diff --git a/templates/test/cpp/naming/create_private_dns_zone_defs.include b/templates/test/cpp/naming/create_private_dns_zone_defs.include
index 465dd6394bf..76af9ab33db 100644
--- a/templates/test/cpp/naming/create_private_dns_zone_defs.include
+++ b/templates/test/cpp/naming/create_private_dns_zone_defs.include
@@ -17,7 +17,7 @@
 
 set -ex
 
-cd $(dirname $0)/../../..
+cd "$(dirname "$0")/../../.."
 
 gcloud alpha dns managed-zones create \\
 
diff --git a/templates/test/cpp/naming/private_dns_zone_init_defs.include b/templates/test/cpp/naming/private_dns_zone_init_defs.include
index 06bc8adb94e..1a6a590ac5e 100644
--- a/templates/test/cpp/naming/private_dns_zone_init_defs.include
+++ b/templates/test/cpp/naming/private_dns_zone_init_defs.include
@@ -17,7 +17,7 @@
 
 set -ex
 
-cd $(dirname $0)/../../..
+cd "$(dirname "$0")/../../.."
 
 gcloud dns record-sets transaction start -z=${resolver_gce_integration_tests_zone_id}
 
diff --git a/templates/test/cpp/naming/resolver_component_tests_defs.include b/templates/test/cpp/naming/resolver_component_tests_defs.include
index 6fa91c741ad..efa54a456b1 100644
--- a/templates/test/cpp/naming/resolver_component_tests_defs.include
+++ b/templates/test/cpp/naming/resolver_component_tests_defs.include
@@ -18,10 +18,10 @@
 set -ex
 
 # all command args required in this set order
-FLAGS_test_bin_path=`echo "$1" | grep '\--test_bin_path=' | cut -d "=" -f 2`
-FLAGS_dns_server_bin_path=`echo "$2" | grep '\--dns_server_bin_path=' | cut -d "=" -f 2`
-FLAGS_records_config_path=`echo "$3" | grep '\--records_config_path=' | cut -d "=" -f 2`
-FLAGS_test_dns_server_port=`echo "$4" | grep '\--test_dns_server_port=' | cut -d "=" -f 2`
+FLAGS_test_bin_path=$(echo "$1" | grep '\--test_bin_path=' | cut -d "=" -f 2)
+FLAGS_dns_server_bin_path=$(echo "$2" | grep '\--dns_server_bin_path=' | cut -d "=" -f 2)
+FLAGS_records_config_path=$(echo "$3" | grep '\--records_config_path=' | cut -d "=" -f 2)
+FLAGS_test_dns_server_port=$(echo "$4" | grep '\--test_dns_server_port=' | cut -d "=" -f 2)
 
 for cmd_arg in "$FLAGS_test_bin_path" "$FLAGS_dns_server_bin_path" "$FLAGS_records_config_path" "$FLAGS_test_dns_server_port"; do
   if [[ "$cmd_arg" == "" ]]; then
@@ -34,7 +34,7 @@ if [[ "$GRPC_DNS_RESOLVER" != "" && "$GRPC_DNS_RESOLVER" != ares ]]; then
 fi
 export GRPC_DNS_RESOLVER=ares
 
-"$FLAGS_dns_server_bin_path" --records_config_path="$FLAGS_records_config_path" --port="$FLAGS_test_dns_server_port" 2>&1 > /dev/null &
+"$FLAGS_dns_server_bin_path" --records_config_path="$FLAGS_records_config_path" --port="$FLAGS_test_dns_server_port" > /dev/null 2>&1 &
 DNS_SERVER_PID=$!
 echo "Local DNS server started. PID: $DNS_SERVER_PID"
 
