diff --git a/test/TEST-50-DISSECT/test.sh b/test/TEST-50-DISSECT/test.sh
index 9d42e4891c1..86a4f079bb0 100755
--- a/test/TEST-50-DISSECT/test.sh
+++ b/test/TEST-50-DISSECT/test.sh
@@ -23,6 +23,7 @@ test_append_files() {
         install_dmevent
         generate_module_dependencies
         inst_binary losetup
+        inst_binary wc
         install_verity_minimal
     )
 }
diff --git a/test/units/testsuite-02.sh b/test/units/testsuite-02.sh
index b0807c9d8aa..ea4efda70bd 100755
--- a/test/units/testsuite-02.sh
+++ b/test/units/testsuite-02.sh
@@ -54,9 +54,9 @@ for task in "${TEST_LIST[@]}"; do
     # until one of the tasks finishes, so we can replace it.
     while [[ ${#running[@]} -ge $MAX_QUEUE_SIZE ]]; do
         for key in "${!running[@]}"; do
-            if ! kill -0 ${running[$key]} &>/dev/null; then
+            if ! kill -0 "${running[$key]}" &>/dev/null; then
                 # Task has finished, report its result and drop it from the queue
-                wait ${running[$key]}
+                wait "${running[$key]}"
                 ec=$?
                 report_result "$key" $ec
                 unset running["$key"]
diff --git a/test/units/testsuite-13.sh b/test/units/testsuite-13.sh
index 03b1bc39712..d93cc7b1452 100755
--- a/test/units/testsuite-13.sh
+++ b/test/units/testsuite-13.sh
@@ -112,7 +112,7 @@ EOF
         sleep 0.1
     done
 
-    return $(systemctl show -P ExecMainStatus nspawn_machinectl_bind.service)
+    return "$(systemctl show -P ExecMainStatus nspawn_machinectl_bind.service)"
 }
 
 function run {
diff --git a/test/units/testsuite-14.sh b/test/units/testsuite-14.sh
index 6eecf916a20..7a64d937361 100755
--- a/test/units/testsuite-14.sh
+++ b/test/units/testsuite-14.sh
@@ -21,18 +21,18 @@ r="$(pwd)/overwrite-broken-machine-id"
 setup_root "$r"
 systemd-machine-id-setup --print --root "$r"
 echo abc >>"$r/etc/machine-id"
-id=$(systemd-machine-id-setup --print --root "$r")
-echo $id >expected
+id="$(systemd-machine-id-setup --print --root "$r")"
+echo "$id" >expected
 check expected "$r/etc/machine-id"
 
-r="$(pwd)/transient-machine-id"
+r="$PWD/transient-machine-id"
 setup_root "$r"
 systemd-machine-id-setup --print --root "$r"
 echo abc >>"$r/etc/machine-id"
 mount -o remount,ro "$r"
 mount -t tmpfs tmpfs "$r/run"
-transient_id=$(systemd-machine-id-setup --print --root "$r")
+transient_id="$(systemd-machine-id-setup --print --root "$r")"
 mount -o remount,rw "$r"
-commited_id=$(systemd-machine-id-setup --print --commit --root "$r")
+commited_id="$(systemd-machine-id-setup --print --commit --root "$r")"
 [[ "$transient_id" = "$commited_id" ]]
 check "$r/etc/machine-id" "$r/run/machine-id"
diff --git a/test/units/testsuite-15.sh b/test/units/testsuite-15.sh
index 018ae8aab9b..23c2156501d 100755
--- a/test/units/testsuite-15.sh
+++ b/test/units/testsuite-15.sh
@@ -3,51 +3,53 @@ set -eux
 set -o pipefail
 
 _clear_service () {
-    systemctl stop $1.service 2>/dev/null || :
-    rm -f  /{etc,run,usr/lib}/systemd/system/$1.service
-    rm -fr /{etc,run,usr/lib}/systemd/system/$1.service.d
-    rm -fr /{etc,run,usr/lib}/systemd/system/$1.service.{wants,requires}
-    if [[ $1 == *@ ]]; then
-        systemctl stop $1*.service 2>/dev/null || :
-        rm -f  /{etc,run,usr/lib}/systemd/system/$1*.service
-        rm -fr /{etc,run,usr/lib}/systemd/system/$1*.service.d
-        rm -fr /{etc,run,usr/lib}/systemd/system/$1*.service.{wants,requires}
+    local SERVICE_NAME="${1:?_clear_service: missing argument}"
+    systemctl stop "$SERVICE_NAME.service" 2>/dev/null || :
+    rm -f  /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME".service
+    rm -fr /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME".service.d
+    rm -fr /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME".service.{wants,requires}
+    if [[ $SERVICE_NAME == *@ ]]; then
+        systemctl stop "$SERVICE_NAME"*.service 2>/dev/null || :
+        rm -f  /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME"*.service
+        rm -fr /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME"*.service.d
+        rm -fr /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME"*.service.{wants,requires}
     fi
 }
 
 clear_services () {
-    for u in $*; do
-        _clear_service $u
+    for u in "$@"; do
+        _clear_service "$u"
     done
     systemctl daemon-reload
 }
 
 create_service () {
-    clear_services $1
+    local SERVICE_NAME="${1:?create_service: missing argument}"
+    clear_services "$SERVICE_NAME"
 
-    cat >/etc/systemd/system/$1.service<<EOF
+    cat >/etc/systemd/system/"$SERVICE_NAME".service <<EOF
 [Unit]
-Description=$1 unit
+Description=$SERVICE_NAME unit
 
 [Service]
 ExecStart=/bin/sleep 100000
 EOF
-    mkdir -p /{etc,run,usr/lib}/systemd/system/$1.service.d
-    mkdir -p /etc/systemd/system/$1.service.{wants,requires}
-    mkdir -p /run/systemd/system/$1.service.{wants,requires}
-    mkdir -p /usr/lib/systemd/system/$1.service.{wants,requires}
+    mkdir -p /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME".service.d
+    mkdir -p /etc/systemd/system/"$SERVICE_NAME".service.{wants,requires}
+    mkdir -p /run/systemd/system/"$SERVICE_NAME".service.{wants,requires}
+    mkdir -p /usr/lib/systemd/system/"$SERVICE_NAME".service.{wants,requires}
 }
 
 create_services () {
-    for u in $*; do
-        create_service $u
+    for u in "$@"; do
+        create_service "$u"
     done
 }
 
 check_ok () {
     [ $# -eq 3 ] || return
 
-    x="$(systemctl show --value -p $2 $1)"
+    x="$(systemctl show --value -p "$2" "$1")"
     case "$x" in
         *$3*) return 0 ;;
         *)    return 1 ;;
diff --git a/test/units/testsuite-16.sh b/test/units/testsuite-16.sh
index 8d2117b4cf9..9f3a843da61 100755
--- a/test/units/testsuite-16.sh
+++ b/test/units/testsuite-16.sh
@@ -4,23 +4,21 @@ set -o pipefail
 
 rm -f /test.log
 
-TL=/test.log.XXXXXXXX
+TESTLOG=/test.log.XXXXXXXX
 
 function wait_for()
 {
-    service=${1}
-    result=${2:-success}
-    time=${3:-45}
+    local service="${1:-wait_for: missing service argument}"
+    local result="${2:-success}"
+    local time="${3:-45}"
 
-    while [[ ! -f /${service}.terminated && ! -f /${service}.success && $time -gt 0  ]]
-    do
+    while [[ ! -f /${service}.terminated && ! -f /${service}.success && $time -gt 0 ]]; do
         sleep 1
-        time=$(( $time - 1 ))
+        time=$((time - 1))
     done
 
