
-    echo $(( ${mem} / 1073741824 ))
+    echo $(( mem / 1073741824 ))
     return
   fi
 
@@ -713,7 +719,7 @@ kube::golang::build_binaries() {
     fi
 
     local binaries
-    binaries=($(kube::golang::binaries_from_targets "${targets[@]}"))
+    while IFS="" read -r binary; do binaries+=("$binary"); done < <(kube::golang::binaries_from_targets "${targets[@]}")
 
     local parallel=false
     if [[ ${#platforms[@]} -gt 1 ]]; then
@@ -735,14 +741,14 @@ kube::golang::build_binaries() {
       for platform in "${platforms[@]}"; do (
           kube::golang::set_platform_envs "${platform}"
           kube::log::status "${platform}: build started"
-          kube::golang::build_binaries_for_platform ${platform}
+          kube::golang::build_binaries_for_platform "${platform}"
           kube::log::status "${platform}: build finished"
         ) &> "/tmp//${platform//\//_}.build" &
       done
 
       local fails=0
       for job in $(jobs -p); do
-        wait ${job} || let "fails+=1"
+        wait "${job}" || (( fails+=1 ))
       done
 
       for platform in "${platforms[@]}"; do
@@ -755,7 +761,7 @@ kube::golang::build_binaries() {
         kube::log::status "Building go targets for ${platform}:" "${targets[@]}"
         (
           kube::golang::set_platform_envs "${platform}"
-          kube::golang::build_binaries_for_platform ${platform}
+          kube::golang::build_binaries_for_platform "${platform}"
         )
       done
     fi