@@ -53,15 +53,15 @@ done
 
 if [[ $RETRY == 1 ]]; then
   echo "FAILED TO START LOCAL DNS SERVER"
-  kill -SIGTERM $DNS_SERVER_PID
+  kill -SIGTERM "$DNS_SERVER_PID"
   wait
   exit 1
 fi
 
 function terminate_all {
   echo "Received signal. Terminating $! and $DNS_SERVER_PID"
-  kill -SIGTERM $! || true
-  kill -SIGTERM $DNS_SERVER_PID || true
+  kill -SIGTERM "$!" || true
+  kill -SIGTERM "$DNS_SERVER_PID" || true
   wait
   exit 1
 }
@@ -83,10 +83,10 @@ $FLAGS_test_bin_path \\
 
   --expected_lb_policy='${test['expected_lb_policy']}' \\
 
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 % endfor
-kill -SIGTERM $DNS_SERVER_PID || true
+kill -SIGTERM "$DNS_SERVER_PID" || true
 wait
 exit $EXIT_CODE</%def>
diff --git a/templates/test/cpp/naming/resolver_gce_integration_tests_defs.include b/templates/test/cpp/naming/resolver_gce_integration_tests_defs.include
index 2413ec57d09..0cb8a1baf31 100644
--- a/templates/test/cpp/naming/resolver_gce_integration_tests_defs.include
+++ b/templates/test/cpp/naming/resolver_gce_integration_tests_defs.include
@@ -24,7 +24,7 @@ elif [[ "$GRPC_DNS_RESOLVER" != ares ]]; then
   exit 1
 fi
 
-cd $(dirname $0)/../../..
+cd "$(dirname "$0")/../../.."
 
 if [[ "$CONFIG" == "" ]]; then
   export CONFIG=opt
diff --git a/templates/tools/openssl/use_openssl.sh.template b/templates/tools/openssl/use_openssl.sh.template
index 80508169821..b07ce132052 100644
--- a/templates/tools/openssl/use_openssl.sh.template
+++ b/templates/tools/openssl/use_openssl.sh.template
@@ -18,7 +18,7 @@
 
   set -ex
 
-  cd $(dirname $0)/../..
+  cd "$(dirname "$0")/../.."
   set root=`pwd`
   CC=${"${CC:-cc}"}
 
diff --git a/test/core/end2end/end2end_test.sh b/test/core/end2end/end2end_test.sh
index 3b18ae30aff..b1b9a65a1bf 100755
--- a/test/core/end2end/end2end_test.sh
+++ b/test/core/end2end/end2end_test.sh
@@ -15,4 +15,4 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-$1 $2
+"$1" "$2"
diff --git a/test/core/util/fuzzer_one_entry_runner.sh b/test/core/util/fuzzer_one_entry_runner.sh
index 2634a1b3a9e..7c471afcc22 100755
--- a/test/core/util/fuzzer_one_entry_runner.sh
+++ b/test/core/util/fuzzer_one_entry_runner.sh
@@ -15,4 +15,4 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-$1 $2
+"$1" "$2"
diff --git a/test/core/util/run_with_poller.sh b/test/core/util/run_with_poller.sh
index 05791457a2c..382a63e8ae6 100755
--- a/test/core/util/run_with_poller.sh
+++ b/test/core/util/run_with_poller.sh
@@ -16,4 +16,4 @@
 set -ex
 export GRPC_POLL_STRATEGY=$1
 shift
-$@
+"$@"
diff --git a/test/cpp/naming/create_private_dns_zone.sh b/test/cpp/naming/create_private_dns_zone.sh
index 55a4cfe36e5..5c9364ca1a9 100755
--- a/test/cpp/naming/create_private_dns_zone.sh
+++ b/test/cpp/naming/create_private_dns_zone.sh
@@ -17,7 +17,7 @@
 
 set -ex
 
-cd $(dirname $0)/../../..
+cd "$(dirname "$0")/../../.."
 
