diff --git a/test/000_unit_syntax.bats b/test/000_unit_syntax.bats
index e115281..2bb1ee3 100644
--- a/test/000_unit_syntax.bats
+++ b/test/000_unit_syntax.bats
@@ -7,5 +7,5 @@ load_fixtures
   "
 
   #; check the syntax of yadm
-  bash -n $T_YADM
+  bash -n "$T_YADM"
 }
diff --git a/test/001_unit_configure_paths.bats b/test/001_unit_configure_paths.bats
index 4904fba..9bd6703 100644
--- a/test/001_unit_configure_paths.bats
+++ b/test/001_unit_configure_paths.bats
@@ -11,8 +11,10 @@ load_fixtures
            GIT_DIR=$DEFAULT_YADM_DIR/$DEFAULT_REPO
   "
 
+  # shellcheck source=/dev/null
+
   #; load yadm functions
-  YADM_TEST=1 source $T_YADM
+  YADM_TEST=1 source "$T_YADM"
 
   #; configure the paths
   configure_paths
@@ -42,12 +44,14 @@ load_fixtures
            GIT_DIR=$T_DIR_YADM/$DEFAULT_REPO
   "
 
+  # shellcheck source=/dev/null
+
   #; load yadm functions
-  YADM_TEST=1 source $T_YADM
+  YADM_TEST=1 source "$T_YADM"
 
   #; configure the paths
   TEST_ARGS=(-Y $T_DIR_YADM)
-  process_global_args ${TEST_ARGS[*]}
+  process_global_args "${TEST_ARGS[@]}"
   configure_paths
 
   echo "CONFIGURED PATHS:"
diff --git a/test/002_unit_yadm_dir.bats b/test/002_unit_yadm_dir.bats
index d223bf6..178d237 100644
--- a/test/002_unit_yadm_dir.bats
+++ b/test/002_unit_yadm_dir.bats
@@ -6,8 +6,10 @@ load_fixtures
     YADM_DIR should default to \$HOME/.yadm
   "
 
+  # shellcheck source=/dev/null
+
   #; load yadm functions
-  YADM_TEST=1 source $T_YADM
+  YADM_TEST=1 source "$T_YADM"
 
   #; test value of YADM_DIR
   [ "$HOME/.yadm" = "$YADM_DIR" ]
@@ -19,12 +21,14 @@ load_fixtures
     YADM_DIR should become $T_DIR_YADM
   "
 
+  # shellcheck source=/dev/null
+
   #; load yadm functions
-  YADM_TEST=1 source $T_YADM
+  YADM_TEST=1 source "$T_YADM"
 
   #; call process_global_args() with -Y
   TEST_ARGS=(-Y $T_DIR_YADM)
-  process_global_args ${TEST_ARGS[*]}
+  process_global_args "${TEST_ARGS[@]}"
 
   #; test value of YADM_DIR
   [ "$T_DIR_YADM" = "$YADM_DIR" ]
diff --git a/test/100_accept_version.bats b/test/100_accept_version.bats
index da7a6e5..8c9b219 100644
--- a/test/100_accept_version.bats
+++ b/test/100_accept_version.bats
@@ -1,5 +1,6 @@
 load common
 load_fixtures
+status=;output=; #; populated by bats run()
 
 @test "Command 'version'" {
   echo "
@@ -9,10 +10,12 @@ load_fixtures
   "
 
   #; run yadm with 'version' command
-  run $T_YADM version
+  run "$T_YADM" version
+
+  # shellcheck source=/dev/null
 
   #; load yadm variables (including VERSION)
-  YADM_TEST=1 source $T_YADM
+  YADM_TEST=1 source "$T_YADM"
 
   #; validate status and output
   [ $status -eq 0 ]
diff --git a/test/101_accept_help.bats b/test/101_accept_help.bats
index 3104fd8..5932379 100644
--- a/test/101_accept_help.bats
+++ b/test/101_accept_help.bats
@@ -1,5 +1,6 @@
 load common
 load_fixtures
+status=;lines=; #; populated by bats run()
 
 @test "Missing command" {
   echo "
@@ -9,8 +10,8 @@ load_fixtures
   "
 
   #; run yadm with no command
-  run $T_YADM
-  
+  run "$T_YADM"
+
   #; validate status and output
   [ $status -eq 1 ]
   [[ "${lines[0]}" =~ ^Usage: ]]
@@ -24,7 +25,7 @@ load_fixtures
   "
 