-    if [[ ! -f /${service}.${result} ]]
-    then
-        journalctl -u ${service/_/-}.service >> "${TL}"
+    if [[ ! -f /${service}.${result} ]]; then
+        journalctl -u "${service/_/-}.service" >>"$TESTLOG"
     fi
 }
 
@@ -45,12 +43,11 @@ wait_for fail_start startfail
 wait_for fail_stop stopfail
 wait_for fail_runtime runtimefail
 
-if [[ -f "${TL}" ]]
-then
+if [[ -f "$TESTLOG" ]]; then
     # no mv
-    cp "${TL}" /test.log
+    cp "$TESTLOG" /test.log
     exit 1
-else
-    touch /testok
-    exit 0
 fi
+
+touch /testok
+exit 0
diff --git a/test/units/testsuite-17.sh b/test/units/testsuite-17.sh
index 3cf57550fc3..2ec9f6a8910 100755
--- a/test/units/testsuite-17.sh
+++ b/test/units/testsuite-17.sh
@@ -5,8 +5,8 @@ set -o pipefail
 
 >/failed
 
-for t in ${0%.sh}.*.sh; do
-    echo "Running $t"; ./$t
+for t in "${0%.sh}".*.sh; do
+    echo "Running $t"; ./"$t"
 done
 
 touch /testok
diff --git a/test/units/testsuite-20.sh b/test/units/testsuite-20.sh
index 56f07933a91..111713dabf1 100755
--- a/test/units/testsuite-20.sh
+++ b/test/units/testsuite-20.sh
@@ -140,7 +140,7 @@ systemd-run --unit=test20-mainpidsh3.service \
     && { echo 'unexpected success'; exit 1; }
 
 # Test that this failed due to timeout, and not some other error
-test $(systemctl show -P Result test20-mainpidsh3.service) = timeout
+test "$(systemctl show -P Result test20-mainpidsh3.service)" = timeout
 
 systemd-analyze log-level info
 
diff --git a/test/units/testsuite-22.02.sh b/test/units/testsuite-22.02.sh
index 5d1254db03e..94fa11ba886 100755
--- a/test/units/testsuite-22.02.sh
+++ b/test/units/testsuite-22.02.sh
@@ -21,10 +21,10 @@ d     /tmp/d/2    0755 daemon daemon - -
 EOF
 
 test -d /tmp/d/1
-test $(stat -c %U:%G:%a /tmp/d/1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/d/1)" = "daemon:daemon:755"
 
 test -d /tmp/d/2
-test $(stat -c %U:%G:%a /tmp/d/2) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/d/2)" = "daemon:daemon:755"
 
 #
 # 'D'
@@ -39,10 +39,10 @@ D     /tmp/D/2    0755 daemon daemon - -
 EOF
 
 test -d /tmp/D/1
-test $(stat -c %U:%G:%a /tmp/D/1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/D/1)" = "daemon:daemon:755"
 
 test -d /tmp/D/2
-test $(stat -c %U:%G:%a /tmp/D/2) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/D/2)" = "daemon:daemon:755"
 
 systemd-tmpfiles --remove - <<EOF
 D     /tmp/D/2    0755 daemon daemon - -
@@ -66,12 +66,12 @@ EOF
 test ! -d /tmp/e/1
 
 test -d /tmp/e/2
-test $(stat -c %U:%G:%a /tmp/e/2) = "root:root:777"
+test "$(stat -c %U:%G:%a /tmp/e/2)" = "root:root:777"
 
 test -d /tmp/e/2/d1
-test $(stat -c %U:%G:%a /tmp/e/2/d1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/e/2/d1)" = "daemon:daemon:755"
 test -d /tmp/e/2/d2
-test $(stat -c %U:%G:%a /tmp/e/2/d2) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/e/2/d2)" = "daemon:daemon:755"
 
 # 'e' operates on directories only
 mkdir -p /tmp/e/3/{d1,d2}
@@ -87,12 +87,12 @@ EOF
 # the directories should have been processed although systemd-tmpfiles failed
 # previously due to the presence of a file.
 test -d /tmp/e/3/d1
-test $(stat -c %U:%G:%a /tmp/e/3/d1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/e/3/d1)" = "daemon:daemon:755"
 test -d /tmp/e/3/d2
-test $(stat -c %U:%G:%a /tmp/e/3/d2) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/e/3/d2)" = "daemon:daemon:755"
 
 test -f /tmp/e/3/f1
-test $(stat -c %U:%G:%a /tmp/e/3/f1) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/e/3/f1)" = "root:root:644"
 
 #
 # 'C'
@@ -111,12 +111,12 @@ C     /tmp/C/2    0755 daemon daemon - /tmp/C/2-origin
 EOF
 
 test -d /tmp/C/1
-test $(stat -c %U:%G:%a /tmp/C/1/f1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/C/1/f1)" = "daemon:daemon:755"
 test -d /tmp/C/2
-test $(stat -c %U:%G:%a /tmp/C/2/f1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/C/2/f1)" = "daemon:daemon:755"
 
 systemd-tmpfiles --create - <<EOF
 C     /tmp/C/3    0755 daemon daemon - /tmp/C/3-origin
 EOF
 
-test $(stat -c %U:%G:%a /tmp/C/3/f1) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/C/3/f1)" = "root:root:644"
diff --git a/test/units/testsuite-22.03.sh b/test/units/testsuite-22.03.sh
index bb321c1c2f8..e4311dcfb65 100755
--- a/test/units/testsuite-22.03.sh
+++ b/test/units/testsuite-22.03.sh
@@ -20,9 +20,9 @@ EOF
 
 ### '1' should exist and be empty
 test -f /tmp/f/1; test ! -s /tmp/f/1
-test $(stat -c %U:%G:%a /tmp/f/1) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/f/1)" = "root:root:644"
 
-test $(stat -c %U:%G:%a /tmp/f/2) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/f/2)" = "root:root:644"
 test "$(< /tmp/f/2)" = "This string should be written"
 
 ### The perms are supposed to be updated even if the file already exists.
@@ -32,7 +32,7 @@ EOF
 
 # file should be empty
 test ! -s /tmp/f/1
-test $(stat -c %U:%G:%a /tmp/f/1) = "daemon:daemon:666"
+test "$(stat -c %U:%G:%a /tmp/f/1)" = "daemon:daemon:666"
 
 ### But we shouldn't try to set perms on an existing file which is not a
 ### regular one.
@@ -44,7 +44,7 @@ f     /tmp/f/fifo    0666 daemon daemon - This string should not be written
 EOF
 
 test -p /tmp/f/fifo
-test $(stat -c %U:%G:%a /tmp/f/fifo) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/f/fifo)" = "root:root:644"
 
 ### 'f' should not follow symlinks.
 ln -s missing /tmp/f/dangling
@@ -55,7 +55,7 @@ f     /tmp/f/dangling    0644 daemon daemon - -
 f     /tmp/f/symlink     0644 daemon daemon - -
 EOF
 test ! -e /tmp/f/missing
-test $(stat -c %U:%G:%a /tmp/file-owned-by-root) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/file-owned-by-root)" = "root:root:644"
 
 ### Handle read-only filesystem gracefully: we shouldn't fail if the target
 ### already exists and have the correct perms.
@@ -75,7 +75,7 @@ test -f /tmp/f/ro-fs/foo; test ! -s /tmp/f/ro-fs/foo
 systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
 f     /tmp/f/ro-fs/foo    0666 - - - -
 EOF
-test $(stat -c %U:%G:%a /tmp/f/fifo) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/f/fifo)" = "root:root:644"
 
 systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
 f     /tmp/f/ro-fs/bar    0644 - - - -
@@ -109,9 +109,9 @@ test -f /tmp/F/created; test ! -s /tmp/F/created
 test -f /tmp/F/created-with-content
 test "$(< /tmp/F/created-with-content)" = "new content"
 test -f /tmp/F/truncated; test ! -s /tmp/F/truncated
-test $(stat -c %U:%G:%a /tmp/F/truncated) = "daemon:daemon:666"
+test "$(stat -c %U:%G:%a /tmp/F/truncated)" = "daemon:daemon:666"
 test -s /tmp/F/truncated-with-content
-test $(stat -c %U:%G:%a /tmp/F/truncated-with-content) = "daemon:daemon:666"
+test "$(stat -c %U:%G:%a /tmp/F/truncated-with-content)" = "daemon:daemon:666"
 