 gcloud alpha dns managed-zones create \
   resolver-tests-version-4-grpctestingexp-zone-id \
diff --git a/test/cpp/naming/private_dns_zone_init.sh b/test/cpp/naming/private_dns_zone_init.sh
index 8fa5a8a4755..fba8a005cc9 100755
--- a/test/cpp/naming/private_dns_zone_init.sh
+++ b/test/cpp/naming/private_dns_zone_init.sh
@@ -17,7 +17,7 @@
 
 set -ex
 
-cd $(dirname $0)/../../..
+cd "$(dirname "$0")/../../.."
 
 gcloud dns record-sets transaction start -z=resolver-tests-version-4-grpctestingexp-zone-id
 
diff --git a/test/cpp/naming/resolver_component_tests_runner.sh b/test/cpp/naming/resolver_component_tests_runner.sh
index 11a45d72ce5..618a173dc00 100755
--- a/test/cpp/naming/resolver_component_tests_runner.sh
+++ b/test/cpp/naming/resolver_component_tests_runner.sh
@@ -18,10 +18,10 @@
 set -ex
 
 # all command args required in this set order
-FLAGS_test_bin_path=`echo "$1" | grep '\--test_bin_path=' | cut -d "=" -f 2`
-FLAGS_dns_server_bin_path=`echo "$2" | grep '\--dns_server_bin_path=' | cut -d "=" -f 2`
-FLAGS_records_config_path=`echo "$3" | grep '\--records_config_path=' | cut -d "=" -f 2`
-FLAGS_test_dns_server_port=`echo "$4" | grep '\--test_dns_server_port=' | cut -d "=" -f 2`
+FLAGS_test_bin_path=$(echo "$1" | grep '\--test_bin_path=' | cut -d "=" -f 2)
+FLAGS_dns_server_bin_path=$(echo "$2" | grep '\--dns_server_bin_path=' | cut -d "=" -f 2)
+FLAGS_records_config_path=$(echo "$3" | grep '\--records_config_path=' | cut -d "=" -f 2)
+FLAGS_test_dns_server_port=$(echo "$4" | grep '\--test_dns_server_port=' | cut -d "=" -f 2)
 
 for cmd_arg in "$FLAGS_test_bin_path" "$FLAGS_dns_server_bin_path" "$FLAGS_records_config_path" "$FLAGS_test_dns_server_port"; do
   if [[ "$cmd_arg" == "" ]]; then
@@ -34,7 +34,7 @@ if [[ "$GRPC_DNS_RESOLVER" != "" && "$GRPC_DNS_RESOLVER" != ares ]]; then
 fi
 export GRPC_DNS_RESOLVER=ares
 
-"$FLAGS_dns_server_bin_path" --records_config_path="$FLAGS_records_config_path" --port="$FLAGS_test_dns_server_port" 2>&1 > /dev/null &
+"$FLAGS_dns_server_bin_path" --records_config_path="$FLAGS_records_config_path" --port="$FLAGS_test_dns_server_port" > /dev/null 2>&1 &
 DNS_SERVER_PID=$!
 echo "Local DNS server started. PID: $DNS_SERVER_PID"
 
@@ -53,15 +53,15 @@ done
 
 if [[ $RETRY == 1 ]]; then
   echo "FAILED TO START LOCAL DNS SERVER"
-  kill -SIGTERM $DNS_SERVER_PID
+  kill -SIGTERM "$DNS_SERVER_PID"
   wait
   exit 1
 fi
 
