diff --git a/hack/shell b/hack/shell
index cd2901a5..75797e96 100755
--- a/hack/shell
+++ b/hack/shell
@@ -2,8 +2,8 @@
 
 set -e
 
-: ${BUILDX_CMD=docker buildx}
-: ${TMUX=}
+: "${BUILDX_CMD=docker buildx}"
+: "${TMUX=}"
 
 function clean {
   docker rmi $iid
diff --git a/hack/test-driver b/hack/test-driver
index be5810c8..871ddb20 100755
--- a/hack/test-driver
+++ b/hack/test-driver
@@ -2,14 +2,14 @@
 
 set -eu -o pipefail
 
-: ${BUILDX_CMD=docker buildx}
-: ${BUILDKIT_IMAGE=moby/buildkit:buildx-stable-1}
-: ${BUILDKIT_CFG=}
-: ${DRIVER=docker-container}
-: ${DRIVER_OPT=}
-: ${ENDPOINT=}
-: ${MULTI_NODE=0}
-: ${PLATFORMS=linux/amd64,linux/arm64}
+: "${BUILDX_CMD=docker buildx}"
+: "${BUILDKIT_IMAGE=moby/buildkit:buildx-stable-1}"
+: "${BUILDKIT_CFG=}"
+: "${DRIVER=docker-container}"
+: "${DRIVER_OPT=}"
+: "${ENDPOINT=}"
+: "${MULTI_NODE=0}"
+: "${PLATFORMS=linux/amd64,linux/arm64}"
 
 function buildxCmd {
   (set -x ; $BUILDX_CMD "$@")
diff --git a/hack/update-docs b/hack/update-docs
index 1bd2e638..c9dbaab8 100755
--- a/hack/update-docs
+++ b/hack/update-docs
@@ -2,11 +2,11 @@
 
 set -eu -o pipefail
 
-: ${BUILDX_CMD=docker buildx}
-: ${FORMATS=md}
+: "${BUILDX_CMD=docker buildx}"
+: "${FORMATS=md}"
 
 output=$(mktemp -d -t buildx-output.XXXXXXXXXX)
 (set -x ; DOCS_FORMATS=$FORMATS ${BUILDX_CMD} bake --set "*.output=$output" update-docs)
 rm -rf ./docs/reference/*
 cp -R "$output"/out/* ./docs/
-rm -rf $output
+rm -rf "$output"
diff --git a/hack/update-vendor b/hack/update-vendor
index 983a7f0c..f679c845 100755
--- a/hack/update-vendor
+++ b/hack/update-vendor
@@ -2,10 +2,10 @@
 
 set -eu -o pipefail
 
-: ${BUILDX_CMD=docker buildx}
+: "${BUILDX_CMD=docker buildx}"
 
 output=$(mktemp -d -t buildx-output.XXXXXXXXXX)
 (set -x ; ${BUILDX_CMD} bake --set "*.output=$output" update-vendor)
 rm -rf ./vendor
 cp -R "$output"/out/* .
-rm -rf $output
+rm -rf "$output"