   #; run yadm with 'help' command
-  run $T_YADM help
+  run "$T_YADM" help
 
   #; validate status and output
   [ $status -eq 1 ]
diff --git a/test/102_accept_clean.bats b/test/102_accept_clean.bats
index d6c3efb..1ab0e77 100644
--- a/test/102_accept_clean.bats
+++ b/test/102_accept_clean.bats
@@ -1,5 +1,6 @@
 load common
 load_fixtures
+status=;lines=; #; populated by bats run()
 
 @test "Command 'clean'" {
   echo "
@@ -10,7 +11,7 @@ load_fixtures
   "
 
   #; run yadm with 'clean' command
-  run $T_YADM clean
+  run "$T_YADM" clean
 
   #; validate status and output
   [ $status -eq 1 ]
diff --git a/test/103_accept_git.bats b/test/103_accept_git.bats
index 6857e7b..6808b9e 100644
--- a/test/103_accept_git.bats
+++ b/test/103_accept_git.bats
@@ -1,5 +1,6 @@
 load common
 load_fixtures
+status=;output=;lines=; #; populated by bats run()
 
 IN_REPO=(.bash_profile .vimrc)
 
@@ -19,7 +20,7 @@ function setup_environment() {
   setup_environment
 
   #; run bogus
-  run $T_YADM_Y bogus
+  run "${T_YADM_Y[@]}" bogus
 
   #; validate status and output
   [ "$status" -eq 0 ]
@@ -38,10 +39,10 @@ function setup_environment() {
 
   #; create a testfile
   local testfile="$T_DIR_WORK/testfile"
-  echo "$testfile" > $testfile
+  echo "$testfile" > "$testfile"
 
   #; run add
-  run $T_YADM_Y add -v "$testfile"
+  run "${T_YADM_Y[@]}" add -v "$testfile"
 
   #; validate status and output
   [ "$status" -eq 0 ]
@@ -56,7 +57,7 @@ function setup_environment() {
   "
 
   #; run status
-  run $T_YADM_Y status
+  run "${T_YADM_Y[@]}" status
 
   #; validate status and output
   [ "$status" -eq 0 ]
@@ -71,7 +72,7 @@ function setup_environment() {
   "
 
   #; run commit
-  run $T_YADM_Y commit -m 'Add testfile'
+  run "${T_YADM_Y[@]}" commit -m 'Add testfile'
 
   #; validate status and output
   [ "$status" -eq 0 ]
@@ -87,7 +88,7 @@ function setup_environment() {
   "
 
   #; run log
-  run $T_YADM_Y log --oneline
+  run "${T_YADM_Y[@]}" log --oneline
 
   #; validate status and output
   [ "$status" -eq 0 ]
diff --git a/test/104_accept_init.bats b/test/104_accept_init.bats
index 2c603c4..1751e7a 100644
--- a/test/104_accept_init.bats
+++ b/test/104_accept_init.bats
@@ -1,5 +1,6 @@
 load common
 load_fixtures
+status=;output=; #; populated by bats run()
 
 setup() {
   destroy_tmp
@@ -20,18 +21,18 @@ setup() {
   "
 
   #; run init
-  run $T_YADM_Y init
+  run "${T_YADM_Y[@]}" init
 
   #; validate status and output
   [ $status -eq 0 ]
   [[ "$output" =~ Initialized ]]
 
   #; validate repo attributes
-  test_perms $T_DIR_REPO "drw.--.--."
-  test_repo_attribute $T_DIR_REPO core.bare false
-  test_repo_attribute $T_DIR_REPO core.worktree "$HOME"
-  test_repo_attribute $T_DIR_REPO status.showUntrackedFiles no
-  test_repo_attribute $T_DIR_REPO yadm.managed true
+  test_perms "$T_DIR_REPO" "drw.--.--."
+  test_repo_attribute "$T_DIR_REPO" core.bare false
+  test_repo_attribute "$T_DIR_REPO" core.worktree "$HOME"
+  test_repo_attribute "$T_DIR_REPO" status.showUntrackedFiles no
+  test_repo_attribute "$T_DIR_REPO" yadm.managed true
 }
 
 @test "Command 'init' -w (alternate worktree)" {
@@ -49,18 +50,18 @@ setup() {
   "
 
   #; run init
-  run $T_YADM_Y init -w "$T_DIR_WORK"
+  run "${T_YADM_Y[@]}" init -w "$T_DIR_WORK"
 
   #; validate status and output
   [ $status -eq 0 ]
   [[ "$output" =~ Initialized ]]
 
