diff --git a/docker-common.sh b/docker-common.sh
index a2fc2a1..d14187d 100644
--- a/docker-common.sh
+++ b/docker-common.sh
@@ -3,7 +3,7 @@
 set -e
 set -x
 
-docker login -u $DOCKER_USER -p $DOCKER_PASS
+docker login -u "$DOCKER_USER" -p "$DOCKER_PASS"
 
 # LEDE Build System (LEDE GnuPG key for unattended build jobs)
 curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/626471F1.asc' | gpg --import \
diff --git a/docker-imagebuilder.sh b/docker-imagebuilder.sh
index 1fca15f..8da68df 100644
--- a/docker-imagebuilder.sh
+++ b/docker-imagebuilder.sh
@@ -17,26 +17,26 @@ for TARGET in $TARGETS ; do
         curl "https://downloads.openwrt.org/$IMAGEBUILDER_PATH/sha256sums.asc" -sS -o sha256sums.asc
         gpg --with-fingerprint --verify sha256sums.asc sha256sums
         rsync -av "downloads.openwrt.org::downloads/$IMAGEBUILDER_PATH/$IMAGEBUILDER_FILE" . || contine # skip uploading if no IB is available
-        cat sha256sums | grep openwrt-imagebuilder > sha256sums_imagebuilder
+        grep openwrt-imagebuilder sha256sums > sha256sums_imagebuilder
         sha256sum -c sha256sums_imagebuilder
 
         mkdir -p ./imagebuilder
-        tar Jxf $IMAGEBUILDER_FILE --strip=1 -C ./imagebuilder
-        rm -rf $IMAGEBUILDER_FILE
+        tar Jxf "$IMAGEBUILDER_FILE" --strip=1 -C ./imagebuilder
+        rm -rf "$IMAGEBUILDER_FILE"
 
-        docker build -t $DOCKER_IMAGE:$TARGET-$BRANCH -f Dockerfile.imagebuilder .
+        docker build -t "$DOCKER_IMAGE:$TARGET-$BRANCH" -f Dockerfile.imagebuilder .
 
         rm -rf ./imagebuilder
 
         if [ "$BRANCH" == "master" ]; then
-            docker tag $DOCKER_IMAGE:$TARGET-$BRANCH $DOCKER_IMAGE:$TARGET
-            docker push $DOCKER_IMAGE:$TARGET
+            docker tag "$DOCKER_IMAGE:$TARGET-$BRANCH" "$DOCKER_IMAGE:$TARGET"
+            docker push "$DOCKER_IMAGE:$TARGET"
             if [ "$TARGET" == "x86-64" ]; then
-                docker tag $DOCKER_IMAGE:$TARGET-$BRANCH $DOCKER_IMAGE:latest
-                docker push $DOCKER_IMAGE:latest
+                docker tag "$DOCKER_IMAGE:$TARGET-$BRANCH" "$DOCKER_IMAGE:latest"
+                docker push "$DOCKER_IMAGE:latest"
             fi
         else
-            docker push $DOCKER_IMAGE:$TARGET-$BRANCH
+            docker push "$DOCKER_IMAGE:$TARGET-$BRANCH"
         fi
     done
 done
diff --git a/docker-rootfs.sh b/docker-rootfs.sh
index 2be3c6e..40e5c0d 100644
--- a/docker-rootfs.sh
+++ b/docker-rootfs.sh
@@ -18,27 +18,27 @@ for TARGET in $TARGETS ; do
         rsync -av "downloads.openwrt.org::downloads/$ROOTFS_PATH/$ROOTFS_FILE" . || contine
 
         # shrink checksum file to single desired file and verify downloaded archive
-        cat sha256sums | grep generic-rootfs > sha256sums_rootfs
+        grep generic-rootfs sha256sums > sha256sums_rootfs
         sha256sum -c sha256sums_rootfs
 
         mkdir -p ./rootfs-openwrt
-        tar xzf $ROOTFS_FILE -C ./rootfs-openwrt
-        rm -rf $ROOTFS_FILE
+        tar xzf "$ROOTFS_FILE" -C ./rootfs-openwrt
+        rm -rf "$ROOTFS_FILE"
 