 ### We shouldn't try to truncate anything but regular files since the behavior is
 ### unspecified in the other cases.
@@ -132,7 +132,7 @@ f     /tmp/F/dangling    0644 daemon daemon - -
 f     /tmp/F/symlink     0644 daemon daemon - -
 EOF
 test ! -e /tmp/F/missing
-test $(stat -c %U:%G:%a /tmp/file-owned-by-root) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/file-owned-by-root)" = "root:root:644"
 
 ### Handle read-only filesystem gracefully: we shouldn't fail if the target
 ### already exists and is empty.
@@ -165,7 +165,7 @@ grep -q 'truncating is not allowed' /tmp/F/ro-fs/foo
 systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
 F     /tmp/F/ro-fs/foo    0666 - - - -
 EOF
-test $(stat -c %U:%G:%a /tmp/F/ro-fs/foo) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/F/ro-fs/foo)" = "root:root:644"
 
 ### Try to create a new file.
 systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
diff --git a/test/units/testsuite-22.04.sh b/test/units/testsuite-22.04.sh
index 3298aa04ed9..d814ed87867 100755
--- a/test/units/testsuite-22.04.sh
+++ b/test/units/testsuite-22.04.sh
@@ -15,7 +15,7 @@ p     /tmp/p/fifo1    0666 - - - -
 EOF
 
 test -p /tmp/p/fifo1
-test $(stat -c %U:%G:%a /tmp/p/fifo1) = "root:root:666"
+test "$(stat -c %U:%G:%a /tmp/p/fifo1)" = "root:root:666"
 
 # Refuse to overwrite an existing file. Error is not propagated.
 systemd-tmpfiles --create - <<EOF
@@ -30,7 +30,7 @@ p+     /tmp/p/f1    0666 - - - -
 EOF
 
 test -p /tmp/p/f1
-test $(stat -c %U:%G:%a /tmp/p/f1) = "root:root:666"
+test "$(stat -c %U:%G:%a /tmp/p/f1)" = "root:root:666"
 
 #
 # Must be fixed
diff --git a/test/units/testsuite-22.05.sh b/test/units/testsuite-22.05.sh
index a1820089c01..eaabbc4517c 100755
--- a/test/units/testsuite-22.05.sh
+++ b/test/units/testsuite-22.05.sh
@@ -17,15 +17,15 @@ z     /tmp/z/f1    0755 daemon daemon - -
 z     /tmp/z/d1    0755 daemon daemon - -
 EOF
 
-test $(stat -c %U:%G /tmp/z/f1) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/z/d1) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/z/d1/f11) = "root:root"
+test "$(stat -c %U:%G /tmp/z/f1)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/z/d1)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/z/d1/f11)" = "root:root"
 
 systemd-tmpfiles --create - <<EOF
 z     /tmp/z/d2/*    0755 daemon daemon - -
 EOF
 
-test $(stat -c %U:%G /tmp/z/d2/f21) = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/z/d2/f21)" = "daemon:daemon"
 
 #
 # 'Z'
@@ -38,8 +38,8 @@ Z     /tmp/Z/f1    0755 daemon daemon - -
 Z     /tmp/Z/d1    0755 daemon daemon - -
 EOF
 
-test $(stat -c %U:%G /tmp/Z/f1) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/Z/d1) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/Z/d1/d11) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/Z/d1/f11) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/Z/d1/d11/f111) = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/Z/f1)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/Z/d1)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/Z/d1/d11)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/Z/d1/f11)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/Z/d1/d11/f111)" = "daemon:daemon"
diff --git a/test/units/testsuite-22.sh b/test/units/testsuite-22.sh
index 3cf57550fc3..2ec9f6a8910 100755
--- a/test/units/testsuite-22.sh
+++ b/test/units/testsuite-22.sh
@@ -5,8 +5,8 @@ set -o pipefail
 
 >/failed
 
-for t in ${0%.sh}.*.sh; do
-    echo "Running $t"; ./$t
+for t in "${0%.sh}".*.sh; do
+    echo "Running $t"; ./"$t"
 done
 
 touch /testok
diff --git a/test/units/testsuite-23.sh b/test/units/testsuite-23.sh
index c66ed262296..4ef7c878a83 100755
--- a/test/units/testsuite-23.sh
+++ b/test/units/testsuite-23.sh
@@ -21,8 +21,8 @@ systemd-run --unit=six -p Type=exec /tmp/brokenbinary && { echo 'unexpected succ
 
 systemd-run --unit=seven -p KillSignal=SIGTERM -p RestartKillSignal=SIGINT -p Type=exec /bin/sleep infinity
 # Both TERM and SIGINT happen to have the same number on all architectures
-test $(systemctl show --value -p KillSignal seven.service) -eq 15
-test $(systemctl show --value -p RestartKillSignal seven.service) -eq 2
+test "$(systemctl show --value -p KillSignal seven.service)" -eq 15
+test "$(systemctl show --value -p RestartKillSignal seven.service)" -eq 2
 
 systemctl restart seven.service
 systemctl stop seven.service
diff --git a/test/units/testsuite-36.sh b/test/units/testsuite-36.sh
index 46c08017d1b..6d3713c9623 100755
--- a/test/units/testsuite-36.sh
+++ b/test/units/testsuite-36.sh
@@ -55,7 +55,7 @@ stopJournalctl() {
     # the --sync wait until the synchronization is complete
     echo "Force journald to write all queued messages"
     journalctl --sync
-    journalctl -u $unit --cursor-file="$journalCursorFile" >"$journalLog"
+    journalctl -u "$unit" --cursor-file="$journalCursorFile" >"$journalLog"
 }
 
 checkNUMA() {
@@ -97,32 +97,38 @@ pid1ReloadWithJournal() {
 
 pid1StartUnitWithStrace() {
     startStrace '-f'
-    systemctl start $1
+    systemctl start "${1:?missing unit name}"
     sleep $sleepAfterStart
     stopStrace
 }
 
 pid1StartUnitWithJournal() {
     startJournalctl
-    systemctl start $1
+    systemctl start "${1:?missing unit name}"
     sleep $sleepAfterStart
     stopJournalctl
 }
 
 pid1StopUnit() {
-    systemctl stop $1
+    systemctl stop "${1:?missing unit name}"
 }
 
 systemctlCheckNUMAProperties() {
-    local LOGFILE="$(mktemp)"
-    systemctl show -p NUMAPolicy $1 >"$LOGFILE"
-    grep "NUMAPolicy=$2" "$LOGFILE"
+    local UNIT_NAME="${1:?missing unit name}"
+    local NUMA_POLICY="${2:?missing NUMAPolicy}"
+    local NUMA_MASK="${3:-""}"
+    local LOGFILE
 
-    >"$LOGFILE"
+    LOGFILE="$(mktemp)"
 
-    if [ -n "$3" ]; then
-        systemctl show -p NUMAMask $1 >"$LOGFILE"
-        grep "NUMAMask=$3" "$LOGFILE"
+    systemctl show -p NUMAPolicy "$UNIT_NAME" >"$LOGFILE"
+    grep "NUMAPolicy=$NUMA_POLICY" "$LOGFILE"
+
+    : >"$LOGFILE"
+
+    if [ -n "$NUMA_MASK" ]; then
+        systemctl show -p NUMAMask "$UNIT_NAME" >"$LOGFILE"
+        grep "NUMAMask=$NUMA_MASK" "$LOGFILE"
     fi
 }
 