   #; validate repo attributes
-  test_perms $T_DIR_REPO "drw.--.--."
-  test_repo_attribute $T_DIR_REPO core.bare false
-  test_repo_attribute $T_DIR_REPO core.worktree "$T_DIR_WORK"
-  test_repo_attribute $T_DIR_REPO status.showUntrackedFiles no
-  test_repo_attribute $T_DIR_REPO yadm.managed true
+  test_perms "$T_DIR_REPO" "drw.--.--."
+  test_repo_attribute "$T_DIR_REPO" core.bare false
+  test_repo_attribute "$T_DIR_REPO" core.worktree "$T_DIR_WORK"
+  test_repo_attribute "$T_DIR_REPO" status.showUntrackedFiles no
+  test_repo_attribute "$T_DIR_REPO" yadm.managed true
 }
 
 @test "Command 'init' (existing repo)" {
@@ -72,19 +73,19 @@ setup() {
   "
 
   #; create existing repo content
-  mkdir -p $T_DIR_REPO
+  mkdir -p "$T_DIR_REPO"
   local testfile="$T_DIR_REPO/testfile"
   touch "$testfile"
 
   #; run init
-  run $T_YADM_Y init
+  run "${T_YADM_Y[@]}" init
 
   #; validate status and output
   [ $status -eq 1 ]
   [[ "$output" =~ already.exists ]]
 
   #; verify existing repo is intact
-  if [ ! -e $testfile ]; then
+  if [ ! -e "$testfile" ]; then
     echo "ERROR: existing repo has been changed"
     return 1
   fi
@@ -108,29 +109,29 @@ setup() {
   "
 
   #; create existing repo content
-  mkdir -p $T_DIR_REPO
+  mkdir -p "$T_DIR_REPO"
   local testfile="$T_DIR_REPO/testfile"
   touch "$testfile"
 
   #; run init
-  run $T_YADM_Y init -f
+  run "${T_YADM_Y[@]}" init -f
 
   #; validate status and output
   [ $status -eq 0 ]
   [[ "$output" =~ Initialized ]]
 
   #; verify existing repo is gone
-  if [ -e $testfile ]; then
+  if [ -e "$testfile" ]; then
     echo "ERROR: existing repo files remain"
     return 1
   fi
 
   #; validate repo attributes
-  test_perms $T_DIR_REPO "drw.--.--."
-  test_repo_attribute $T_DIR_REPO core.bare false
-  test_repo_attribute $T_DIR_REPO core.worktree "$HOME"
-  test_repo_attribute $T_DIR_REPO status.showUntrackedFiles no
-  test_repo_attribute $T_DIR_REPO yadm.managed true
+  test_perms "$T_DIR_REPO" "drw.--.--."
+  test_repo_attribute "$T_DIR_REPO" core.bare false
+  test_repo_attribute "$T_DIR_REPO" core.worktree "$HOME"
+  test_repo_attribute "$T_DIR_REPO" status.showUntrackedFiles no
+  test_repo_attribute "$T_DIR_REPO" yadm.managed true
 }
 
 @test "Command 'init' -f -w (force overwrite repo with alternate worktree)" {
@@ -151,27 +152,27 @@ setup() {
   "
 
   #; create existing repo content
-  mkdir -p $T_DIR_REPO
+  mkdir -p "$T_DIR_REPO"
   local testfile="$T_DIR_REPO/testfile"
   touch "$testfile"
 
   #; run init
-  run $T_YADM_Y init -f -w "$T_DIR_WORK"
+  run "${T_YADM_Y[@]}" init -f -w "$T_DIR_WORK"
 
   #; validate status and output
   [ $status -eq 0 ]
   [[ "$output" =~ Initialized ]]
 
   #; verify existing repo is gone
-  if [ -e $testfile ]; then
+  if [ -e "$testfile" ]; then
     echo "ERROR: existing repo files remain"
     return 1
   fi
 
   #; validate repo attributes
-  test_perms $T_DIR_REPO "drw.--.--."
-  test_repo_attribute $T_DIR_REPO core.bare false
-  test_repo_attribute $T_DIR_REPO core.worktree "$T_DIR_WORK"
-  test_repo_attribute $T_DIR_REPO status.showUntrackedFiles no
-  test_repo_attribute $T_DIR_REPO yadm.managed true
+  test_perms "$T_DIR_REPO" "drw.--.--."
+  test_repo_attribute "$T_DIR_REPO" core.bare false
+  test_repo_attribute "$T_DIR_REPO" core.worktree "$T_DIR_WORK"
+  test_repo_attribute "$T_DIR_REPO" status.showUntrackedFiles no
+  test_repo_attribute "$T_DIR_REPO" yadm.managed true
 }
diff --git a/test/105_accept_clone.bats b/test/105_accept_clone.bats
index 767e230..0f32453 100644
--- a/test/105_accept_clone.bats
+++ b/test/105_accept_clone.bats
@@ -1,5 +1,6 @@
 load common
 load_fixtures
+status=;output=; #; populated by bats run()
 
