diff --git a/lib/galaxy/dependencies/update.sh b/lib/galaxy/dependencies/update.sh
index bb0977fa456..5c69ff30ee1 100755
--- a/lib/galaxy/dependencies/update.sh
+++ b/lib/galaxy/dependencies/update.sh
@@ -47,7 +47,11 @@ fi
 
 # Update pinned requirements files.
 UV_EXPORT_OPTIONS='--frozen --no-annotate --no-hashes'
+# shellcheck disable=SC2086
 ${uv} export ${UV_EXPORT_OPTIONS} --no-dev > "$this_directory/pinned-requirements.txt"
+# shellcheck disable=SC2086
 ${uv} export ${UV_EXPORT_OPTIONS} --only-group=test > "$this_directory/pinned-test-requirements.txt"
+# shellcheck disable=SC2086
 ${uv} export ${UV_EXPORT_OPTIONS} --only-group=dev > "$this_directory/dev-requirements.txt"
+# shellcheck disable=SC2086
 ${uv} export ${UV_EXPORT_OPTIONS} --only-group=typecheck > "$this_directory/pinned-typecheck-requirements.txt"
diff --git a/packages/package-build-install.sh b/packages/package-build-install.sh
index b30d71355e4..e9f7c191221 100755
--- a/packages/package-build-install.sh
+++ b/packages/package-build-install.sh
@@ -7,8 +7,8 @@
 #
 set -euo pipefail
 
-: ${PACKAGE_LIST_FILE:=packages_by_dep_dag.txt}
-: ${PIP_EXTRA_ARGS:=--extra-index-url https://wheels.galaxyproject.org}
+: "${PACKAGE_LIST_FILE:=packages_by_dep_dag.txt}"
+: "${PIP_EXTRA_ARGS:=--extra-index-url https://wheels.galaxyproject.org}"
 #: ${SETUP_VENV:=true}
 
 INSTALL=true
@@ -26,7 +26,7 @@ fi
 
 # Prevent making a venv for build deps for each package, Used inside the package dir, so refers to
 # <source_root>/packages/.venv
-: ${VENV=../.venv}
+: "${VENV=../.venv}"
 export VENV
 
 trap_handler() {
@@ -36,42 +36,45 @@ trap_handler() {
 }
 trap trap_handler EXIT
 
+usage() {
+    echo "usage: $0 [-bem] [up_to_package]"
+    echo "  -b  build only, no install"
+    echo "  -e  install packages in \"editable\" mode (pip install -e)"
+    echo "  -m  install galaxy metapackage, installing pinned deps in meta/requirements.txt"
+}
+
 while getopts ':bhem' OPTION
 do
     case $OPTION in
-        b)
-            INSTALL=false
-            ;;
-        h)
-            echo "usage: $0 [-bem] [up_to_package]"
-            echo "  -b  build only, no install"
-            echo "  -e  install packages in \"editable\" mode (pip install -e)"
-            echo "  -m  install galaxy metapackage, installing pinned deps in meta/requirements.txt"
-            exit 0
-            ;;
-        e)
-            EDITABLE=true
-            INSTALL=true
-            ;;
-        m)
-            META=true
-            ;;
+        b) INSTALL=false
+           ;;
+        h) usage
+           exit 0
+           ;;
+        e) EDITABLE=true
+           INSTALL=true
+           ;;
+        m) META=true
+           ;;
+        ?) usage
+           exit 2
+           ;;
     esac
 done
 shift $((OPTIND - 1))
 
 up_to="${1:-}"
 
-if [ -n "$up_to" -a ! -d "$up_to" ]; then
+if [ -n "$up_to" ] && [ ! -d "$up_to" ]; then
     echo "ERROR: package does not exist: $up_to"
     exit 1
 fi
 