 function terminate_all {
   echo "Received signal. Terminating $! and $DNS_SERVER_PID"
-  kill -SIGTERM $! || true
-  kill -SIGTERM $DNS_SERVER_PID || true
+  kill -SIGTERM "$!" || true
+  kill -SIGTERM "$DNS_SERVER_PID" || true
   wait
   exit 1
 }
@@ -77,105 +77,105 @@ $FLAGS_test_bin_path \
   --expected_addrs='1.2.3.4:1234,True' \
   --expected_chosen_service_config='' \
   --expected_lb_policy='' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='srv-ipv4-multi-target.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='1.2.3.5:1234,True;1.2.3.6:1234,True;1.2.3.7:1234,True' \
   --expected_chosen_service_config='' \
   --expected_lb_policy='' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='srv-ipv6-single-target.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='[2607:f8b0:400a:801::1001]:1234,True' \
   --expected_chosen_service_config='' \
   --expected_lb_policy='' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='srv-ipv6-multi-target.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='[2607:f8b0:400a:801::1002]:1234,True;[2607:f8b0:400a:801::1003]:1234,True;[2607:f8b0:400a:801::1004]:1234,True' \
   --expected_chosen_service_config='' \
   --expected_lb_policy='' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='srv-ipv4-simple-service-config.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='1.2.3.4:1234,True' \
   --expected_chosen_service_config='{"loadBalancingPolicy":"round_robin","methodConfig":[{"name":[{"method":"Foo","service":"SimpleService","waitForReady":true}]}]}' \
   --expected_lb_policy='round_robin' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='ipv4-no-srv-simple-service-config.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='1.2.3.4:443,False' \
   --expected_chosen_service_config='{"loadBalancingPolicy":"round_robin","methodConfig":[{"name":[{"method":"Foo","service":"NoSrvSimpleService","waitForReady":true}]}]}' \
   --expected_lb_policy='round_robin' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='ipv4-no-config-for-cpp.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='1.2.3.4:443,False' \
   --expected_chosen_service_config='' \
   --expected_lb_policy='' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='ipv4-cpp-config-has-zero-percentage.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='1.2.3.4:443,False' \
   --expected_chosen_service_config='' \
   --expected_lb_policy='' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='ipv4-second-language-is-cpp.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='1.2.3.4:443,False' \
   --expected_chosen_service_config='{"loadBalancingPolicy":"round_robin","methodConfig":[{"name":[{"method":"Foo","service":"CppService","waitForReady":true}]}]}' \
   --expected_lb_policy='round_robin' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='ipv4-config-with-percentages.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='1.2.3.4:443,False' \
   --expected_chosen_service_config='{"loadBalancingPolicy":"round_robin","methodConfig":[{"name":[{"method":"Foo","service":"AlwaysPickedService","waitForReady":true}]}]}' \
   --expected_lb_policy='round_robin' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='srv-ipv4-target-has-backend-and-balancer.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='1.2.3.4:1234,True;1.2.3.4:443,False' \
   --expected_chosen_service_config='' \
   --expected_lb_policy='' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='srv-ipv6-target-has-backend-and-balancer.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='[2607:f8b0:400a:801::1002]:1234,True;[2607:f8b0:400a:801::1002]:443,False' \
   --expected_chosen_service_config='' \
   --expected_lb_policy='' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
 $FLAGS_test_bin_path \
   --target_name='ipv4-config-causing-fallback-to-tcp.resolver-tests-version-4.grpctestingexp.' \
   --expected_addrs='1.2.3.4:443,False' \
   --expected_chosen_service_config='{"loadBalancingPolicy":"round_robin","methodConfig":[{"name":[{"method":"Foo","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooTwo","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooThree","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooFour","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooFive","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooSix","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooSeven","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooEight","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooNine","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooTen","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooEleven","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooTwelve","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooTwelve","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooTwelve","service":"SimpleService","waitForReady":true}]},{"name":[{"method":"FooTwelve","service":"SimpleService","waitForReady":true}]}]}' \
   --expected_lb_policy='' \
-  --local_dns_server_address=127.0.0.1:$FLAGS_test_dns_server_port &
-wait $! || EXIT_CODE=1
+  --local_dns_server_address="127.0.0.1:$FLAGS_test_dns_server_port" &
+wait "$!" || EXIT_CODE=1
 