 IN_REPO=(.bash_profile .vimrc)
 T_DIR_REMOTE="$T_TMP/remote"
@@ -26,7 +27,7 @@ setup() {
   rm -rf "$T_DIR_REPO"
 
   #; run clone
-  run $T_YADM_Y clone -w "$T_DIR_WORK" "file:///bogus-repo"
+  run "${T_YADM_Y[@]}" clone -w "$T_DIR_WORK" "file:///bogus-repo"
 
   #; validate status and output
   [ "$status" -eq 1 ]
@@ -56,21 +57,22 @@ setup() {
   rm -rf "$T_DIR_REPO"
 
   #; run clone
-  run $T_YADM_Y clone -w "$T_DIR_WORK" "$REMOTE_URL"
+  run "${T_YADM_Y[@]}" clone -w "$T_DIR_WORK" "$REMOTE_URL"
 
   #; validate status and output
   [ "$status" -eq 0 ]
   [[ "$output" =~ Initialized ]]
 
   #; validate repo attributes
-  test_perms $T_DIR_REPO "drw.--.--."
-  test_repo_attribute $T_DIR_REPO core.bare false
-  test_repo_attribute $T_DIR_REPO core.worktree "$T_DIR_WORK"
-  test_repo_attribute $T_DIR_REPO status.showUntrackedFiles no
-  test_repo_attribute $T_DIR_REPO yadm.managed true
+  test_perms "$T_DIR_REPO" "drw.--.--."
+  test_repo_attribute "$T_DIR_REPO" core.bare false
+  test_repo_attribute "$T_DIR_REPO" core.worktree "$T_DIR_WORK"
+  test_repo_attribute "$T_DIR_REPO" status.showUntrackedFiles no
+  test_repo_attribute "$T_DIR_REPO" yadm.managed true
 
   #; test the remote
-  local remote_output=$(GIT_DIR="$T_DIR_REPO" git remote show)
+  local remote_output
+  remote_output=$(GIT_DIR="$T_DIR_REPO" git remote show)
   [ "$remote_output" = "origin" ]
 }
 
@@ -83,7 +85,7 @@ setup() {
   "
 
   #; run clone
-  run $T_YADM_Y clone -w "$T_DIR_WORK" "$REMOTE_URL"
+  run "${T_YADM_Y[@]}" clone -w "$T_DIR_WORK" "$REMOTE_URL"
 
   #; validate status and output
   [ "$status" -eq 1 ]
@@ -111,21 +113,22 @@ setup() {
   mkdir -p "$T_DIR_WORK"
 
   #; run clone
-  run $T_YADM_Y clone -w "$T_DIR_WORK" -f "$REMOTE_URL"
+  run "${T_YADM_Y[@]}" clone -w "$T_DIR_WORK" -f "$REMOTE_URL"
 
   #; validate status and output
   [ "$status" -eq 0 ]
   [[ "$output" =~ Initialized ]]
 
   #; validate repo attributes
-  test_perms $T_DIR_REPO "drw.--.--."
-  test_repo_attribute $T_DIR_REPO core.bare false
-  test_repo_attribute $T_DIR_REPO core.worktree "$T_DIR_WORK"
-  test_repo_attribute $T_DIR_REPO status.showUntrackedFiles no
-  test_repo_attribute $T_DIR_REPO yadm.managed true
+  test_perms "$T_DIR_REPO" "drw.--.--."
+  test_repo_attribute "$T_DIR_REPO" core.bare false
+  test_repo_attribute "$T_DIR_REPO" core.worktree "$T_DIR_WORK"
+  test_repo_attribute "$T_DIR_REPO" status.showUntrackedFiles no
+  test_repo_attribute "$T_DIR_REPO" yadm.managed true
 
   #; test the remote
-  local remote_output=$(GIT_DIR="$T_DIR_REPO" git remote show)
+  local remote_output
+  remote_output=$(GIT_DIR="$T_DIR_REPO" git remote show)
   [ "$remote_output" = "origin" ]
 }
 
@@ -152,24 +155,25 @@ setup() {
   echo "conflict" >> "$T_DIR_WORK/.bash_profile"
 
   #; run clone
-  run $T_YADM_Y clone -w "$T_DIR_WORK" "$REMOTE_URL"
+  run "${T_YADM_Y[@]}" clone -w "$T_DIR_WORK" "$REMOTE_URL"
 
   #; validate status and output
   [ "$status" -eq 0 ]
   [[ "$output" =~ Initialized ]]
 
   #; validate merging note
-  [[ "$output" =~ Merging\ origin\/master\ failed ]]
+  [[ "$output" =~ Merging\ origin/master\ failed ]]
   [[ "$output" =~ NOTE ]]
 
