diff --git a/compiler/rustc_codegen_cranelift/scripts/cargo.sh b/compiler/rustc_codegen_cranelift/scripts/cargo.sh
index e63daa40f35..947b4a28798 100755
--- a/compiler/rustc_codegen_cranelift/scripts/cargo.sh
+++ b/compiler/rustc_codegen_cranelift/scripts/cargo.sh
@@ -10,7 +10,7 @@ cmd=$1
 shift || true
 
 if [[ "$cmd" = "jit" ]]; then
-cargo +${TOOLCHAIN} rustc $@ -- --jit
+cargo +${TOOLCHAIN} rustc "$@" -- --jit
 else
-cargo +${TOOLCHAIN} $cmd $@
+cargo +${TOOLCHAIN} $cmd "$@"
 fi
diff --git a/compiler/rustc_codegen_cranelift/test.sh b/compiler/rustc_codegen_cranelift/test.sh
index 3cdd4119d79..c6c4956e481 100755
--- a/compiler/rustc_codegen_cranelift/test.sh
+++ b/compiler/rustc_codegen_cranelift/test.sh
@@ -3,13 +3,13 @@ set -e
 
 export RUSTFLAGS="-Zrun_dsymutil=no"
 
-./build.sh --without-sysroot $@
+./build.sh --without-sysroot "$@"
 
 rm -r target/out || true
 
 scripts/tests.sh no_sysroot
 
-./build.sh $@
+./build.sh "$@"
 