@@ -145,10 +151,10 @@ if ! checkNUMA; then
     echo "systemd-run NUMAPolicy=default && NUMAMask=0 check without NUMA support"
     runUnit='numa-systemd-run-test.service'
     startJournalctl
-    systemd-run -p NUMAPolicy=default -p NUMAMask=0 --unit $runUnit sleep 1000
+    systemd-run -p NUMAPolicy=default -p NUMAMask=0 --unit "$runUnit" sleep 1000
     sleep $sleepAfterStart
-    pid1StopUnit $runUnit
-    stopJournalctl $runUnit
+    pid1StopUnit "$runUnit"
+    stopJournalctl "$runUnit"
     grep "NUMA support not available, ignoring" "$journalLog"
 
 else
@@ -156,43 +162,43 @@ else
     writePID1NUMAPolicy "default"
     pid1ReloadWithStrace
     # Kernel requires that nodemask argument is set to NULL when setting default policy
-    grep "set_mempolicy(MPOL_DEFAULT, NULL" $straceLog
+    grep "set_mempolicy(MPOL_DEFAULT, NULL" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Default policy w/ mask"
     writePID1NUMAPolicy "default" "0"
     pid1ReloadWithStrace
-    grep "set_mempolicy(MPOL_DEFAULT, NULL" $straceLog
+    grep "set_mempolicy(MPOL_DEFAULT, NULL" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Bind policy w/o mask"
     writePID1NUMAPolicy "bind"
     pid1ReloadWithJournal
-    grep "Failed to set NUMA memory policy: Invalid argument" $journalLog
+    grep "Failed to set NUMA memory policy: Invalid argument" "$journalLog"
 
     echo "PID1 NUMAPolicy support - Bind policy w/ mask"
     writePID1NUMAPolicy "bind" "0"
     pid1ReloadWithStrace
-    grep -P "set_mempolicy\(MPOL_BIND, \[0x0*1\]" $straceLog
+    grep -P "set_mempolicy\(MPOL_BIND, \[0x0*1\]" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Interleave policy w/o mask"
     writePID1NUMAPolicy "interleave"
     pid1ReloadWithJournal
-    grep "Failed to set NUMA memory policy: Invalid argument" $journalLog
+    grep "Failed to set NUMA memory policy: Invalid argument" "$journalLog"
 
     echo "PID1 NUMAPolicy support - Interleave policy w/ mask"
     writePID1NUMAPolicy "interleave" "0"
     pid1ReloadWithStrace
-    grep -P "set_mempolicy\(MPOL_INTERLEAVE, \[0x0*1\]" $straceLog
+    grep -P "set_mempolicy\(MPOL_INTERLEAVE, \[0x0*1\]" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Preferred policy w/o mask"
     writePID1NUMAPolicy "preferred"
     pid1ReloadWithJournal
     # Preferred policy with empty node mask is actually allowed and should reset allocation policy to default
-    ! grep "Failed to set NUMA memory policy: Invalid argument" $journalLog
+    grep "Failed to set NUMA memory policy: Invalid argument" "$journalLog" && { echo >&2 "unexpected pass"; exit 1; }
 
     echo "PID1 NUMAPolicy support - Preferred policy w/ mask"
     writePID1NUMAPolicy "preferred" "0"
     pid1ReloadWithStrace
-    grep -P "set_mempolicy\(MPOL_PREFERRED, \[0x0*1\]" $straceLog
+    grep -P "set_mempolicy\(MPOL_PREFERRED, \[0x0*1\]" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Local policy w/o mask"
     writePID1NUMAPolicy "local"
@@ -202,136 +208,133 @@ else
     # return a numerical constant instead (with a comment):
     #   set_mempolicy(0x4 /* MPOL_??? */, NULL, 0) = 0
     # Let's cover this scenario as well
-    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" $straceLog
+    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Local policy w/ mask"
     writePID1NUMAPolicy "local" "0"
     pid1ReloadWithStrace
-    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" $straceLog
+    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Default policy w/o mask"
     writeTestUnitNUMAPolicy "default"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "default"
-    pid1StopUnit $testUnit
-    grep "set_mempolicy(MPOL_DEFAULT, NULL" $straceLog
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "default"
+    pid1StopUnit "$testUnit"
+    grep "set_mempolicy(MPOL_DEFAULT, NULL" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Default policy w/ mask"
     writeTestUnitNUMAPolicy "default" "0"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "default" "0"
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "default" "0"
     pid1StopUnit $testUnit
     # Mask must be ignored
-    grep "set_mempolicy(MPOL_DEFAULT, NULL" $straceLog
+    grep "set_mempolicy(MPOL_DEFAULT, NULL" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Bind policy w/o mask"
     writeTestUnitNUMAPolicy "bind"
-    pid1StartUnitWithJournal $testUnit
-    pid1StopUnit $testUnit
-    grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" $journalLog
+    pid1StartUnitWithJournal "$testUnit"
+    pid1StopUnit "$testUnit"
+    grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" "$journalLog"
 
     echo "Unit file NUMAPolicy support - Bind policy w/ mask"
     writeTestUnitNUMAPolicy "bind" "0"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "bind" "0"
-    pid1StopUnit $testUnit
-    grep -P "set_mempolicy\(MPOL_BIND, \[0x0*1\]" $straceLog
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "bind" "0"
+    pid1StopUnit "$testUnit"
+    grep -P "set_mempolicy\(MPOL_BIND, \[0x0*1\]" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Interleave policy w/o mask"
     writeTestUnitNUMAPolicy "interleave"
-    pid1StartUnitWithStrace $testUnit
-    pid1StopUnit $testUnit
-    grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" $journalLog
+    pid1StartUnitWithStrace "$testUnit"
+    pid1StopUnit "$testUnit"
+    grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" "$journalLog"
 
     echo "Unit file NUMAPolicy support - Interleave policy w/ mask"
     writeTestUnitNUMAPolicy "interleave" "0"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "interleave" "0"
-    pid1StopUnit $testUnit
-    grep -P "set_mempolicy\(MPOL_INTERLEAVE, \[0x0*1\]" $straceLog
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "interleave" "0"
+    pid1StopUnit "$testUnit"
+    grep -P "set_mempolicy\(MPOL_INTERLEAVE, \[0x0*1\]" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Preferred policy w/o mask"
     writeTestUnitNUMAPolicy "preferred"
-    pid1StartUnitWithJournal $testUnit
-    systemctlCheckNUMAProperties $testUnit "preferred"
-    pid1StopUnit $testUnit
-    ! grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" $journalLog
+    pid1StartUnitWithJournal "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "preferred"
+    pid1StopUnit "$testUnit"
+    grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" "$journalLog" && { echo >&2 "unexpected pass"; exit 1; }
 
     echo "Unit file NUMAPolicy support - Preferred policy w/ mask"
     writeTestUnitNUMAPolicy "preferred" "0"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "preferred" "0"
-    pid1StopUnit $testUnit
-    grep -P "set_mempolicy\(MPOL_PREFERRED, \[0x0*1\]" $straceLog
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "preferred" "0"
+    pid1StopUnit "$testUnit"
+    grep -P "set_mempolicy\(MPOL_PREFERRED, \[0x0*1\]" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Local policy w/o mask"
     writeTestUnitNUMAPolicy "local"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "local"
-    pid1StopUnit $testUnit
-    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" $straceLog
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "local"
+    pid1StopUnit "$testUnit"
+    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Local policy w/ mask"
     writeTestUnitNUMAPolicy "local" "0"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "local" "0"
-    pid1StopUnit $testUnit
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "local" "0"
+    pid1StopUnit "$testUnit"
     # Mask must be ignored
-    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" $straceLog
+    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" "$straceLog"
 