-while read package; do
+while read -r package; do
     [ -n "$package" ] || continue
     if $INSTALL && [[ $package == meta ]] && ! $META; then continue; fi
     printf "\n========= PACKAGE %s =========\n\n" "$package"
-    pushd $package
+    pushd "$package"
     if $EDITABLE; then
         ${PIP_CMD} install -e .
     else
@@ -90,6 +93,7 @@ done < "$PACKAGE_LIST_FILE"
 
 if $INSTALL && $META && ! $EDITABLE; then
     WHEELHOUSE=$(mktemp -d -t gxpkgwheelhouseXXXXXX)
-    cp */dist/*.whl "$WHEELHOUSE"
-    ${PIP_CMD} install $PIP_EXTRA_ARGS --find-links "$WHEELHOUSE" meta/dist/*.whl
+    cp ./*/dist/*.whl "$WHEELHOUSE"
+    # shellcheck disable=SC2086
+    ${PIP_CMD} install ${PIP_EXTRA_ARGS} --find-links "$WHEELHOUSE" meta/dist/*.whl
 fi
diff --git a/packages/test.sh b/packages/test.sh
index 3d46d31fb0e..849d8c67ebd 100755
--- a/packages/test.sh
+++ b/packages/test.sh
@@ -11,8 +11,8 @@ SKIP_PACKAGES=(
 
 should_skip_package() {
     local pkg
-    for pkg in ${SKIP_PACKAGES[@]}; do
-        [[ $1 == $pkg ]] && return 0
+    for pkg in "${SKIP_PACKAGES[@]}"; do
+        [ "$1" = "$pkg" ] && return 0
     done
     return 1
 }
diff --git a/scripts/common_startup.sh b/scripts/common_startup.sh
index b98fb8d8b6b..f06915b7ddd 100755
--- a/scripts/common_startup.sh
+++ b/scripts/common_startup.sh
@@ -267,7 +267,7 @@ if [ $SKIP_CLIENT_BUILD -eq 0 ]; then
     # Set plugin path
     GALAXY_PLUGIN_PATH=$(python scripts/config_parse.py --setting=plugin_path --config-file="$GALAXY_CONFIG_FILE")
 
-    if [ $INSTALL_PREBUILT_CLIENT -eq 0 ]; then
+    if [ "${INSTALL_PREBUILT_CLIENT}" -eq 0 ]; then
         # If we have not opted to use a prebuilt client, then build client.
         cd client
         # shellcheck disable=SC2086
diff --git a/scripts/release.sh b/scripts/release.sh
index 237cf22933b..388073c9f11 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -5,27 +5,27 @@ shopt -s extglob
 # TODO: upload packages
 # TODO: set dev version in 21.01 (+ 20.09?) branches
 
-: ${VENV:=.venv}
-: ${FORK_REMOTE:=origin}
-: ${UPSTREAM_REMOTE:=upstream}
-: ${UPSTREAM_REMOTE_URL:=git@github.com:galaxyproject/galaxy.git}
-: ${DEV_BRANCH:=dev}
-: ${STABLE_BRANCH:=master}
+: "${VENV:=.venv}"
+: "${FORK_REMOTE:=origin}"
+: "${UPSTREAM_REMOTE:=upstream}"
+: "${UPSTREAM_REMOTE_URL:=git@github.com:galaxyproject/galaxy.git}"
+: "${DEV_BRANCH:=dev}"
+: "${STABLE_BRANCH:=master}"
 
 # Vars for local releases
-: ${RELEASE_LOCAL_TAG:=local}
-: ${RELEASE_LOCAL_COMMIT:=$(git rev-parse --short HEAD)}
-: ${RELEASE_LOCAL_VERSION:=${RELEASE_LOCAL_TAG}$(date -u +%Y%m%dT%H%M%SZ).${RELEASE_LOCAL_COMMIT}}
+: "${RELEASE_LOCAL_TAG:=local}"
+: "${RELEASE_LOCAL_COMMIT:=$(git rev-parse --short HEAD)}"
+: "${RELEASE_LOCAL_VERSION:=${RELEASE_LOCAL_TAG}$(date -u +%Y%m%dT%H%M%SZ).${RELEASE_LOCAL_COMMIT}}"
 
