diff --git a/build_docker.sh b/build_docker.sh
index 30e00d37f..8c134fbc5 100755
--- a/build_docker.sh
+++ b/build_docker.sh
@@ -20,9 +20,9 @@
 set -eu
 
 # Use the "go" binary from the "tool" directory (which is github.com/tailscale/go)
-export PATH=$PWD/tool:$PATH
+export PATH="$PWD"/tool:"$PATH"
 
-eval $(./build_dist.sh shellvars)
+eval "$(./build_dist.sh shellvars)"
 
 DEFAULT_TARGET="client"
 DEFAULT_TAGS="v${VERSION_SHORT},v${VERSION_MINOR}"
@@ -74,4 +74,4 @@ case "$TARGET" in
     echo "unknown target: $TARGET"
     exit 1
     ;;
-esac
\ No newline at end of file
+esac
diff --git a/update-flake.sh b/update-flake.sh
index af31c9775..4561183b8 100755
--- a/update-flake.sh
+++ b/update-flake.sh
@@ -3,14 +3,12 @@
 
 set -eu
 
-REV=$(cat go.toolchain.rev)
-
 OUT=$(mktemp -d -t nar-hash-XXXXXX)
-rm -rf $OUT
+rm -rf "$OUT"
 
-./tool/go mod vendor -o $OUT
-./tool/go run tailscale.com/cmd/nardump --sri $OUT >go.mod.sri
-rm -rf $OUT
+./tool/go mod vendor -o "$OUT"
+./tool/go run tailscale.com/cmd/nardump --sri "$OUT" >go.mod.sri
+rm -rf "$OUT"
 
 # nix-direnv only watches the top-level nix file for changes. As a
 # result, when we change a referenced SRI file, we have to cause some