     echo "Unit file CPUAffinity=NUMA support"
     writeTestUnitNUMAPolicy "bind" "0"
-    echo "CPUAffinity=numa" >>$testUnitNUMAConf
+    echo "CPUAffinity=numa" >>"$testUnitNUMAConf"
     systemctl daemon-reload
-    systemctl start $testUnit
-    systemctlCheckNUMAProperties $testUnit "bind" "0"
-    pid=$(systemctl show --value -p MainPID $testUnit)
-    cpulist=$(cat /sys/devices/system/node/node0/cpulist)
-    affinity_systemd=$(systemctl show --value -p CPUAffinity $testUnit)
-    [ $cpulist = $affinity_systemd ]
-    pid1StopUnit $testUnit
+    systemctl start "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "bind" "0"
+    cpulist="$(cat /sys/devices/system/node/node0/cpulist)"
+    affinity_systemd="$(systemctl show --value -p CPUAffinity "$testUnit")"
+    [ "$cpulist" = "$affinity_systemd" ]
+    pid1StopUnit "$testUnit"
 
     echo "systemd-run NUMAPolicy support"
     runUnit='numa-systemd-run-test.service'
 
-    systemd-run -p NUMAPolicy=default --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "default"
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=default --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "default"
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=default -p NUMAMask=0 --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "default" ""
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=default -p NUMAMask=0 --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "default" ""
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=bind -p NUMAMask=0 --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "bind" "0"
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=bind -p NUMAMask=0 --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "bind" "0"
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=interleave -p NUMAMask=0 --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "interleave" "0"
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=interleave -p NUMAMask=0 --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "interleave" "0"
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=preferred -p NUMAMask=0 --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "preferred" "0"
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=preferred -p NUMAMask=0 --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "preferred" "0"
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=local --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "local"
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=local --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "local"
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=local -p NUMAMask=0 --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "local" ""
-    pid1StopUnit $runUnit
-
-    systemd-run -p NUMAPolicy=local -p NUMAMask=0 -p CPUAffinity=numa --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "local" ""
-    systemctl cat $runUnit | grep -q 'CPUAffinity=numa'
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=local -p NUMAMask=0 --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "local" ""
+    pid1StopUnit "$runUnit"
 
+    systemd-run -p NUMAPolicy=local -p NUMAMask=0 -p CPUAffinity=numa --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "local" ""
+    systemctl cat "$runUnit" | grep -q 'CPUAffinity=numa'
+    pid1StopUnit "$runUnit"
 fi
 
 # Cleanup
-rm -rf $testDir
-rm -rf $confDir
+rm -rf "$confDir"
 systemctl daemon-reload
 
 systemd-analyze log-level info
diff --git a/test/units/testsuite-39.sh b/test/units/testsuite-39.sh
index 90da2bf5e18..3b0d893a4c0 100755
--- a/test/units/testsuite-39.sh
+++ b/test/units/testsuite-39.sh
@@ -18,12 +18,12 @@ ExecReload=/bin/false
 EOF
 
 systemctl daemon-reload
-systemctl start $SERVICE_NAME
-systemctl status $SERVICE_NAME
+systemctl start "$SERVICE_NAME"
+systemctl status "$SERVICE_NAME"
 # The reload SHOULD fail but SHOULD NOT affect the service state
-systemctl reload $SERVICE_NAME && { echo 'unexpected success'; exit 1; }
-systemctl status $SERVICE_NAME
-systemctl stop $SERVICE_NAME
+systemctl reload "$SERVICE_NAME" && { echo 'unexpected success'; exit 1; }
+systemctl status "$SERVICE_NAME"
+systemctl stop "$SERVICE_NAME"
 
 
 echo "[#2] Failing ExecReload= should not kill the service (multiple ExecReload=)"
@@ -36,12 +36,12 @@ ExecReload=/bin/true
 EOF
 
 systemctl daemon-reload
-systemctl start $SERVICE_NAME
-systemctl status $SERVICE_NAME
+systemctl start "$SERVICE_NAME"
+systemctl status "$SERVICE_NAME"
 # The reload SHOULD fail but SHOULD NOT affect the service state
-systemctl reload $SERVICE_NAME && { echo 'unexpected success'; exit 1; }
-systemctl status $SERVICE_NAME
-systemctl stop $SERVICE_NAME
+systemctl reload "$SERVICE_NAME" && { echo 'unexpected success'; exit 1; }
+systemctl status "$SERVICE_NAME"
+systemctl stop "$SERVICE_NAME"
 
 echo "[#3] Failing ExecReload=- should not affect reload's exit code"
 cat >"$SERVICE_PATH" <<EOF
@@ -51,11 +51,11 @@ ExecReload=-/bin/false
 EOF
 
 systemctl daemon-reload
-systemctl start $SERVICE_NAME
-systemctl status $SERVICE_NAME
-systemctl reload $SERVICE_NAME
-systemctl status $SERVICE_NAME
-systemctl stop $SERVICE_NAME
+systemctl start "$SERVICE_NAME"
+systemctl status "$SERVICE_NAME"
+systemctl reload "$SERVICE_NAME"
+systemctl status "$SERVICE_NAME"
+systemctl stop "$SERVICE_NAME"
 
 systemd-analyze log-level info
 
diff --git a/test/units/testsuite-46.sh b/test/units/testsuite-46.sh
index 686c7f5bc9b..808270f33d9 100755
--- a/test/units/testsuite-46.sh
+++ b/test/units/testsuite-46.sh
@@ -14,8 +14,9 @@ inspect() {
     # avoid unexpected fails. To see the full outputs of both homectl &
     # userdbctl (for debugging purposes) drop the fields just before the
     # comparison.
-    homectl inspect $1 | tee /tmp/a
-    userdbctl user $1 | tee /tmp/b
+    local USERNAME="${1:?missing argument}"
+    homectl inspect "$USERNAME" | tee /tmp/a
+    userdbctl user "$USERNAME" | tee /tmp/b
 
     diff -I '/^\s*Disk (Size|Free|Floor|Ceiling):/' /tmp/{a,b}
     rm /tmp/{a,b}
diff --git a/test/units/testsuite-50.sh b/test/units/testsuite-50.sh
index 8067997a9df..505d93c13bf 100755
--- a/test/units/testsuite-50.sh
+++ b/test/units/testsuite-50.sh
@@ -26,48 +26,48 @@ trap cleanup EXIT
 
 cp /usr/share/minimal* "${image_dir}/"
 image="${image_dir}/minimal_0"
-roothash="$(cat ${image}.roothash)"
+roothash="$(cat "${image}.roothash")"
 
-os_release=$(test -e /etc/os-release && echo /etc/os-release || echo /usr/lib/os-release)
+os_release="$(test -e /etc/os-release && echo /etc/os-release || echo /usr/lib/os-release)"
 
-systemd-dissect --json=short ${image}.raw | grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
-systemd-dissect ${image}.raw | grep -q -F "MARKER=1"
-systemd-dissect ${image}.raw | grep -q -F -f <(sed 's/"//g' $os_release)
+systemd-dissect --json=short "${image}.raw" | grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
+systemd-dissect "${image}.raw" | grep -q -F "MARKER=1"
+systemd-dissect "${image}.raw" | grep -q -F -f <(sed 's/"//g' "$os_release")
 