 # Only use this for dev/testing/CI to ignore forward merge conflicts, skip confirmation and package builds, etc.
-: ${TEST_MODE:=false}
+: "${TEST_MODE:=false}"
 $TEST_MODE && MERGE_STRATEGY_OPTIONS='-X ours' || MERGE_STRATEGY_OPTIONS=
 
 VERIFY_PACKAGES=(wheel packaging)
 
 BRANCH_CURR=$(git branch --show-current)
 
-: ${RELEASE_CURR:=$(grep '^VERSION_MAJOR' lib/galaxy/version.py | sed -E -e "s/^[^'\"]*['\"]([^'\"]*)['\"]$/\1/")}
+: "${RELEASE_CURR:=$(grep '^VERSION_MAJOR' lib/galaxy/version.py | sed -E -e "s/^[^'\"]*['\"]([^'\"]*)['\"]$/\1/")}"
 RELEASE_NEXT=
 RELEASE_CURR_MINOR=
 RELEASE_CURR_MINOR_NEXT=
@@ -70,7 +70,6 @@ done
 
 function trap_handler() {
     { set +x; } 2>/dev/null
-    local file
     $ERROR && log_func=log_error || log_func=log
     $log_func "Cleaning up..."
     if $WORKING_DIR_CLEAN; then
@@ -140,7 +139,8 @@ function sed_inplace() {
 
 
 function fork_owner() {
-    local url=$(git remote get-url "$FORK_REMOTE")
+    local url
+    url=$(git remote get-url "$FORK_REMOTE")
     case "$url" in
         https://github.com/*)
             echo "$url" | awk -F/ '{print $4}'
@@ -182,7 +182,7 @@ function ensure_prereqs() {
     else
         pip_list=$(log_exec "${VENV}/bin/pip" list)
     fi
-    for package in ${VERIFY_PACKAGES[@]}; do
+    for package in "${VERIFY_PACKAGES[@]}"; do
         echo "$pip_list" | grep -E "^${package}\s+" || { log_error "Package '${package}' missing from venv: ${VENV}" ; exit 1; }
     done
 }
@@ -257,7 +257,8 @@ function branch_exists() {
 
 function _test_forward_merge() {
     local curr="$1"
-    local next="$(release_next "$curr")"
+    local next
+    next=$(release_next "$curr")
     local curr_branch="${UPSTREAM_REMOTE}/release_${curr}"
     local next_branch="${UPSTREAM_REMOTE}/release_${next}"
     local curr_local_branch="__release_merge_test_${curr}"
@@ -274,6 +275,7 @@ function _test_forward_merge() {
     fi
     git_checkout_temp "$next_local_branch" "$next_branch"
     # Test the merge even if ignoring just to test the code path
+    # shellcheck disable=SC2086
     log_exec git merge $MERGE_STRATEGY_OPTIONS -m 'test merge; please ignore' "$curr_local_branch" || { 
         log_error "Merging unmodified ${curr} to ${next} failed, resolve upstream first!"; exit 1; }
     if $recurse; then
@@ -283,21 +285,27 @@ function _test_forward_merge() {
 
 
 function test_forward_merge() {
-    local branch_curr=$(git branch --show-current)
+    local branch_curr
+    branch_curr=$(git branch --show-current)
     _test_forward_merge "$@"
     git checkout "$branch_curr"
 }
 
