diff --git a/ci/add-apt-keys.sh b/ci/add-apt-keys.sh
index 72ea596..3c299ee 100755
--- a/ci/add-apt-keys.sh
+++ b/ci/add-apt-keys.sh
@@ -23,7 +23,7 @@ function do_add_key
         keyfilename=$(basename -s .key "$key_url")
     fi
     echo -e "\tDownloading APT key from '$key_url' to '$keyfilename'"
-    if ! curl -sSL --retry ${NET_RETRY_COUNT:-5} "$key_url" | sudo gpg --dearmor -o "/etc/apt/trusted.gpg.d/${keyfilename}"; then
+    if ! curl -sSL --retry "${NET_RETRY_COUNT:-5}" "$key_url" | sudo gpg --dearmor -o "/etc/apt/trusted.gpg.d/${keyfilename}"; then
         echo "Failed downloading $keyfilename"
         return 1
     fi
diff --git a/ci/add-apt-repositories.sh b/ci/add-apt-repositories.sh
index 0df21bc..b5e5dce 100755
--- a/ci/add-apt-repositories.sh
+++ b/ci/add-apt-repositories.sh
@@ -14,7 +14,7 @@ set -eu
 function do_add_repository {
     name=$1
     echo -e "\tAdding repository $name"
-    for i in $(seq ${NET_RETRY_COUNT:-3}); do
+    for i in $(seq "${NET_RETRY_COUNT:-3}"); do
         if [[ $i -ne 1 ]]; then
             sleep 10
             echo -e "\tRetrying"
diff --git a/ci/build.sh b/ci/build.sh
index 30200e6..7feab47 100755
--- a/ci/build.sh
+++ b/ci/build.sh
@@ -10,7 +10,7 @@
 
 set -ex
 
-: ${B2_TARGETS:="libs/$SELF/test"}
+: "${B2_TARGETS:="libs/$SELF/test"}"
 
 . "$(dirname "${BASH_SOURCE[0]}")"/enforce.sh
 
diff --git a/ci/codecov.sh b/ci/codecov.sh
index 7245de5..d5d7eca 100755
--- a/ci/codecov.sh
+++ b/ci/codecov.sh
@@ -25,7 +25,7 @@
 
 set -ex
 
-. $(dirname "${BASH_SOURCE[0]}")/enforce.sh
+. "$(dirname "${BASH_SOURCE[0]}")"/enforce.sh
 
 coverage_action=$1
 
@@ -55,7 +55,7 @@ elif [[ "$coverage_action" == "collect" ]] || [[ "$coverage_action" == "upload"
     fi
 
     # install the latest lcov we know works
-    : ${LCOV_VERSION:=v1.15}
+    : "${LCOV_VERSION:=v1.15}"
 
     if [[ "$LCOV_VERSION" =~ ^v[2-9] ]]; then
         sudo apt-get install -y libcapture-tiny-perl libdatetime-perl || true
@@ -65,33 +65,33 @@ elif [[ "$coverage_action" == "collect" ]] || [[ "$coverage_action" == "upload"
 
     rm -rf /tmp/lcov
     cd /tmp
-    git clone --depth 1 -b ${LCOV_VERSION} https://github.com/linux-test-project/lcov.git
+    git clone --depth 1 -b "${LCOV_VERSION}" https://github.com/linux-test-project/lcov.git
     export PATH=/tmp/lcov/bin:$PATH
     command -v lcov
     lcov --version
 
     # switch back to the original source code directory
-    cd $BOOST_CI_SRC_FOLDER
+    cd "$BOOST_CI_SRC_FOLDER"
     : "${LCOV_BRANCH_COVERAGE:=1}" # Set default
 
     # coverage files are in ../../b2 from this location
-    lcov ${LCOV_OPTIONS} --rc lcov_branch_coverage=${LCOV_BRANCH_COVERAGE} --gcov-tool=$GCOV --directory "$BOOST_ROOT" --capture --output-file all.info
+    lcov ${LCOV_OPTIONS} --rc lcov_branch_coverage="${LCOV_BRANCH_COVERAGE}" --gcov-tool="$GCOV" --directory "$BOOST_ROOT" --capture --output-file all.info
     # dump a summary on the console
-    lcov --rc lcov_branch_coverage=${LCOV_BRANCH_COVERAGE} --list all.info
+    lcov --rc lcov_branch_coverage="${LCOV_BRANCH_COVERAGE}" --list all.info
 
     # all.info contains all the coverage info for all projects - limit to ours
     # first we extract the interesting headers for our project then we use that list to extract the right things
-    for f in `for f in include/boost/*; do echo $f; done | cut -f2- -d/`; do echo "*/$f*"; done > /tmp/interesting
+    for f in $(for h in include/boost/*; do echo "$h"; done | cut -f2- -d/); do echo "*/$f*"; done > /tmp/interesting
     echo headers that matter:
     cat /tmp/interesting
-    xargs --verbose -L 999999 -a /tmp/interesting lcov ${LCOV_OPTIONS} --rc lcov_branch_coverage=${LCOV_BRANCH_COVERAGE} --extract all.info "*/libs/$SELF/*" --output-file coverage.info
+    xargs --verbose -L 999999 -a /tmp/interesting lcov ${LCOV_OPTIONS} --rc lcov_branch_coverage="${LCOV_BRANCH_COVERAGE}" --extract all.info "*/libs/$SELF/*" --output-file coverage.info
 
     # dump a summary on the console - helps us identify problems in pathing
     # note this has test file coverage in it - if you do not want to count test
     # files against your coverage numbers then use a .codecov.yml file which
     # must be checked into the default branch (it is not read or used from a
     # pull request)
-    lcov --rc lcov_branch_coverage=${LCOV_BRANCH_COVERAGE} --list coverage.info
+    lcov --rc lcov_branch_coverage="${LCOV_BRANCH_COVERAGE}" --list coverage.info
 
     if [[ "$coverage_action" == "upload" ]] && [[ "$BOOST_CI_CODECOV_IO_UPLOAD" != "skip" ]]; then
         #
diff --git a/ci/coverity.sh b/ci/coverity.sh
index 03ee43d..818efc7 100755
--- a/ci/coverity.sh
+++ b/ci/coverity.sh
@@ -30,7 +30,7 @@ if [[ "${1:-}" != "--skipdownload" ]]; then
   curl -L -d "token=$COVERITY_SCAN_TOKEN&project=$BOOST_REPO" -X POST https://scan.coverity.com/download/cxx/linux64 -o coverity_tool.tgz
   tar xzf coverity_tool.tgz
 fi
-COVBIN=$(echo $(pwd)/cov-analysis*/bin)
+COVBIN=$(echo "$(pwd)"/cov-analysis*/bin)
 export PATH=$COVBIN:$PATH
 popd
 
diff --git a/ci/drone/linux-cxx-install.sh b/ci/drone/linux-cxx-install.sh
index 8fc972c..025f839 100755
--- a/ci/drone/linux-cxx-install.sh
+++ b/ci/drone/linux-cxx-install.sh
@@ -5,7 +5,12 @@ set -e
 function add_repository {
     name="$1"
     echo -e "\tAdding repository $name"
-    for i in {1..3}; do sudo -E apt-add-repository -y "$name" && return 0 || sleep 10; done
+    for _i in {1..3}; do
+        if sudo -E apt-add-repository -y "$name"; then
+            return 0;
+        fi
+        sleep 10
+    done
     return 1 # Failed
 }