diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index 8e45a20b68d..0daefe63c0b 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -16,10 +16,7 @@
 ./cluster/pre-existing/util.sh
 ./cluster/test-e2e.sh
 ./cluster/validate-cluster.sh
-./hack/lib/init.sh
-./hack/lib/swagger.sh
 ./hack/lib/test.sh
-./hack/lib/version.sh
 ./hack/test-integration.sh
 ./hack/verify-test-featuregates.sh
 ./test/cmd/diff.sh
diff --git a/hack/lib/init.sh b/hack/lib/init.sh
index 42f34567db9..46b69836efa 100755
--- a/hack/lib/init.sh
+++ b/hack/lib/init.sh
@@ -29,7 +29,7 @@ unset CDPATH
 export GO111MODULE=auto
 
 # The root of the build/dist directory
-KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE}")/../.." && pwd -P)"
+KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)"
 
 KUBE_OUTPUT_SUBPATH="${KUBE_OUTPUT_SUBPATH:-_output/local}"
 KUBE_OUTPUT="${KUBE_ROOT}/${KUBE_OUTPUT_SUBPATH}"
@@ -44,7 +44,7 @@ KUBE_RSYNC_COMPRESS="${KUBE_RSYNC_COMPRESS:-0}"
 export no_proxy=127.0.0.1,localhost
 
 # This is a symlink to binaries for "this platform", e.g. build tools.
-THIS_PLATFORM_BIN="${KUBE_ROOT}/_output/bin"
+export THIS_PLATFORM_BIN="${KUBE_ROOT}/_output/bin"
 
 source "${KUBE_ROOT}/hack/lib/util.sh"
 source "${KUBE_ROOT}/hack/lib/logging.sh"
@@ -56,6 +56,7 @@ source "${KUBE_ROOT}/hack/lib/golang.sh"
 source "${KUBE_ROOT}/hack/lib/etcd.sh"
 
 KUBE_OUTPUT_HOSTBIN="${KUBE_OUTPUT_BINPATH}/$(kube::util::host_platform)"
+export KUBE_OUTPUT_HOSTBIN
 
 # list of all available group versions.  This should be used when generated code
 # or when starting an API server that you want to have everything.
@@ -110,6 +111,7 @@ KUBE_NONSERVER_GROUP_VERSIONS="
  imagepolicy.k8s.io/v1alpha1\
  admission.k8s.io/v1beta1\
 "
+export KUBE_NONSERVER_GROUP_VERSIONS
 
 # This emulates "readlink -f" which is not available on MacOS X.
 # Test:
diff --git a/hack/lib/swagger.sh b/hack/lib/swagger.sh
index 6865ad35b48..f8c4ba33ccb 100644
--- a/hack/lib/swagger.sh
+++ b/hack/lib/swagger.sh
@@ -20,9 +20,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-# The root of the build/dist directory
-KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE}")/../.." && pwd -P)"
-
 # Generates types_swagger_doc_generated file for the given group version.
 # $1: Name of the group version
 # $2: Path to the directory where types.go for that group version exists. This
@@ -30,13 +27,15 @@ KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE}")/../.." && pwd -P)"
 kube::swagger::gen_types_swagger_doc() {
   local group_version=$1
   local gv_dir=$2
-  local TMPFILE="${TMPDIR:-/tmp}/types_swagger_doc_generated.$(date +%s).go"
+  local TMPFILE
+  TMPFILE="${TMPDIR:-/tmp}/types_swagger_doc_generated.$(date +%s).go"
 
   echo "Generating swagger type docs for ${group_version} at ${gv_dir}"
 
-  echo -e "$(cat hack/boilerplate/boilerplate.generatego.txt)\n" > "${TMPFILE}"
-  echo "package ${group_version##*/}" >> "${TMPFILE}"
-  cat >> "${TMPFILE}" <<EOF
+  {
+    echo -e "$(cat hack/boilerplate/boilerplate.generatego.txt)\n"
+    echo "package ${group_version##*/}"
+    cat <<EOF
 
 // This file contains a collection of methods that can be used from go-restful to
 // generate Swagger API documentation for its models. Please read this PR for more
@@ -50,6 +49,7 @@ kube::swagger::gen_types_swagger_doc() {
 
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 EOF
+  } > "${TMPFILE}"
 
   go run cmd/genswaggertypedocs/swagger_type_docs.go -s \
     "${gv_dir}/types.go" \
@@ -59,5 +59,5 @@ EOF
   echo "// AUTO-GENERATED FUNCTIONS END HERE" >> "${TMPFILE}"
 
   gofmt -w -s "${TMPFILE}"
-  mv "${TMPFILE}" ""${gv_dir}"/types_swagger_doc_generated.go"
+  mv "${TMPFILE}" "${gv_dir}/types_swagger_doc_generated.go"
 }
diff --git a/hack/lib/version.sh b/hack/lib/version.sh
index 1b7665b467a..b8890c9255e 100644
--- a/hack/lib/version.sh
+++ b/hack/lib/version.sh
@@ -39,6 +39,9 @@ kube::version::get_version_vars() {
 