-mv ${image}.verity ${image}.fooverity
-mv ${image}.roothash ${image}.foohash
-systemd-dissect --json=short ${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity | grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
-systemd-dissect ${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity | grep -q -F "MARKER=1"
-systemd-dissect ${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity | grep -q -F -f <(sed 's/"//g' $os_release)
-mv ${image}.fooverity ${image}.verity
-mv ${image}.foohash ${image}.roothash
+mv "${image}.verity" "${image}.fooverity"
+mv "${image}.roothash" "${image}.foohash"
+systemd-dissect --json=short "${image}.raw" --root-hash="${roothash}" --verity-data="${image}.fooverity" | grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
+systemd-dissect "${image}.raw" --root-hash="${roothash}" --verity-data="${image}.fooverity" | grep -q -F "MARKER=1"
+systemd-dissect "${image}.raw" --root-hash="${roothash}" --verity-data="${image}.fooverity" | grep -q -F -f <(sed 's/"//g' "$os_release")
+mv "${image}.fooverity" "${image}.verity"
+mv "${image}.foohash" "${image}.roothash"
 
-mkdir -p ${image_dir}/mount ${image_dir}/mount2
-systemd-dissect --mount ${image}.raw ${image_dir}/mount
-cat ${image_dir}/mount/usr/lib/os-release | grep -q -F -f $os_release
-cat ${image_dir}/mount/etc/os-release | grep -q -F -f $os_release
-cat ${image_dir}/mount/usr/lib/os-release | grep -q -F "MARKER=1"
+mkdir -p "${image_dir}/mount" "${image_dir}/mount2"
+systemd-dissect --mount "${image}.raw" "${image_dir}/mount"
+grep -q -F -f "$os_release" "${image_dir}/mount/usr/lib/os-release"
+grep -q -F -f "$os_release" "${image_dir}/mount/etc/os-release"
+grep -q -F "MARKER=1" "${image_dir}/mount/usr/lib/os-release"
 # Verity volume should be shared (opened only once)
-systemd-dissect --mount ${image}.raw ${image_dir}/mount2
-verity_count=$(ls -1 /dev/mapper/ | grep -c verity)
+systemd-dissect --mount "${image}.raw" "${image_dir}/mount2"
+verity_count=$(find /dev/mapper/ -name "*verity*" | wc -l)
 # In theory we should check that count is exactly one. In practice, libdevmapper
 # randomly and unpredictably fails with an unhelpful EINVAL when a device is open
 # (and even mounted and in use), so best-effort is the most we can do for now
-if [ ${verity_count} -lt 1 ]; then
+if [ "${verity_count}" -lt 1 ]; then
     echo "Verity device ${image}.raw not found in /dev/mapper/"
     exit 1
 fi
-umount ${image_dir}/mount
-umount ${image_dir}/mount2
+umount "${image_dir}/mount"
+umount "${image_dir}/mount2"
 
-systemd-run -t -p RootImage=${image}.raw cat /usr/lib/os-release | grep -q -F "MARKER=1"
-mv ${image}.verity ${image}.fooverity
-mv ${image}.roothash ${image}.foohash
-systemd-run -t -p RootImage=${image}.raw -p RootHash=${image}.foohash -p RootVerity=${image}.fooverity cat /usr/lib/os-release | grep -q -F "MARKER=1"
+systemd-run -t -p RootImage="${image}.raw" cat /usr/lib/os-release | grep -q -F "MARKER=1"
+mv "${image}.verity" "${image}.fooverity"
+mv "${image}.roothash" "${image}.foohash"
+systemd-run -t -p RootImage="${image}.raw" -p RootHash="${image}.foohash" -p RootVerity="${image}.fooverity" cat /usr/lib/os-release | grep -q -F "MARKER=1"
 # Let's use the long option name just here as a test
-systemd-run -t --property RootImage=${image}.raw --property RootHash=${roothash} --property RootVerity=${image}.fooverity cat /usr/lib/os-release | grep -q -F "MARKER=1"
-mv ${image}.fooverity ${image}.verity
-mv ${image}.foohash ${image}.roothash
+systemd-run -t --property RootImage="${image}.raw" --property RootHash="${roothash}" --property RootVerity="${image}.fooverity" cat /usr/lib/os-release | grep -q -F "MARKER=1"
+mv "${image}.fooverity" "${image}.verity"
+mv "${image}.foohash" "${image}.roothash"
 
 # Make a GPT disk on the fly, with the squashfs as partition 1 and the verity hash tree as partition 2
 machine="$(uname -m)"
@@ -100,51 +100,54 @@ else
     exit 1
 fi
 # du rounds up to block size, which is more helpful for partitioning
-root_size="$(du -k ${image}.raw | cut -f1)"
-verity_size="$(du -k ${image}.verity | cut -f1)"
+root_size="$(du -k "${image}.raw" | cut -f1)"
+verity_size="$(du -k "${image}.verity" | cut -f1)"
 # 4MB seems to be the minimum size blkid will accept, below that probing fails
-dd if=/dev/zero of=${image}.gpt bs=512 count=$((8192+${root_size}*2+${verity_size}*2))
+dd if=/dev/zero of="${image}.gpt" bs=512 count=$((8192+root_size*2+verity_size*2))
 # sfdisk seems unhappy if the size overflows into the next unit, eg: 1580KiB will be interpreted as 1MiB
 # so do some basic rounding up if the minimal image is more than 1 MB
-if [ ${root_size} -ge 1024 ]; then
-    root_size="$((${root_size}/1024 + 1))MiB"
+if [ "${root_size}" -ge 1024 ]; then
+    root_size="$((root_size/1024 + 1))MiB"
 else
     root_size="${root_size}KiB"
 fi
-verity_size="$((${verity_size} * 2))KiB"
-uuid="$(head -c 32 ${image}.roothash | cut -c -8)-$(head -c 32 ${image}.roothash | cut -c 9-12)-$(head -c 32 ${image}.roothash | cut -c 13-16)-$(head -c 32 ${image}.roothash | cut -c 17-20)-$(head -c 32 ${image}.roothash | cut -c 21-)"
-echo -e "label: gpt\nsize=${root_size}, type=${root_guid}, uuid=${uuid}" | sfdisk ${image}.gpt
-uuid="$(tail -c 32 ${image}.roothash | cut -c -8)-$(tail -c 32 ${image}.roothash | cut -c 9-12)-$(tail -c 32 ${image}.roothash | cut -c 13-16)-$(tail -c 32 ${image}.roothash | cut -c 17-20)-$(tail -c 32 ${image}.roothash | cut -c 21-)"
-echo -e "size=${verity_size}, type=${verity_guid}, uuid=${uuid}" | sfdisk ${image}.gpt --append
-sfdisk --part-label ${image}.gpt 1 "Root Partition"
-sfdisk --part-label ${image}.gpt 2 "Verity Partition"
-loop="$(losetup --show -P -f ${image}.gpt)"
-dd if=${image}.raw of=${loop}p1
-dd if=${image}.verity of=${loop}p2
-losetup -d ${loop}
+verity_size="$((verity_size * 2))KiB"
+# Construct a UUID from hash
+# input:  11111111222233334444555566667777
+# output: 11111111-2222-3333-4444-555566667777
+uuid="$(head -c 32 "${image}.roothash" | sed -r 's/(.{8})(.{4})(.{4})(.{4})(.+)/\1-\2-\3-\4-\5/')"
+echo -e "label: gpt\nsize=${root_size}, type=${root_guid}, uuid=${uuid}" | sfdisk "${image}.gpt"
+uuid="$(tail -c 32 "${image}.roothash" | sed -r 's/(.{8})(.{4})(.{4})(.{4})(.+)/\1-\2-\3-\4-\5/')"
+echo -e "size=${verity_size}, type=${verity_guid}, uuid=${uuid}" | sfdisk "${image}.gpt" --append
+sfdisk --part-label "${image}.gpt" 1 "Root Partition"
+sfdisk --part-label "${image}.gpt" 2 "Verity Partition"
+loop="$(losetup --show -P -f "${image}.gpt")"
+dd if="${image}.raw" of="${loop}p1"
+dd if="${image}.verity" of="${loop}p2"
+losetup -d "${loop}"
 