 scripts/tests.sh base_sysroot
 scripts/tests.sh extended_sysroot
diff --git a/src/ci/docker/host-x86_64/disabled/dist-x86_64-dragonfly/build-toolchain.sh b/src/ci/docker/host-x86_64/disabled/dist-x86_64-dragonfly/build-toolchain.sh
index 112d747fe4e..409bca45c94 100755
--- a/src/ci/docker/host-x86_64/disabled/dist-x86_64-dragonfly/build-toolchain.sh
+++ b/src/ci/docker/host-x86_64/disabled/dist-x86_64-dragonfly/build-toolchain.sh
@@ -17,7 +17,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   set -x
diff --git a/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/build-toolchain.sh b/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/build-toolchain.sh
index faf30f36a20..189e537ecae 100755
--- a/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/build-toolchain.sh
+++ b/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/build-toolchain.sh
@@ -22,7 +22,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   set -x
diff --git a/src/ci/docker/host-x86_64/dist-aarch64-linux/build-toolchains.sh b/src/ci/docker/host-x86_64/dist-aarch64-linux/build-toolchains.sh
index 390ba1a1ddf..f15a7081612 100755
--- a/src/ci/docker/host-x86_64/dist-aarch64-linux/build-toolchains.sh
+++ b/src/ci/docker/host-x86_64/dist-aarch64-linux/build-toolchains.sh
@@ -11,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-arm-linux/build-toolchains.sh b/src/ci/docker/host-x86_64/dist-arm-linux/build-toolchains.sh
index 2e790b77a96..3fd88252199 100755
--- a/src/ci/docker/host-x86_64/dist-arm-linux/build-toolchains.sh
+++ b/src/ci/docker/host-x86_64/dist-arm-linux/build-toolchains.sh
@@ -12,7 +12,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-armhf-linux/build-toolchains.sh b/src/ci/docker/host-x86_64/dist-armhf-linux/build-toolchains.sh
index a01c2e0eb0a..f425efd6057 100755
--- a/src/ci/docker/host-x86_64/dist-armhf-linux/build-toolchains.sh
+++ b/src/ci/docker/host-x86_64/dist-armhf-linux/build-toolchains.sh
@@ -12,7 +12,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-armv7-linux/build-toolchains.sh b/src/ci/docker/host-x86_64/dist-armv7-linux/build-toolchains.sh
index 28f8ba2437b..17dda2dbd16 100755
--- a/src/ci/docker/host-x86_64/dist-armv7-linux/build-toolchains.sh
+++ b/src/ci/docker/host-x86_64/dist-armv7-linux/build-toolchains.sh
@@ -12,7 +12,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-powerpc-linux/build-powerpc-toolchain.sh b/src/ci/docker/host-x86_64/dist-powerpc-linux/build-powerpc-toolchain.sh
index d2e39834d6e..264d0764f29 100755
--- a/src/ci/docker/host-x86_64/dist-powerpc-linux/build-powerpc-toolchain.sh
+++ b/src/ci/docker/host-x86_64/dist-powerpc-linux/build-powerpc-toolchain.sh
@@ -11,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-powerpc64-linux/shared.sh b/src/ci/docker/host-x86_64/dist-powerpc64-linux/shared.sh
index 4b207031df8..dc86dddd464 100644
--- a/src/ci/docker/host-x86_64/dist-powerpc64-linux/shared.sh
+++ b/src/ci/docker/host-x86_64/dist-powerpc64-linux/shared.sh
@@ -9,7 +9,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   set -x
diff --git a/src/ci/docker/host-x86_64/dist-powerpc64le-linux/shared.sh b/src/ci/docker/host-x86_64/dist-powerpc64le-linux/shared.sh
index 4b207031df8..dc86dddd464 100644
--- a/src/ci/docker/host-x86_64/dist-powerpc64le-linux/shared.sh
+++ b/src/ci/docker/host-x86_64/dist-powerpc64le-linux/shared.sh
@@ -9,7 +9,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   set -x
diff --git a/src/ci/docker/host-x86_64/dist-riscv64-linux/build-toolchains.sh b/src/ci/docker/host-x86_64/dist-riscv64-linux/build-toolchains.sh
index 6a7c022d01a..a7025b2b754 100755
--- a/src/ci/docker/host-x86_64/dist-riscv64-linux/build-toolchains.sh
+++ b/src/ci/docker/host-x86_64/dist-riscv64-linux/build-toolchains.sh
@@ -12,7 +12,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-s390x-linux/build-s390x-toolchain.sh b/src/ci/docker/host-x86_64/dist-s390x-linux/build-s390x-toolchain.sh
index df9529da8a1..6f8d6be842b 100755
--- a/src/ci/docker/host-x86_64/dist-s390x-linux/build-s390x-toolchain.sh
+++ b/src/ci/docker/host-x86_64/dist-s390x-linux/build-s390x-toolchain.sh
@@ -11,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-various-1/build-rumprun.sh b/src/ci/docker/host-x86_64/dist-various-1/build-rumprun.sh
index 9c7aaef4f43..103dbbe6fda 100755
--- a/src/ci/docker/host-x86_64/dist-various-1/build-rumprun.sh
+++ b/src/ci/docker/host-x86_64/dist-various-1/build-rumprun.sh
@@ -11,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   rm /tmp/build.log
diff --git a/src/ci/docker/host-x86_64/dist-x86_64-linux/shared.sh b/src/ci/docker/host-x86_64/dist-x86_64-linux/shared.sh
index 4b207031df8..dc86dddd464 100644
--- a/src/ci/docker/host-x86_64/dist-x86_64-linux/shared.sh
+++ b/src/ci/docker/host-x86_64/dist-x86_64-linux/shared.sh
@@ -9,7 +9,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   set -x
diff --git a/src/ci/docker/host-x86_64/dist-x86_64-netbsd/build-netbsd-toolchain.sh b/src/ci/docker/host-x86_64/dist-x86_64-netbsd/build-netbsd-toolchain.sh
index f8697c698b9..5dfa47b4eed 100755
--- a/src/ci/docker/host-x86_64/dist-x86_64-netbsd/build-netbsd-toolchain.sh
+++ b/src/ci/docker/host-x86_64/dist-x86_64-netbsd/build-netbsd-toolchain.sh
@@ -13,7 +13,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/scripts/emscripten.sh b/src/ci/docker/scripts/emscripten.sh
index 61596a1ca30..56dc96283ed 100644
--- a/src/ci/docker/scripts/emscripten.sh
+++ b/src/ci/docker/scripts/emscripten.sh
@@ -11,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   rm -f /tmp/build.log
diff --git a/src/ci/docker/scripts/freebsd-toolchain.sh b/src/ci/docker/scripts/freebsd-toolchain.sh
index b10263d5a26..c7ff78ca90c 100755
--- a/src/ci/docker/scripts/freebsd-toolchain.sh
+++ b/src/ci/docker/scripts/freebsd-toolchain.sh
@@ -19,7 +19,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   local ping_loop_pid=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $ping_loop_pid
   set -x
diff --git a/src/ci/docker/scripts/musl-toolchain.sh b/src/ci/docker/scripts/musl-toolchain.sh
index e83367db35b..59fc921ec26 100644
--- a/src/ci/docker/scripts/musl-toolchain.sh
+++ b/src/ci/docker/scripts/musl-toolchain.sh
@@ -20,7 +20,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   rm /tmp/build.log
diff --git a/src/ci/docker/scripts/musl.sh b/src/ci/docker/scripts/musl.sh
index c5d6cdeba03..65e15950559 100644
--- a/src/ci/docker/scripts/musl.sh
+++ b/src/ci/docker/scripts/musl.sh
@@ -11,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   rm /tmp/build.log
@@ -33,7 +33,7 @@ if [ ! -d $MUSL ]; then
 fi
 
 cd $MUSL
-./configure --enable-optimize --enable-debug --disable-shared --prefix=/musl-$TAG $@
+./configure --enable-optimize --enable-debug --disable-shared --prefix=/musl-$TAG "$@"
 if [ "$TAG" = "i586" -o "$TAG" = "i686" ]; then
   hide_output make -j$(nproc) AR=ar RANLIB=ranlib
 else
diff --git a/src/ci/init_repo.sh b/src/ci/init_repo.sh
index 92c6e546a38..0fc09d0c8e2 100755
--- a/src/ci/init_repo.sh
+++ b/src/ci/init_repo.sh
@@ -53,7 +53,7 @@ modules=($modules)
 use_git=""
 urls="$(git config --file .gitmodules --get-regexp '\.url$' | cut -d' ' -f2)"
 urls=($urls)
-for i in ${!modules[@]}; do
+for i in "${!modules[@]}"; do
     module=${modules[$i]}
     if [[ " $included " = *" $module "* ]]; then
         commit="$(git ls-tree HEAD $module | awk '{print $3}')"