   #; validate repo attributes
-  test_perms $T_DIR_REPO "drw.--.--."
-  test_repo_attribute $T_DIR_REPO core.bare false
-  test_repo_attribute $T_DIR_REPO core.worktree "$T_DIR_WORK"
-  test_repo_attribute $T_DIR_REPO status.showUntrackedFiles no
-  test_repo_attribute $T_DIR_REPO yadm.managed true
+  test_perms "$T_DIR_REPO" "drw.--.--."
+  test_repo_attribute "$T_DIR_REPO" core.bare false
+  test_repo_attribute "$T_DIR_REPO" core.worktree "$T_DIR_WORK"
+  test_repo_attribute "$T_DIR_REPO" status.showUntrackedFiles no
+  test_repo_attribute "$T_DIR_REPO" yadm.managed true
 
   #; test the remote
-  local remote_output=$(GIT_DIR="$T_DIR_REPO" git remote show)
+  local remote_output
+  remote_output=$(GIT_DIR="$T_DIR_REPO" git remote show)
   [ "$remote_output" = "origin" ]
 }
diff --git a/test/106_accept_config.bats b/test/106_accept_config.bats
index dfb1dab..8688211 100644
--- a/test/106_accept_config.bats
+++ b/test/106_accept_config.bats
@@ -1,5 +1,6 @@
 load common
 load_fixtures
+status=;output=; #; populated by bats run()
 
 T_SECTION="test"
 T_ATTRIB="attribute"
@@ -32,7 +33,7 @@ setup() {
   "
 
   #; run config
-  run $T_YADM_Y config $T_KEY
+  run "${T_YADM_Y[@]}" config $T_KEY
 
   #; validate status and output
   [ $status -eq 0 ]
@@ -50,15 +51,17 @@ setup() {
   "
 
   #; run config
-  run $T_YADM_Y config "$T_KEY" "$T_VALUE"
+  run "${T_YADM_Y[@]}" config "$T_KEY" "$T_VALUE"
 
   #; validate status and output
   [ $status -eq 0 ]
   [ "$output" = "" ]
 
   #; validate configuration
-  local config=$(cat $T_YADM_CONFIG)
-  local expected=$(echo -e "$T_EXPECTED")
+  local config
+  config=$(cat "$T_YADM_CONFIG")
+  local expected
+  expected=$(echo -e "$T_EXPECTED")
   if [ "$config" != "$expected" ]; then
     echo "ERROR: Config does not match expected"
     echo "$config"
@@ -76,11 +79,11 @@ setup() {
   "
 
   #; manually load a value into the configuration
-  mkdir -p $(dirname "$T_YADM_CONFIG")
-  echo -e "$T_EXPECTED" > $T_YADM_CONFIG
+  make_parents "$T_YADM_CONFIG"
+  echo -e "$T_EXPECTED" > "$T_YADM_CONFIG"
 
   #; run config
-  run $T_YADM_Y config "$T_KEY"
+  run "${T_YADM_Y[@]}" config "$T_KEY"
 
   #; validate status and output
   [ $status -eq 0 ]
@@ -101,19 +104,21 @@ setup() {
   "
 
   #; manually load a value into the configuration
-  mkdir -p $(dirname "$T_YADM_CONFIG")
-  echo -e "${T_EXPECTED}_with_extra_data" > $T_YADM_CONFIG
+  make_parents "$T_YADM_CONFIG"
+  echo -e "${T_EXPECTED}_with_extra_data" > "$T_YADM_CONFIG"
 
   #; run config
-  run $T_YADM_Y config "$T_KEY" "$T_VALUE"
+  run "${T_YADM_Y[@]}" config "$T_KEY" "$T_VALUE"
 
   #; validate status and output
   [ $status -eq 0 ]
   [ "$output" = "" ]
 
   #; validate configuration
-  local config=$(cat $T_YADM_CONFIG)
-  local expected=$(echo -e "$T_EXPECTED")
+  local config
+  config=$(cat "$T_YADM_CONFIG")
+  local expected
+  expected=$(echo -e "$T_EXPECTED")
   if [ "$config" != "$expected" ]; then
     echo "ERROR: Config does not match expected"
     echo "$config"
diff --git a/test/107_accept_list.bats b/test/107_accept_list.bats
index ef076b7..3cc61d3 100644
--- a/test/107_accept_list.bats
+++ b/test/107_accept_list.bats
@@ -1,5 +1,6 @@
 load common
 load_fixtures
+status=;lines=; #; populated by bats run()
 
 IN_REPO=(.bash_profile .hammerspoon/init.lua .vimrc)
 SUBDIR=".hammerspoon"
@@ -19,7 +20,7 @@ function setup() {
   "
 