 
 function perform_stable_merge() {
-    [ "$RELEASE_TYPE" == 'initial' -o "$RELEASE_TYPE" == 'point' ] || return 0
-    local branch_curr=$(git branch --show-current)
+    [ "$RELEASE_TYPE" == 'initial' ] || [ "$RELEASE_TYPE" == 'point' ] || return 0
+    local branch_curr
+    branch_curr=$(git branch --show-current)
     git_checkout_temp '__stable' "${UPSTREAM_REMOTE}/${STABLE_BRANCH}"
-    local stable=$(get_version_major)
-    local curr_int=$(echo "$RELEASE_CURR" | tr -d .)
-    local stable_int=$(echo "$stable" | tr -d .)
+    local stable
+    stable=$(get_version_major)
+    local curr_int
+    curr_int=$(echo "$RELEASE_CURR" | tr -d .)
+    local stable_int
+    stable_int=$(echo "$stable" | tr -d .)
     if [ "$curr_int" -ge "$stable_int" ]; then
         log "Release '${RELEASE_CURR}' >= stable branch release '${stable}', merging 'release_${RELEASE_CURR}' to '${STABLE_BRANCH}'"
+        # shellcheck disable=SC2086
         log_exec git merge $MERGE_STRATEGY_OPTIONS -m "Merge branch 'release_${RELEASE_CURR}' into '${STABLE_BRANCH}'" "__release_${RELEASE_CURR}"
         PUSH_BRANCHES+=("__stable:${STABLE_BRANCH}")
     else
@@ -309,7 +317,8 @@ function perform_stable_merge() {
 
 function _perform_forward_merge() {
     local curr="$1"
-    local next="$(release_next "$curr")"
+    local next
+    next="$(release_next "$curr")"
     local curr_branch="${UPSTREAM_REMOTE}/release_${curr}"
     local next_branch="${UPSTREAM_REMOTE}/release_${next}"
     local curr_local_branch="__release_${curr}"
@@ -335,7 +344,8 @@ function _perform_forward_merge() {
 
 function perform_forward_merge() {
     local curr="$1"
-    local branch_curr=$(git branch --show-current)
+    local branch_curr
+    branch_curr=$(git branch --show-current)
     _perform_forward_merge "$@"
     declare -p PUSH_BRANCHES
     git checkout "$branch_curr"
@@ -348,7 +358,7 @@ function push_merged() {
         log "Pushing '${branch}' to remote '${UPSTREAM_REMOTE}'"
         log_exec git push "$UPSTREAM_REMOTE" "$branch"
     done
-    if [ "$RELEASE_TYPE" == 'initial' -o "$RELEASE_TYPE" == 'point' ]; then
+    if [ "$RELEASE_TYPE" == 'initial' ] || [ "$RELEASE_TYPE" == 'point' ]; then
         log_exec git push --tags "$UPSTREAM_REMOTE"
     fi
 }
@@ -448,7 +458,7 @@ function packages_make_all() {
     (
         cd packages/
         for dir in *; do
-            [ ! -d "$dir" -o ! -f "${dir}/setup.cfg" ] && continue
+            [ ! -d "$dir" ] || [ ! -f "${dir}/setup.cfg" ] && continue
             # can't use log_exec here because we want to capture output
             echo + make -C "$dir" "$@" 1>&2
             make -C "$dir" "$@" >"${dir}/make-${1}.log" 2>&1
@@ -504,7 +514,7 @@ function perform_version_update() {
 
 
 function perform_version_update_dev() {
-    [ "$RELEASE_TYPE" == 'initial' -o "$RELEASE_TYPE" == 'point' ] || return 0
+    [ "$RELEASE_TYPE" == 'initial' ] || [ "$RELEASE_TYPE" == 'point' ] || return 0
     log "Incrementing release version to '${RELEASE_CURR}.${RELEASE_CURR_MINOR_NEXT_DEV}' for development of next point release"
     update_galaxy_version 'VERSION_MINOR' "$RELEASE_CURR_MINOR_NEXT_DEV"
     log_exec git diff --exit-code && { log_error 'Missing expected version.py changes'; exit 1; } || true
@@ -542,7 +552,8 @@ function create_release_rc_initial() {
     sed_inplace -e "s/^RELEASE_CURR:=.*/RELEASE_CURR:=${RELEASE_NEXT}/" Makefile
     log_exec git diff --exit-code && { log_error 'Missing expected Makefile changes'; exit 1; } || true
     git add -- Makefile
-    local package_version=$(packaging_version "${RELEASE_NEXT}.0dev0" "true")
+    local package_version
+    package_version=$(packaging_version "${RELEASE_NEXT}.0dev0" "true")
     update_package_versions "$package_version"
     git add -- packages/
     log_exec git commit -m "Update version to ${RELEASE_NEXT}.dev0"
@@ -551,7 +562,8 @@ function create_release_rc_initial() {
 	log_exec git merge -X ours -m "Merge branch 'release_${RELEASE_CURR}' into 'dev'" "__release_${RELEASE_CURR}"
 