   # If the kubernetes source was exported through git archive, then
   # we likely don't have a git tree, but these magic values may be filled in.
+  # shellcheck disable=SC2016,SC2050
+  # Disabled as we're not expanding these at runtime, but rather expecting
+  # that another tool may have expanded these and rewritten the source (!)
   if [[ '$Format:%%$' == "%" ]]; then
     KUBE_GIT_COMMIT='$Format:%H$'
     KUBE_GIT_TREE_STATE="archive"
@@ -70,11 +73,17 @@ kube::version::get_version_vars() {
       #
       # TODO: We continue calling this "git version" because so many
       # downstream consumers are expecting it there.
+      #
+      # These regexes are painful enough in sed...
+      # We don't want to do them in pure shell, so disable SC2001
+      # shellcheck disable=SC2001
       DASHES_IN_VERSION=$(echo "${KUBE_GIT_VERSION}" | sed "s/[^-]//g")
       if [[ "${DASHES_IN_VERSION}" == "---" ]] ; then
+        # shellcheck disable=SC2001
         # We have distance to subversion (v1.1.0-subversion-1-gCommitHash)
         KUBE_GIT_VERSION=$(echo "${KUBE_GIT_VERSION}" | sed "s/-\([0-9]\{1,\}\)-g\([0-9a-f]\{14\}\)$/.\1\+\2/")
       elif [[ "${DASHES_IN_VERSION}" == "--" ]] ; then
+        # shellcheck disable=SC2001
         # We have distance to base tag (v1.1.0-1-gCommitHash)
         KUBE_GIT_VERSION=$(echo "${KUBE_GIT_VERSION}" | sed "s/-g\([0-9a-f]\{14\}\)$/+\1/")
       fi
@@ -135,16 +144,6 @@ kube::version::load_version_vars() {
   source "${version_file}"
 }
 
-kube::version::ldflag() {
-  local key=${1}
-  local val=${2}
-
-  # If you update these, also update the list pkg/version/def.bzl.
-  echo "-X '${KUBE_GO_PACKAGE}/pkg/version.${key}=${val}'"
-  echo "-X '${KUBE_GO_PACKAGE}/vendor/k8s.io/client-go/pkg/version.${key}=${val}'"
-  echo "-X '${KUBE_GO_PACKAGE}/pkg/kubectl/version.${key}=${val}'"
-}
-
 # Prints the value that needs to be passed to the -ldflags parameter of go build
 # in order to set the Kubernetes based on the git tree status.
 # IMPORTANT: if you update any of these, also update the lists in
@@ -152,23 +151,31 @@ kube::version::ldflag() {
 kube::version::ldflags() {
   kube::version::get_version_vars
 
-  local buildDate=
-  [[ -z ${SOURCE_DATE_EPOCH-} ]] || buildDate="--date=@${SOURCE_DATE_EPOCH}"
-  local -a ldflags=($(kube::version::ldflag "buildDate" "$(date ${buildDate} -u +'%Y-%m-%dT%H:%M:%SZ')"))
+  local -a ldflags
+  function add_ldflag() {
+    local key=${1}
+    local val=${2}
+    # If you update these, also update the list pkg/version/def.bzl.
+    ldflags+=(
+      "-X '${KUBE_GO_PACKAGE}/pkg/version.${key}=${val}'"
+      "-X '${KUBE_GO_PACKAGE}/vendor/k8s.io/client-go/pkg/version.${key}=${val}'"
+      "-X '${KUBE_GO_PACKAGE}/pkg/kubectl/version.${key}=${val}'"
+    )
+  }
+
+  add_ldflag "buildDate" "$(date ${SOURCE_DATE_EPOCH:+"--date=@${SOURCE_DATE_EPOCH}"} -u +'%Y-%m-%dT%H:%M:%SZ')"
   if [[ -n ${KUBE_GIT_COMMIT-} ]]; then
-    ldflags+=($(kube::version::ldflag "gitCommit" "${KUBE_GIT_COMMIT}"))
-    ldflags+=($(kube::version::ldflag "gitTreeState" "${KUBE_GIT_TREE_STATE}"))
+    add_ldflag "gitCommit" "${KUBE_GIT_COMMIT}"
+    add_ldflag "gitTreeState" "${KUBE_GIT_TREE_STATE}"
   fi
 
   if [[ -n ${KUBE_GIT_VERSION-} ]]; then
-    ldflags+=($(kube::version::ldflag "gitVersion" "${KUBE_GIT_VERSION}"))
+    add_ldflag "gitVersion" "${KUBE_GIT_VERSION}"
   fi
 
   if [[ -n ${KUBE_GIT_MAJOR-} && -n ${KUBE_GIT_MINOR-} ]]; then
-    ldflags+=(
-      $(kube::version::ldflag "gitMajor" "${KUBE_GIT_MAJOR}")
-      $(kube::version::ldflag "gitMinor" "${KUBE_GIT_MINOR}")
-    )
+    add_ldflag "gitMajor" "${KUBE_GIT_MAJOR}"
+    add_ldflag "gitMinor" "${KUBE_GIT_MINOR}"
   fi
 
   # The -ldflags parameter takes a single string, so join the output.