   #; run list -a
-  run $T_YADM_Y list -a
+  run "${T_YADM_Y[@]}" list -a
 
   #; validate status and output
   [ "$status" -eq 0 ]
@@ -39,7 +40,7 @@ function setup() {
   "
 
   #; run list
-  run $T_YADM_Y list
+  run "${T_YADM_Y[@]}" list
 
   #; validate status and output
   [ "$status" -eq 0 ]
@@ -59,7 +60,7 @@ function setup() {
   "
 
   #; run list
-  run bash -c "(cd $T_DIR_WORK; $T_YADM_Y list)"
+  run bash -c "(cd '$T_DIR_WORK'; ${T_YADM_Y[*]} list)"
 
   #; validate status and output
   [ "$status" -eq 0 ]
@@ -79,7 +80,7 @@ function setup() {
   "
 
   #; run list
-  run bash -c "(cd $T_DIR_WORK/$SUBDIR; $T_YADM_Y list)"
+  run bash -c "(cd '$T_DIR_WORK/$SUBDIR'; ${T_YADM_Y[*]} list)"
 
   #; validate status and output
   [ "$status" -eq 0 ]
diff --git a/test/108_accept_alt.bats b/test/108_accept_alt.bats
index c2e1b10..fcf04c3 100644
--- a/test/108_accept_alt.bats
+++ b/test/108_accept_alt.bats
@@ -1,5 +1,6 @@
 load common
 load_fixtures
+status=;output=; #; populated by bats run()
 
 IN_REPO=(alt*)
 
@@ -45,7 +46,7 @@ function test_alt() {
 
   #; run yadm (alt or status)
   if [ -z "$auto_alt" ]; then
-    run $T_YADM_Y alt
+    run "${T_YADM_Y[@]}" alt
     #; validate status and output
     if [ "$status" != 0 ] || [[ ! "$output" =~ Linking.+$link_name ]]; then
       echo "ERROR: Could not confirm status and output of alt command"
@@ -53,7 +54,7 @@ function test_alt() {
     fi
   else
     #; running any passed through Git command should trigger auto-alt
-    run $T_YADM_Y status
+    run "${T_YADM_Y[@]}" status
     if [ ! -z "$auto_alt" ] && [[ "$output" =~ Linking.+$link_name ]]; then
       echo "ERROR: Reporting of link should not happen"
       return 1
@@ -69,7 +70,8 @@ function test_alt() {
     fi
   else
     #; correct link should be present
-    local link_content=$(cat "$T_DIR_WORK/$link_name")
+    local link_content
+    link_content=$(cat "$T_DIR_WORK/$link_name")
     if [ "$link_content" != "$link_match" ]; then
       echo "ERROR: Link content is not correct"
       return 1
diff --git a/test/109_accept_encryption.bats b/test/109_accept_encryption.bats
index ca125a9..a3c07a7 100644
--- a/test/109_accept_encryption.bats
+++ b/test/109_accept_encryption.bats
@@ -1,5 +1,6 @@
 load common
 load_fixtures
+status=;output=; #; populated by bats run()
 
 T_PASSWD="ExamplePassword"
 
@@ -11,16 +12,19 @@ setup() {
   build_repo
 
   #; define a YADM_ENCRYPT
-  mkdir -p $(dirname "$T_YADM_ENCRYPT")
-  echo -e ".ssh/*.key\n.gnupg/*.gpg" > $T_YADM_ENCRYPT
+  make_parents "$T_YADM_ENCRYPT"
+  echo -e ".ssh/*.key\n.gnupg/*.gpg" > "$T_YADM_ENCRYPT"
 
   #; create a YADM_ARCHIVE
   (
-    cd $T_DIR_WORK
-    for f in $(sort "$T_YADM_ENCRYPT"); do
-      tar rf "$T_TMP/build_archive.tar" "$f"
-      echo "$f" >> "$T_TMP/archived_files"
-    done
+    if cd "$T_DIR_WORK"; then
+      # shellcheck disable=2013
+      # (globbing is desired)
+      for f in $(sort "$T_YADM_ENCRYPT"); do
+        tar rf "$T_TMP/build_archive.tar" "$f"
+        echo "$f" >> "$T_TMP/archived_files"
+      done
+    fi
   )
 
   #; encrypt YADM_ARCHIVE
@@ -46,10 +50,13 @@ EOF
 
   #; inventory what is expected in the archive
   (
-    cd $T_DIR_WORK
-    for f in $(cat "$T_YADM_ENCRYPT"); do
-      echo "$f"
-    done | sort > "$T_TMP/expected_list"
+    if cd "$T_DIR_WORK"; then
+      # shellcheck disable=2013
+      # (globbing is desired)
+      for f in $(cat "$T_YADM_ENCRYPT"); do
+        echo "$f"
+      done | sort > "$T_TMP/expected_list"
+    fi
   )
 