     # Push branches for PR
-    local owner=$(fork_owner)
+    local owner
+    owner=$(fork_owner)
     local curr_remote_branch="version-${RELEASE_CURR}.${RELEASE_CURR_MINOR_NEXT}"
     local next_remote_branch="version-${RELEASE_NEXT}.dev"
     log_exec git push "$FORK_REMOTE" "__release_${RELEASE_CURR}:${curr_remote_branch}"
diff --git a/test/release.sh b/test/release.sh
index 44e97f51546..57785c28eb4 100755
--- a/test/release.sh
+++ b/test/release.sh
@@ -4,8 +4,8 @@ set -euo pipefail
 # Necessary for testing the release script
 export TEST_MODE=true
 
-: ${ORIGIN:=origin}
-: ${STABLE_BRANCH:=master}
+: "${ORIGIN:=origin}"
+: "${STABLE_BRANCH:=master}"
 
 REPO_ROOT=
 FORK_ROOT=$(mktemp -d -t galaxy_release_test_XXXXXXXX)
@@ -16,7 +16,7 @@ TEST_RELEASE_CURR='99.0'
 TEST_RELEASE_NEXT='99.1'
 TEST_RELEASE_NEXT_NEXT='99.2'
 
-: ${VENV:=${FORK_ROOT}/venv}
+: "${VENV:=${FORK_ROOT}/venv}"
 export VENV
 
 
@@ -60,7 +60,8 @@ function get_stable_version() {
     local part="$1"
     (
         cd_fork work
-        local restore_branch="$(git branch --show-current)"
+        local restore_branch
+        restore_branch="$(git branch --show-current)"
         git checkout -q --no-track -b __stable_version_check "upstream/${STABLE_BRANCH}"
         grep "^VERSION_${part}" lib/galaxy/version.py | sed -E -e "s/^[^'\"]*['\"]([^'\"]*)['\"]$/\1/"
         git checkout -q "$restore_branch"
@@ -148,8 +149,9 @@ function verify_version() {
     local minor="$2"
     local ref="$3"
     local _ref="$3"
-    local restore_branch="$(git branch --show-current)"
-    [ -n "$(git tag -l $ref)" ]  || _ref="upstream/${ref}"
+    local restore_branch
+    restore_branch="$(git branch --show-current)"
+    [ -n "$(git tag -l "$ref")" ]  || _ref="upstream/${ref}"
     log_exec git checkout --no-track -b "__${ref}" "$_ref"
     if grep -q "^VERSION_MAJOR = \"${major}\"$" lib/galaxy/version.py; then
         log "**** Major version '${major}' is correct at ref '${ref}'"
@@ -174,8 +176,9 @@ function verify_makefile_version() {
     local major="$1"
     local ref="$2"
     local _ref="$2"
-    local restore_branch="$(git branch --show-current)"
-    [ -n "$(git tag -l $ref)" ]  || _ref="upstream/${ref}"
+    local restore_branch
+    restore_branch="$(git branch --show-current)"
+    [ -n "$(git tag -l "$ref")" ]  || _ref="upstream/${ref}"
     log_exec git checkout --no-track -b "__${ref}" "$_ref"
     if grep -q "^RELEASE_CURR:=${major}$" Makefile; then
         log "**** RELEASE_CURR '${major}' is correct in Makefile at ref '${ref}'"