-kill -SIGTERM $DNS_SERVER_PID || true
+kill -SIGTERM "$DNS_SERVER_PID" || true
 wait
 exit $EXIT_CODE
diff --git a/test/cpp/naming/resolver_gce_integration_tests_runner.sh b/test/cpp/naming/resolver_gce_integration_tests_runner.sh
index 091f9efbbde..2f673a59fd1 100755
--- a/test/cpp/naming/resolver_gce_integration_tests_runner.sh
+++ b/test/cpp/naming/resolver_gce_integration_tests_runner.sh
@@ -24,7 +24,7 @@ elif [[ "$GRPC_DNS_RESOLVER" != ares ]]; then
   exit 1
 fi
 
-cd $(dirname $0)/../../..
+cd "$(dirname "$0")/../../.."
 
 if [[ "$CONFIG" == "" ]]; then
   export CONFIG=opt
diff --git a/test/distrib/cpp/run_distrib_test_cmake.sh b/test/distrib/cpp/run_distrib_test_cmake.sh
index a9c081c2f5d..6ec3cab6024 100755
--- a/test/distrib/cpp/run_distrib_test_cmake.sh
+++ b/test/distrib/cpp/run_distrib_test_cmake.sh
@@ -15,7 +15,7 @@
 
 set -ex
 
-cd $(dirname $0)/../../..
+cd "$(dirname "$0")/../../.."
 
 echo "deb http://ftp.debian.org/debian jessie-backports main" | tee /etc/apt/sources.list.d/jessie-backports.list
 apt-get update
diff --git a/test/distrib/cpp/run_distrib_test_routeguide.sh b/test/distrib/cpp/run_distrib_test_routeguide.sh
index b043075d93a..dc69ab83773 100755
--- a/test/distrib/cpp/run_distrib_test_routeguide.sh
+++ b/test/distrib/cpp/run_distrib_test_routeguide.sh
@@ -16,7 +16,7 @@
 set -ex
 
 # change to grpc repo root
-cd $(dirname $0)/../../..
+cd "$(dirname "$0")/../../.."
 
 cd third_party/protobuf && ./autogen.sh && \
 ./configure && make -j4 && make check && make install && ldconfig
diff --git a/test/distrib/csharp/run_distrib_test.sh b/test/distrib/csharp/run_distrib_test.sh
index 99cdb5e022e..eee24d0e57f 100755
--- a/test/distrib/csharp/run_distrib_test.sh
+++ b/test/distrib/csharp/run_distrib_test.sh
@@ -15,7 +15,7 @@
 
 set -ex
 
-cd $(dirname $0)
+cd "$(dirname "$0")"
 
 unzip -o "$EXTERNAL_GIT_ROOT/input_artifacts/csharp_nugets_windows_dotnetcli.zip" -d TestNugetFeed
 
diff --git a/test/distrib/csharp/run_distrib_test_dotnetcli.sh b/test/distrib/csharp/run_distrib_test_dotnetcli.sh
index 53117d48284..9e31945dfb9 100755
--- a/test/distrib/csharp/run_distrib_test_dotnetcli.sh
+++ b/test/distrib/csharp/run_distrib_test_dotnetcli.sh
@@ -15,7 +15,7 @@
 
 set -ex
 
-cd $(dirname $0)
+cd "$(dirname "$0")"
 
 unzip -o "$EXTERNAL_GIT_ROOT/input_artifacts/csharp_nugets_windows_dotnetcli.zip" -d TestNugetFeed
 
diff --git a/test/distrib/csharp/update_version.sh b/test/distrib/csharp/update_version.sh
index 2e9050cb983..734ec21ba24 100755
--- a/test/distrib/csharp/update_version.sh
+++ b/test/distrib/csharp/update_version.sh
@@ -15,12 +15,14 @@
 
 set -e
 
-cd $(dirname $0)
+cd "$(dirname "$0")"
 