   #; compare the archive vs expected
@@ -64,13 +71,14 @@ EOF
 
 function validate_extraction() {
   #; test each file which was archived
-  for f in $(cat "$T_TMP/archived_files"); do
-    local contents=$(cat "$T_DIR_WORK/$f")
+  while IFS= read -r f; do
+    local contents
+    contents=$(cat "$T_DIR_WORK/$f")
     if [ "$contents" != "$f" ]; then
       echo "ERROR: Contents of $T_DIR_WORK/$f is incorrect"
       return 1
     fi
-  done
+  done < "$T_TMP/archived_files"
   return 0
 }
 
@@ -86,7 +94,7 @@ function validate_extraction() {
   rm -f "$T_YADM_ENCRYPT"
 
   #; run encrypt
-  run $T_YADM_Y encrypt
+  run "${T_YADM_Y[@]}" encrypt
 
   #; validate status and output
   [ "$status" -eq 1 ]
@@ -108,7 +116,7 @@ function validate_extraction() {
   #; run encrypt
   run expect <<EOF
     set timeout 2;
-    spawn $T_YADM_Y encrypt;
+    spawn ${T_YADM_Y[*]} encrypt;
     expect "passphrase:" {send "ONE\n"}
     expect "passphrase:" {send "TWO\n"}
     expect "$"
@@ -138,7 +146,7 @@ EOF
   #; run encrypt
   run expect <<EOF
     set timeout 2;
-    spawn $T_YADM_Y encrypt;
+    spawn ${T_YADM_Y[*]} encrypt;
     expect "passphrase:" {send "$T_PASSWD\n"}
     expect "passphrase:" {send "$T_PASSWD\n"}
     expect "$"
@@ -168,13 +176,14 @@ EOF
   rm -f "$T_YADM_ARCHIVE"
 
   #; add comment to YADM_ARCHIVE
-  local original_encrypt=$(cat "$T_YADM_ENCRYPT")
-  echo -e "#.vimrc" >> $T_YADM_ENCRYPT
+  local original_encrypt
+  original_encrypt=$(cat "$T_YADM_ENCRYPT")
+  echo -e "#.vimrc" >> "$T_YADM_ENCRYPT"
 
   #; run encrypt
   run expect <<EOF
     set timeout 2;
-    spawn $T_YADM_Y encrypt;
+    spawn ${T_YADM_Y[*]} encrypt;
     expect "passphrase:" {send "$T_PASSWD\n"}
     expect "passphrase:" {send "$T_PASSWD\n"}
     expect "$"
@@ -210,7 +219,7 @@ EOF
   #; run encrypt
   run expect <<EOF
     set timeout 2;
-    spawn $T_YADM_Y encrypt;
+    spawn ${T_YADM_Y[*]} encrypt;
     expect "passphrase:" {send "$T_PASSWD\n"}
     expect "passphrase:" {send "$T_PASSWD\n"}
     expect "$"
@@ -238,7 +247,7 @@ EOF
   rm -f "$T_YADM_ARCHIVE"
 
   #; run encrypt
-  run $T_YADM_Y decrypt
+  run "${T_YADM_Y[@]}" decrypt
 
   #; validate status and output
   [ "$status" -eq 1 ]
@@ -257,7 +266,7 @@ EOF
   #; run encrypt
   run expect <<EOF
     set timeout 2;
-    spawn $T_YADM_Y decrypt;
+    spawn ${T_YADM_Y[*]} decrypt;
     expect "passphrase:" {send "WRONG\n"}
     expect "$"
     foreach {pid spawnid os_error_flag value} [wait] break
@@ -283,7 +292,7 @@ EOF
   #; run encrypt
   run expect <<EOF
     set timeout 2;
-    spawn $T_YADM_Y decrypt -l;
+    spawn ${T_YADM_Y[*]} decrypt -l;
     expect "passphrase:" {send "WRONG\n"}
     expect "$"
     foreach {pid spawnid os_error_flag value} [wait] break
@@ -312,7 +321,7 @@ EOF
   #; run encrypt
   run expect <<EOF
     set timeout 2;
-    spawn $T_YADM_Y decrypt;
+    spawn ${T_YADM_Y[*]} decrypt;
     expect "passphrase:" {send "$T_PASSWD\n"}
     expect "$"
     foreach {pid spawnid os_error_flag value} [wait] break
@@ -338,14 +347,14 @@ EOF
   "
 
