diff --git a/contrib/depdot.sh b/contrib/depdot.sh
index c065ea57..4e0a9406 100755
--- a/contrib/depdot.sh
+++ b/contrib/depdot.sh
@@ -5,8 +5,7 @@
 #  * Works only if directory names and package names are the same (true for all Gluon packages)
 #  * Doesn't show dependencies through virtual packages correctly
 
-
-
+set -e
 shopt -s nullglob
 
 
diff --git a/contrib/lsupgrade.sh b/contrib/lsupgrade.sh
index eca7a852..f8e28f9a 100755
--- a/contrib/lsupgrade.sh
+++ b/contrib/lsupgrade.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 
+set -e
 # Script to list all upgrade scripts in a clear manner
 # Limitations:
 #  * Does only show scripts of packages whose `files'/`luasrc' directories represent the whole image filesystem (which are all Gluon packages)
@@ -27,7 +28,7 @@ fi
 
 pushd "$(dirname "$0")/.." >/dev/null
 
-find ./package packages -name Makefile | while read makefile; do
+find ./package packages -name Makefile | while read -r makefile; do
 	dir="$(dirname "$makefile")"
 
 	pushd "$dir" >/dev/null
diff --git a/contrib/sign.sh b/contrib/sign.sh
index c04854e8..d88bc345 100755
--- a/contrib/sign.sh
+++ b/contrib/sign.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-if [ $# -ne 2 -o "-h" = "$1" -o "--help" = "$1" -o ! -r "$1" -o ! -r "$2" ]; then
+if [ $# -ne 2 ] || [ "-h" = "$1" ] || [ "--help" = "$1" ] || [ ! -r "$1" ] || [ ! -r "$2" ]; then
 	cat <<EOHELP
 Usage: $0 <secret> <manifest>
 
diff --git a/contrib/sigtest.sh b/contrib/sigtest.sh
index 2a0faf2c..0fa19f90 100755
--- a/contrib/sigtest.sh
+++ b/contrib/sigtest.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-if [ $# -eq 0 -o "-h" = "$1" -o "-help" = "$1" -o "--help" = "$1" ]; then
+if [ $# -eq 0 ] || [ "-h" = "$1" ] || [ "-help" = "$1" ] || [ "--help" = "$1" ]; then
     cat <<EOHELP
 Usage: $0 <public> <signed manifest>
 
@@ -27,7 +27,7 @@ awk "BEGIN    { sep=0 }
                 else       print > \"$lower\"}" \
     "$manifest"
 
-while read line
+while read -r line
 do
     if ecdsaverify -s "$line" -p "$public" "$upper"; then
         ret=0
diff --git a/package/gluon-core/files/lib/netifd/proto/gluon_wired.sh b/package/gluon-core/files/lib/netifd/proto/gluon_wired.sh
index 0778b354..708e9743 100755
--- a/package/gluon-core/files/lib/netifd/proto/gluon_wired.sh
+++ b/package/gluon-core/files/lib/netifd/proto/gluon_wired.sh
@@ -14,6 +14,7 @@ xor2() {
         echo -n "${1:1:1}" | tr '0123456789abcdef' '23016745ab89efcd'
 }
 
+# shellcheck disable=SC2086
 interface_linklocal() {
         local macaddr="$(ubus call network.device status '{"name": "'"$1"'"}' | jsonfilter -e '@.macaddr')"
         local oldIFS="$IFS"; IFS=':'; set -- $macaddr; IFS="$oldIFS"
diff --git a/package/gluon-setup-mode/files/etc/hotplug.d/button/50-gluon-setup-mode b/package/gluon-setup-mode/files/etc/hotplug.d/button/50-gluon-setup-mode
index 3a3cb20f..314f8a43 100755
--- a/package/gluon-setup-mode/files/etc/hotplug.d/button/50-gluon-setup-mode
+++ b/package/gluon-setup-mode/files/etc/hotplug.d/button/50-gluon-setup-mode
@@ -12,7 +12,7 @@ wait_setup_mode() {
 }
 
 
-if [ "$BUTTON" = wps -o "$BUTTON" = reset -o "$BUTTON" = phone ]; then
+if [ "$BUTTON" = wps ] || [ "$BUTTON" = reset ] || [ "$BUTTON" = phone ]; then
 	case "$ACTION" in
 		pressed)
 			wait_setup_mode &
@@ -21,7 +21,7 @@ if [ "$BUTTON" = wps -o "$BUTTON" = reset -o "$BUTTON" = phone ]; then
 			;;
 		released)
 			if [ -r /tmp/.wait_setup_mode ]; then
-				kill $(cat /tmp/.wait_setup_mode)
+				kill "$(cat /tmp/.wait_setup_mode)"
 				rm /tmp/.wait_setup_mode
 			fi
 			;;
diff --git a/package/gluon-setup-mode/files/lib/preinit/90_setup_mode b/package/gluon-setup-mode/files/lib/preinit/90_setup_mode
index 396b4f76..c38ac281 100644
--- a/package/gluon-setup-mode/files/lib/preinit/90_setup_mode
+++ b/package/gluon-setup-mode/files/lib/preinit/90_setup_mode
@@ -5,7 +5,7 @@ setup_mode_enable() {
 	local enabled="$(uci -q get 'gluon-setup-mode.@setup_mode[0].enabled')"
 	local configured="$(uci -q get 'gluon-setup-mode.@setup_mode[0].configured')"
 
-	if [ "$enabled" = 1 -o "$configured" != 1 ]; then
+	if [ "$enabled" = 1 ] || [ "$configured" != 1 ]; then
 		echo '/lib/gluon/setup-mode/rc.d' > /tmp/rc_d_path
 	fi
 }
diff --git a/scripts/features.sh b/scripts/features.sh
index 2d35fdee..1d7184ee 100755
--- a/scripts/features.sh
+++ b/scripts/features.sh
@@ -31,14 +31,14 @@ sanitize() {
 	echo -n "$v"
 }
 