 CSHARP_VERSION="$1"
 if [ "$CSHARP_VERSION" == "auto" ]
 then
   # autodetect C# version from the name of Grpc.Core.0.0.0-x.nupkg file
+  # TODO: find a better shellcheck-compliant way to write the following line
+  # shellcheck disable=SC2010
   CSHARP_VERSION=$(ls TestNugetFeed | grep -m 1 '^Grpc\.Core\.[0-9].*\.nupkg$' | sed s/^Grpc\.Core\.// | sed s/\.nupkg$// | sed s/\.symbols$//)
   echo "Autodetected nuget ${CSHARP_VERSION}"
 fi
diff --git a/test/distrib/php/run_distrib_test.sh b/test/distrib/php/run_distrib_test.sh
index 70ebaf88b99..f7818158400 100755
--- a/test/distrib/php/run_distrib_test.sh
+++ b/test/distrib/php/run_distrib_test.sh
@@ -15,9 +15,9 @@
 
 set -ex
 
-cd $(dirname $0)
+cd "$(dirname "$0")"
 
-cp -r $EXTERNAL_GIT_ROOT/input_artifacts/grpc-*.tgz .
+cp -r "$EXTERNAL_GIT_ROOT"/input_artifacts/grpc-*.tgz .
 
 find . -regextype sed -regex ".*/grpc-[0-9].*.tgz" | cut -b3- | \
     xargs pecl install
diff --git a/test/distrib/python/run_distrib_test.sh b/test/distrib/python/run_distrib_test.sh
index 02654be467a..a855ae3b61e 100755
--- a/test/distrib/python/run_distrib_test.sh
+++ b/test/distrib/python/run_distrib_test.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2015 gRPC authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,23 +15,25 @@
 
 set -ex
 
-cd $(dirname $0)
+cd "$(dirname "$0")"
+
+shopt -s nullglob
 
 # Pick up the source dist archive whatever its version is
-SDIST_ARCHIVES=$EXTERNAL_GIT_ROOT/input_artifacts/grpcio-*.tar.gz
-BDIST_ARCHIVES=$EXTERNAL_GIT_ROOT/input_artifacts/grpcio-*.whl
-TOOLS_SDIST_ARCHIVES=$EXTERNAL_GIT_ROOT/input_artifacts/grpcio_tools-*.tar.gz
-TOOLS_BDIST_ARCHIVES=$EXTERNAL_GIT_ROOT/input_artifacts/grpcio_tools-*.whl
+SDIST_ARCHIVES=("$EXTERNAL_GIT_ROOT"/input_artifacts/grpcio-*.tar.gz)
+BDIST_ARCHIVES=("$EXTERNAL_GIT_ROOT"/input_artifacts/grpcio-*.whl)
+TOOLS_SDIST_ARCHIVES=("$EXTERNAL_GIT_ROOT"/input_artifacts/grpcio_tools-*.tar.gz)
+TOOLS_BDIST_ARCHIVES=("$EXTERNAL_GIT_ROOT"/input_artifacts/grpcio_tools-*.whl)
 
 function make_virtualenv() {
-  virtualenv $1
-  $1/bin/python -m pip install --upgrade six pip
-  $1/bin/python -m pip install cython
+  virtualenv "$1"
+  "$1/bin/python" -m pip install --upgrade six pip
+  "$1/bin/python" -m pip install cython
 }
 
 function at_least_one_installs() {
   for file in "$@"; do
-    if python -m pip install $file; then
+    if python -m pip install "$file"; then
       return 0
     fi
   done
@@ -45,11 +47,11 @@ make_virtualenv sdist_test
 # Install our distributions in order of dependencies
 #
 
-(source bdist_test/bin/activate && at_least_one_installs ${BDIST_ARCHIVES})
-(source bdist_test/bin/activate && at_least_one_installs ${TOOLS_BDIST_ARCHIVES})
+(source bdist_test/bin/activate && at_least_one_installs "${BDIST_ARCHIVES[@]}")
+(source bdist_test/bin/activate && at_least_one_installs "${TOOLS_BDIST_ARCHIVES[@]}")
 