 # Derive partition UUIDs from root hash, in UUID syntax
-ROOT_UUID=$(systemd-id128 -u show $(head -c 32 ${image}.roothash) -u | tail -n 1 | cut -b 6-)
-VERITY_UUID=$(systemd-id128 -u show $(tail -c 32 ${image}.roothash) -u | tail -n 1 | cut -b 6-)
+ROOT_UUID="$(systemd-id128 -u show "$(head -c 32 "${image}.roothash")" -u | tail -n 1 | cut -b 6-)"
+VERITY_UUID="$(systemd-id128 -u show "$(tail -c 32 "${image}.roothash")" -u | tail -n 1 | cut -b 6-)"
 
-systemd-dissect --json=short --root-hash ${roothash} ${image}.gpt | grep -q '{"rw":"ro","designator":"root","partition_uuid":"'$ROOT_UUID'","partition_label":"Root Partition","fstype":"squashfs","architecture":"'$architecture'","verity":"yes","node":'
-systemd-dissect --json=short --root-hash ${roothash} ${image}.gpt | grep -q '{"rw":"ro","designator":"root-verity","partition_uuid":"'$VERITY_UUID'","partition_label":"Verity Partition","fstype":"DM_verity_hash","architecture":"'$architecture'","verity":null,"node":'
-systemd-dissect --root-hash ${roothash} ${image}.gpt | grep -q -F "MARKER=1"
-systemd-dissect --root-hash ${roothash} ${image}.gpt | grep -q -F -f <(sed 's/"//g' $os_release)
+systemd-dissect --json=short --root-hash "${roothash}" "${image}.gpt" | grep -q '{"rw":"ro","designator":"root","partition_uuid":"'"$ROOT_UUID"'","partition_label":"Root Partition","fstype":"squashfs","architecture":"'"$architecture"'","verity":"yes","node":'
+systemd-dissect --json=short --root-hash "${roothash}" "${image}.gpt" | grep -q '{"rw":"ro","designator":"root-verity","partition_uuid":"'"$VERITY_UUID"'","partition_label":"Verity Partition","fstype":"DM_verity_hash","architecture":"'"$architecture"'","verity":null,"node":'
+systemd-dissect --root-hash "${roothash}" "${image}.gpt" | grep -q -F "MARKER=1"
+systemd-dissect --root-hash "${roothash}" "${image}.gpt" | grep -q -F -f <(sed 's/"//g' "$os_release")
 
-systemd-dissect --root-hash ${roothash} --mount ${image}.gpt ${image_dir}/mount
-cat ${image_dir}/mount/usr/lib/os-release | grep -q -F -f $os_release
-cat ${image_dir}/mount/etc/os-release | grep -q -F -f $os_release
-cat ${image_dir}/mount/usr/lib/os-release | grep -q -F "MARKER=1"
-umount ${image_dir}/mount
+systemd-dissect --root-hash "${roothash}" --mount "${image}.gpt" "${image_dir}/mount"
+grep -q -F -f "$os_release" "${image_dir}/mount/usr/lib/os-release"
+grep -q -F -f "$os_release" "${image_dir}/mount/etc/os-release"
+grep -q -F "MARKER=1" "${image_dir}/mount/usr/lib/os-release"
+umount "${image_dir}/mount"
 
 # add explicit -p MountAPIVFS=yes once to test the parser
-systemd-run -t -p RootImage=${image}.gpt -p RootHash=${roothash} -p MountAPIVFS=yes cat /usr/lib/os-release | grep -q -F "MARKER=1"
+systemd-run -t -p RootImage="${image}.gpt" -p RootHash="${roothash}" -p MountAPIVFS=yes cat /usr/lib/os-release | grep -q -F "MARKER=1"
 
-systemd-run -t -p RootImage=${image}.raw -p RootImageOptions="root:nosuid,dev home:ro,dev ro,noatime" mount | grep -F "squashfs" | grep -q -F "nosuid"
-systemd-run -t -p RootImage=${image}.gpt -p RootImageOptions="root:ro,noatime root:ro,dev" mount | grep -F "squashfs" | grep -q -F "noatime"
+systemd-run -t -p RootImage="${image}.raw" -p RootImageOptions="root:nosuid,dev home:ro,dev ro,noatime" mount | grep -F "squashfs" | grep -q -F "nosuid"
+systemd-run -t -p RootImage="${image}.gpt" -p RootImageOptions="root:ro,noatime root:ro,dev" mount | grep -F "squashfs" | grep -q -F "noatime"
 
-mkdir -p mkdir -p ${image_dir}/result
+mkdir -p "${image_dir}/result"
 cat >/run/systemd/system/testservice-50a.service <<EOF
 [Service]
 Type=oneshot
@@ -156,8 +159,8 @@ RootImageOptions=root:ro,noatime home:ro,dev relatime,dev
 RootImageOptions=nosuid,dev
 EOF
 systemctl start testservice-50a.service
-grep -F "squashfs" ${image_dir}/result/a | grep -q -F "noatime"
-grep -F "squashfs" ${image_dir}/result/a | grep -q -F -v "nosuid"
+grep -F "squashfs" "${image_dir}/result/a" | grep -q -F "noatime"
+grep -F "squashfs" "${image_dir}/result/a" | grep -q -F -v "nosuid"
 
 cat >/run/systemd/system/testservice-50b.service <<EOF
 [Service]
@@ -172,7 +175,7 @@ RootImageOptions=home:ro,dev nosuid,dev,%%foo
 MountAPIVFS=yes
 EOF
 systemctl start testservice-50b.service
-grep -F "squashfs" ${image_dir}/result/b | grep -q -F "noatime"
+grep -F "squashfs" "${image_dir}/result/b" | grep -q -F "noatime"
 
 # Check that specifier escape is applied %%foo → %foo
 busctl get-property org.freedesktop.systemd1 /org/freedesktop/systemd1/unit/testservice_2d50b_2eservice org.freedesktop.systemd1.Service RootImageOptions | grep -F "nosuid,dev,%foo"
@@ -184,9 +187,9 @@ systemd-run -t -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2:nos
 systemd-run -t -p MountImages="${image}.gpt:/run/img1:root:nosuid ${image}.raw:/run/img2:home:suid" mount | grep -F "squashfs" | grep -q -F "nosuid"
 systemd-run -t -p MountImages="${image}.raw:/run/img2\:3" cat /run/img2:3/usr/lib/os-release | grep -q -F "MARKER=1"
 systemd-run -t -p MountImages="${image}.raw:/run/img2\:3:nosuid" mount | grep -F "squashfs" | grep -q -F "nosuid"
-systemd-run -t -p TemporaryFileSystem=/run -p RootImage=${image}.raw -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /usr/lib/os-release | grep -q -F "MARKER=1"
-systemd-run -t -p TemporaryFileSystem=/run -p RootImage=${image}.raw -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img1/usr/lib/os-release | grep -q -F "MARKER=1"
-systemd-run -t -p TemporaryFileSystem=/run -p RootImage=${image}.gpt -p RootHash=${roothash} -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img2/usr/lib/os-release | grep -q -F "MARKER=1"
+systemd-run -t -p TemporaryFileSystem=/run -p RootImage="${image}.raw" -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /usr/lib/os-release | grep -q -F "MARKER=1"
+systemd-run -t -p TemporaryFileSystem=/run -p RootImage="${image}.raw" -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img1/usr/lib/os-release | grep -q -F "MARKER=1"
+systemd-run -t -p TemporaryFileSystem=/run -p RootImage="${image}.gpt" -p RootHash="${roothash}" -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img2/usr/lib/os-release | grep -q -F "MARKER=1"
 cat >/run/systemd/system/testservice-50c.service <<EOF
 [Service]
 MountAPIVFS=yes
@@ -201,9 +204,9 @@ BindPaths=${image_dir}/result:/run/result
 Type=oneshot
 EOF
 systemctl start testservice-50c.service
-grep -q -F "MARKER=1" ${image_dir}/result/c
-grep -F "squashfs" ${image_dir}/result/c | grep -q -F "noatime"
-grep -F "squashfs" ${image_dir}/result/c | grep -q -F -v "nosuid"
+grep -q -F "MARKER=1" "${image_dir}/result/c"
+grep -F "squashfs" "${image_dir}/result/c" | grep -q -F "noatime"
+grep -F "squashfs" "${image_dir}/result/c" | grep -q -F -v "nosuid"
 