-        docker build -t $DOCKER_IMAGE:$TARGET-$BRANCH -f Dockerfile.rootfs .
+        docker build -t "$DOCKER_IMAGE:$TARGET-$BRANCH" -f Dockerfile.rootfs .
 
         rm -rf ./rootfs-openwrt
 
         # snapshot don't get master attached to tag
-        if [ "$BRANCH" == "master" ]; then
-            docker tag $DOCKER_IMAGE:$TARGET-$BRANCH $DOCKER_IMAGE:$TARGET
-            docker push $DOCKER_IMAGE:$TARGET
-            if [ "$TARGET" == "x86-64" ]; then
-                docker tag $DOCKER_IMAGE:$TARGET-$BRANCH $DOCKER_IMAGE:latest
-                docker push $DOCKER_IMAGE:latest
+        if [ "$BRANCH" = "master" ]; then
+            docker tag "$DOCKER_IMAGE:$TARGET-$BRANCH" "$DOCKER_IMAGE:$TARGET"
+            docker push "$DOCKER_IMAGE:$TARGET"
+            if [ "$TARGET" = "x86-64" ]; then
+                docker tag "$DOCKER_IMAGE:$TARGET-$BRANCH" "$DOCKER_IMAGE:latest"
+                docker push "$DOCKER_IMAGE:latest"
             fi
         else
-            docker push $DOCKER_IMAGE:$TARGET-$BRANCH
+            docker push "$DOCKER_IMAGE:$TARGET-$BRANCH"
         fi
     done
 done
diff --git a/docker-sdk.sh b/docker-sdk.sh
index 213a097..7574cae 100644
--- a/docker-sdk.sh
+++ b/docker-sdk.sh
@@ -19,12 +19,12 @@ for TARGET in $TARGETS ; do
         curl "https://downloads.openwrt.org/$SDK_PATH/sha256sums.asc" -sS -o sha256sums.asc
         gpg --with-fingerprint --verify sha256sums.asc sha256sums
         rsync -av "downloads.openwrt.org::downloads/$SDK_PATH/$SDK_FILE" . || continue # skip uploading if no SDK is available
-        cat sha256sums | grep openwrt-sdk > sha256sums_sdk
+        grep openwrt-sdk sha256sums > sha256sums_sdk
         sha256sum -c sha256sums_sdk
 
         mkdir -p ./sdk
-        tar Jxf $SDK_FILE --strip=1 -C ./sdk
-        rm -rf $SDK_FILE
+        tar Jxf "$SDK_FILE" --strip=1 -C ./sdk
+        rm -rf "$SDK_FILE"
 
         # use GitHub instead of git.openwrt.org
         cat > ./sdk/feeds.conf <<EOF
@@ -35,19 +35,19 @@ src-git routing https://github.com/openwrt-routing/packages.git;$BRANCH_FEEDS
 src-git telephony https://github.com/openwrt/telephony.git;$BRANCH_FEEDS
 EOF
 
-        docker build -t $DOCKER_IMAGE:$TARGET-$BRANCH -f Dockerfile.sdk .
+        docker build -t "$DOCKER_IMAGE:$TARGET-$BRANCH" -f Dockerfile.sdk .
 
         rm -rf ./sdk
 
         if [ "$BRANCH" == "master" ]; then
-            docker tag $DOCKER_IMAGE:$TARGET-$BRANCH $DOCKER_IMAGE:$TARGET
-            docker push $DOCKER_IMAGE:$TARGET
+            docker tag "$DOCKER_IMAGE:$TARGET-$BRANCH" "$DOCKER_IMAGE:$TARGET"
+            docker push "$DOCKER_IMAGE:$TARGET"
             if [ "$TARGET" == "x86-64" ]; then
-                docker tag $DOCKER_IMAGE:$TARGET-$BRANCH $DOCKER_IMAGE:latest
-                docker push $DOCKER_IMAGE:latest
+                docker tag "$DOCKER_IMAGE:$TARGET-$BRANCH" "$DOCKER_IMAGE:latest"
+                docker push "$DOCKER_IMAGE:latest"
             fi
         else
-            docker push $DOCKER_IMAGE:$TARGET-$BRANCH
+            docker push "$DOCKER_IMAGE:$TARGET-$BRANCH"
         fi
     done
 done