-(source sdist_test/bin/activate && at_least_one_installs ${SDIST_ARCHIVES})
-(source sdist_test/bin/activate && at_least_one_installs ${TOOLS_SDIST_ARCHIVES})
+(source sdist_test/bin/activate && at_least_one_installs "${SDIST_ARCHIVES[@]}")
+(source sdist_test/bin/activate && at_least_one_installs "${TOOLS_SDIST_ARCHIVES[@]}")
 
 #
 # Test our distributions
diff --git a/test/distrib/ruby/run_distrib_test.sh b/test/distrib/ruby/run_distrib_test.sh
index d74f4cd76db..99fb873589c 100755
--- a/test/distrib/ruby/run_distrib_test.sh
+++ b/test/distrib/ruby/run_distrib_test.sh
@@ -15,20 +15,22 @@
 
 set -ex
 
-cd $(dirname $0)
+cd "$(dirname "$0")"
 
 ARCH=$1
 PLATFORM=$2
 # Create an indexed local gem source with gRPC gems to test
 GEM_SOURCE=../../../gem_source
-mkdir -p ${GEM_SOURCE}/gems
-cp $EXTERNAL_GIT_ROOT/input_artifacts/grpc-*$ARCH-$PLATFORM.gem ${GEM_SOURCE}/gems
-if [[ "$(ls ${GEM_SOURCE}/gems | grep grpc | wc -l)" != 1 ]]; then
+mkdir -p "${GEM_SOURCE}/gems"
+cp "$EXTERNAL_GIT_ROOT"/input_artifacts/grpc-*"$ARCH-$PLATFORM".gem "${GEM_SOURCE}/gems"
+# TODO: rewrite the following line to be shellcheck-compliant
+# shellcheck disable=SC2010
+if [[ "$(ls "${GEM_SOURCE}/gems" | grep -c grpc)" != 1 ]]; then
   echo "Sanity check failed. Copied over more than one grpc gem into the gem source directory."
   exit 1
 fi;
 gem install builder
-gem generate_index --directory ${GEM_SOURCE}
+gem generate_index --directory "${GEM_SOURCE}"
 
 bundle install
 
diff --git a/tools/distrib/python_wrapper.sh b/tools/distrib/python_wrapper.sh
index 9ace915db9b..a099b2f11ae 100755
--- a/tools/distrib/python_wrapper.sh
+++ b/tools/distrib/python_wrapper.sh
@@ -16,7 +16,7 @@
 
 for p in python2.7 python2.6 python2 python not_found ; do 
 
-  python=`which $p || echo not_found`
+  python=$(which $p || echo not_found)
 
   if [ -x "$python" ] ; then
     break
@@ -25,7 +25,7 @@ for p in python2.7 python2.6 python2 python not_found ; do
 done
 
 if [ -x "$python" ] ; then
-  exec $python $@
+  exec "$python" "$@"
 else
   echo "No acceptable version of python found on the system"
   exit 1
diff --git a/tools/openssl/use_openssl.sh b/tools/openssl/use_openssl.sh
index a97a54b7c86..dea16ca6ee9 100755
--- a/tools/openssl/use_openssl.sh
+++ b/tools/openssl/use_openssl.sh
@@ -16,7 +16,7 @@
 
 set -ex
 
-cd $(dirname $0)/../..
+cd "$(dirname "$0")/../.."
 set root=`pwd`
 CC=${CC:-cc}
 
diff --git a/tools/run_tests/sanity/check_shellcheck.sh b/tools/run_tests/sanity/check_shellcheck.sh
index 64f59cb40e9..6e60ea2fee2 100755
--- a/tools/run_tests/sanity/check_shellcheck.sh
+++ b/tools/run_tests/sanity/check_shellcheck.sh
@@ -19,6 +19,7 @@ set -e
 ROOT="$(dirname "$0")/../../.."
 
 DIRS=(
+    'test'
     'tools/run_tests'
 )