 # Adding a new mounts at runtime works if the unit is in the active state,
 # so use Type=notify to make sure there's no race condition in the test
@@ -218,7 +221,7 @@ ExecStart=/bin/sh -c 'systemd-notify --ready; while ! grep -q -F MARKER /tmp/img
 EOF
 systemctl start testservice-50d.service
 
-systemctl mount-image --mkdir testservice-50d.service ${image}.raw /tmp/img root:nosuid
+systemctl mount-image --mkdir testservice-50d.service "${image}.raw" /tmp/img root:nosuid
 
 while systemctl show -P SubState testservice-50d.service | grep -q running
 do
@@ -228,12 +231,12 @@ done
 systemctl is-active testservice-50d.service
 
 # ExtensionImages will set up an overlay
-systemd-run -t --property ExtensionImages=/usr/share/app0.raw --property RootImage=${image}.raw cat /opt/script0.sh | grep -q -F "extension-release.app0"
-systemd-run -t --property ExtensionImages=/usr/share/app0.raw --property RootImage=${image}.raw cat /usr/lib/systemd/system/some_file | grep -q -F "MARKER=1"
-systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage=${image}.raw cat /opt/script0.sh | grep -q -F "extension-release.app0"
-systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage=${image}.raw cat /usr/lib/systemd/system/some_file | grep -q -F "MARKER=1"
-systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage=${image}.raw cat /opt/script1.sh | grep -q -F "extension-release.app1"
-systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage=${image}.raw cat /usr/lib/systemd/system/other_file | grep -q -F "MARKER=1"
+systemd-run -t --property ExtensionImages=/usr/share/app0.raw --property RootImage="${image}.raw" cat /opt/script0.sh | grep -q -F "extension-release.app0"
+systemd-run -t --property ExtensionImages=/usr/share/app0.raw --property RootImage="${image}.raw" cat /usr/lib/systemd/system/some_file | grep -q -F "MARKER=1"
+systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage="${image}.raw" cat /opt/script0.sh | grep -q -F "extension-release.app0"
+systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage="${image}.raw" cat /usr/lib/systemd/system/some_file | grep -q -F "MARKER=1"
+systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage="${image}.raw" cat /opt/script1.sh | grep -q -F "extension-release.app1"
+systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage="${image}.raw" cat /usr/lib/systemd/system/other_file | grep -q -F "MARKER=1"
 cat >/run/systemd/system/testservice-50e.service <<EOF
 [Service]
 MountAPIVFS=yes
diff --git a/test/units/testsuite-55-slowgrowth.sh b/test/units/testsuite-55-slowgrowth.sh
index ed4ec6d6e4a..918ed6c3416 100755
--- a/test/units/testsuite-55-slowgrowth.sh
+++ b/test/units/testsuite-55-slowgrowth.sh
@@ -10,26 +10,28 @@ BLOAT_HOLDER=()
 PID="$$"
 
 function bloat {
-        local set_size=$(cat "/proc/$PID/statm" | cut -d " " -f2)
-        local mem_usage=$(( "$set_size" * "$PAGE_SIZE" ))
-        local target_mem_size=$(( "$mem_usage" + "$1" ))
+        local set_size mem_usage target_mem_size
+
+        set_size=$(cut -d " " -f2 "/proc/$PID/statm")
+        mem_usage=$(( "$set_size" * "$PAGE_SIZE" ))
+        target_mem_size=$(( "$mem_usage" + "$1" ))
 
         BLOAT_HOLDER=()
         while [[ "$mem_usage" -lt "$target_mem_size" ]]; do
                 echo "target $target_mem_size"
                 echo "mem usage $mem_usage"
-                BLOAT_HOLDER+=( $(printf "%0.sg" {1..1000000}) )
-                set_size=$(cat "/proc/$PID/statm" | cut -d " " -f2)
-                mem_usage=$(( "$set_size" * "$PAGE_SIZE" ))
+                BLOAT_HOLDER+=("$(printf "=%0.s" {1..1000000})")
+                set_size=$(cut -d " " -f2 "/proc/$PID/statm")
+                mem_usage=$(("$set_size" * "$PAGE_SIZE"))
         done
 }
 
 function run {
         local arr=()
 
-        while [[ true ]]; do
+        while :; do
                 bloat "$BLOAT_ITERATION_TARGET"
-                arr+=( "$BLOAT_HOLDER" )
+                arr+=("${BLOAT_HOLDER[@]}")
                 sleep 1
         done
 }
diff --git a/test/units/testsuite-55.sh b/test/units/testsuite-55.sh
index 25c7f8cc63a..63549c8a785 100755
--- a/test/units/testsuite-55.sh
+++ b/test/units/testsuite-55.sh
@@ -7,14 +7,17 @@ systemd-analyze log-target console
 
 # Loose checks to ensure the environment has the necessary features for systemd-oomd
 [[ -e /proc/pressure ]] || echo "no PSI" >>/skipped
-cgroup_type=$(stat -fc %T /sys/fs/cgroup/)
+cgroup_type="$(stat -fc %T /sys/fs/cgroup/)"
 if [[ "$cgroup_type" != *"cgroup2"* ]] && [[ "$cgroup_type" != *"0x63677270"* ]]; then
     echo "no cgroup2" >>/skipped
 fi
 if [ ! -f /usr/lib/systemd/systemd-oomd ] && [ ! -f /lib/systemd/systemd-oomd ]; then
     echo "no oomd" >>/skipped
 fi
-[[ -e /skipped ]] && exit 0 || true
+
+if [[ -e /skipped ]]; then
+    exit 0
+fi
 
 rm -rf /etc/systemd/system/testsuite-55-testbloat.service.d
 
@@ -30,7 +33,7 @@ oomctl | grep "Default Memory Pressure Duration: 5s"
 
 # systemd-oomd watches for elevated pressure for 5 seconds before acting.
 # It can take time to build up pressure so either wait 2 minutes or for the service to fail.
-timeout=$(date -ud "2 minutes" +%s)
+timeout="$(date -ud "2 minutes" +%s)"
 while [[ $(date -u +%s) -le $timeout ]]; do
     if ! systemctl status testsuite-55-testbloat.service; then
         break
@@ -55,8 +58,8 @@ if setfattr -n user.xattr_test -v 1 /sys/fs/cgroup/; then
     systemctl start testsuite-55-testmunch.service
     systemctl start testsuite-55-testbloat.service
 
-    timeout=$(date -ud "2 minutes" +%s)
-    while [[ $(date -u +%s) -le $timeout ]]; do
+    timeout="$(date -ud "2 minutes" +%s)"
+    while [[ "$(date -u +%s)" -le "$timeout" ]]; do
         if ! systemctl status testsuite-55-testmunch.service; then
             break
         fi