-vars=
+vars=()
 
 for feature in $1; do
-	if [ "$(type -t gluon_feature_nodefault_${feature})" != 'function' ]; then
+	if [ "$(type -t "gluon_feature_nodefault_${feature}")" != 'function' ]; then
 		echo "gluon-${feature}"
 	fi
 
-	vars="$vars $(sanitize "$feature")=1"
+	vars+=("$(sanitize "$feature")=1")
 done
 
 
@@ -46,18 +46,19 @@ nodefault() {
 	:
 }
 
+# shellcheck disable=SC2086
 packages() {
 	local cond="$(sanitize "$1")"
 	shift
 
 	# We only allow variable names, parentheses and the operators: & | !
-	if [ "$(expr match "$cond" '.*[^A-Za-z0-9_()&|! ].*')" -gt 0 ]; then
+	if grep -q '[^A-Za-z0-9_()&|! ]' <<< "$cond"; then
 		exit 1
 	fi
 
 	# Let will return false when the result of the passed expression is 0,
 	# so we always add 1. This way false is only returned for syntax errors.
-	local ret="$(env -i $vars bash --norc -ec "let _result_='1+($cond)'; echo -n \"\$_result_\"" 2>/dev/null)"
+	local ret="$(env -i "${vars[@]}" bash --norc -ec "let _result_='1+($cond)'; echo -n \"\$_result_\"" 2>/dev/null)"
 	case "$ret" in
 	2)
 		for pkg in "$@"; do
diff --git a/scripts/filesize.sh b/scripts/filesize.sh
index 1a6ea4dd..7068eb54 100755
--- a/scripts/filesize.sh
+++ b/scripts/filesize.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 check_command() {
-	which "$1" >/dev/null 2>&1
+	command -v "$1" >/dev/null
 }
 
 if check_command gnustat; then
diff --git a/scripts/modules.sh b/scripts/modules.sh
index 4df7e580..78b819c3 100644
--- a/scripts/modules.sh
+++ b/scripts/modules.sh
@@ -1,6 +1,7 @@
 . ./modules
 [ ! -f "$GLUON_SITEDIR"/modules ] || . "$GLUON_SITEDIR"/modules
 
+# shellcheck disable=SC2086
 FEEDS="$(echo $GLUON_FEEDS $GLUON_SITE_FEEDS | tr ' ' '\n')"
 
 GLUON_MODULES=openwrt
diff --git a/scripts/patch.sh b/scripts/patch.sh
index 082ca1fc..9269ffb5 100755
--- a/scripts/patch.sh
+++ b/scripts/patch.sh
@@ -3,7 +3,7 @@
 set -e
 shopt -s nullglob
 
-[ "$GLUON_TMPDIR" -a "$GLUON_PATCHESDIR" ] || exit 1
+[ "$GLUON_TMPDIR" ] && [ "$GLUON_PATCHESDIR" ] || exit 1
 
 . scripts/modules.sh
 
diff --git a/scripts/sha256sum.sh b/scripts/sha256sum.sh
index e4f6f3e5..99d97acd 100755
--- a/scripts/sha256sum.sh
+++ b/scripts/sha256sum.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 check_command() {
-	which "$1" >/dev/null 2>&1
+	command -v "$1" >/dev/null 2>&1
 }
 
 if check_command sha256sum; then
diff --git a/scripts/sha512sum.sh b/scripts/sha512sum.sh
index d9fd544d..cb4b07e4 100755
--- a/scripts/sha512sum.sh
+++ b/scripts/sha512sum.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 check_command() {
-	which "$1" >/dev/null 2>&1
+	command -v "$1" >/dev/null 2>&1
 }
 
 if check_command sha512sum; then
diff --git a/scripts/update-patches.sh b/scripts/update-patches.sh
index 933d20ac..94f103fa 100755
--- a/scripts/update-patches.sh
+++ b/scripts/update-patches.sh
@@ -13,13 +13,13 @@ GLUONDIR="$(pwd)"
 for module in $GLUON_MODULES; do
 	echo "--- Updating patches for module '$module' ---"
 
-	rm -rf "${GLUON_PATCHESDIR}/$module"
+	rm -rf "${GLUON_PATCHESDIR:?}/$module"
 
 	cd "$GLUONDIR"/"$module"
 
 	n=0
 	for commit in $(git rev-list --reverse --no-merges base..patched); do
-		let n=n+1
+		(( ++n ))
 		mkdir -p "${GLUON_PATCHESDIR}/$module"
 		git -c core.abbrev=40 show --pretty=format:'From: %an <%ae>%nDate: %aD%nSubject: %B' --no-renames --binary "$commit" > "${GLUON_PATCHESDIR}/$module/$(printf '%04u' $n)-$(git show -s --pretty=format:%f "$commit").patch"
 	done
diff --git a/scripts/update.sh b/scripts/update.sh
index afea8e71..0d33a8cc 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -10,9 +10,9 @@ GLUONDIR="$(pwd)"
 for module in $GLUON_MODULES; do
 	echo "--- Updating module '$module' ---"
 	var=$(echo "$module" | tr '[:lower:]/' '[:upper:]_')
-	eval repo=\${${var}_REPO}
-	eval branch=\${${var}_BRANCH}
-	eval commit=\${${var}_COMMIT}
+	eval 'repo=${'"${var}"'_REPO}'
+	eval 'branch=${'"${var}"'_BRANCH}'
+	eval 'commit=${'"${var}"'_COMMIT}'
 
 	mkdir -p "$GLUONDIR/$module"
 	cd "$GLUONDIR/$module"