   #; alter the values of the archived files
-  for f in $(cat "$T_TMP/archived_files"); do
+  while IFS= read -r f; do
     echo "changed" >> "$T_DIR_WORK/$f"
-  done
+  done < "$T_TMP/archived_files"
 
   #; run encrypt
   run expect <<EOF
     set timeout 2;
-    spawn $T_YADM_Y decrypt;
+    spawn ${T_YADM_Y[*]} decrypt;
     expect "passphrase:" {send "$T_PASSWD\n"}
     expect "$"
     foreach {pid spawnid os_error_flag value} [wait] break
@@ -372,7 +381,7 @@ EOF
   #; run encrypt
   run expect <<EOF
     set timeout 2;
-    spawn $T_YADM_Y decrypt -l;
+    spawn ${T_YADM_Y[*]} decrypt -l;
     expect "passphrase:" {send "$T_PASSWD\n"}
     expect "$"
     foreach {pid spawnid os_error_flag value} [wait] break
@@ -383,11 +392,11 @@ EOF
   [ "$status" -eq 0 ]
 
   #; validate every file is listed in output
-  for f in $(cat "$T_TMP/archived_files"); do
+  while IFS= read -r f; do
     if [[ ! "$output" =~ $f ]]; then
       echo "ERROR: Did not find '$f' in output"
       return 1
     fi
-  done
+  done < "$T_TMP/archived_files"
 
 }
diff --git a/test/110_accept_perms.bats b/test/110_accept_perms.bats
index 07d9343..4f7f6d4 100644
--- a/test/110_accept_perms.bats
+++ b/test/110_accept_perms.bats
@@ -1,5 +1,6 @@
 load common
 load_fixtures
+status=;output=; #; populated by bats run()
 
 setup() {
   destroy_tmp
@@ -13,7 +14,7 @@ function is_restricted() {
 }
 
 function validate_perms() {
-  local perms="$@"
+  local perms="$*"
 
   #; determine which paths should have restricted permissions
   restricted=()
@@ -39,13 +40,14 @@ function validate_perms() {
 
   #; validate permissions of each path in the worktere
   local testpath
-  for testpath in $(find "$T_DIR_WORK"); do
+  while IFS= read -r -d '' testpath; do
     local perm_regex="....rwxrwx"
     if is_restricted "$testpath"; then
       perm_regex="....------"
     fi
     test_perms "$testpath" "$perm_regex" || return 1
-  done
+  done <   <(find "$T_DIR_WORK" -print0)
+
 }
 
 @test "Command 'perms'" {
@@ -57,7 +59,7 @@ function validate_perms() {
   "
 
   #; run perms
-  run $T_YADM_Y perms
+  run "${T_YADM_Y[@]}" perms
 
   #; validate status and output
   [ "$status" -eq 0 ]
@@ -81,7 +83,7 @@ function validate_perms() {
   echo -e "#.vimrc\n.hammerspoon/*" > "$T_YADM_ENCRYPT"
 
   #; run perms
-  run $T_YADM_Y perms
+  run "${T_YADM_Y[@]}" perms
 
   #; validate status and output
   [ "$status" -eq 0 ]
@@ -107,7 +109,7 @@ function validate_perms() {
   git config --file="$T_YADM_CONFIG" "yadm.ssh-perms" "false"
 
   #; run perms
-  run $T_YADM_Y perms
+  run "${T_YADM_Y[@]}" perms
 
   #; validate status and output
   [ "$status" -eq 0 ]
@@ -130,7 +132,7 @@ function validate_perms() {
   git config --file="$T_YADM_CONFIG" "yadm.gpg-perms" "false"
 
   #; run perms
-  run $T_YADM_Y perms
+  run "${T_YADM_Y[@]}" perms
 
   #; validate status and output
   [ "$status" -eq 0 ]
@@ -148,7 +150,7 @@ function validate_perms() {
   "
 
   #; run status
-  run $T_YADM_Y status
+  run "${T_YADM_Y[@]}" status
 
   #; validate status
   [ "$status" -eq 0 ]
@@ -169,7 +171,7 @@ function validate_perms() {
   git config --file="$T_YADM_CONFIG" "yadm.auto-perms" "false"
 
   #; run status
-  run $T_YADM_Y status
+  run "${T_YADM_Y[@]}" status
 
   #; validate status
   [ "$status" -eq 0 ]
diff --git a/test/common.bash b/test/common.bash
index c5fb41e..0a5eb86 100644
--- a/test/common.bash
+++ b/test/common.bash
@@ -1,24 +1,29 @@
 
 #; common fixtures
 function load_fixtures() {
-  DEFAULT_YADM_DIR="$HOME/.yadm"
-  DEFAULT_REPO="repo.git"
-  DEFAULT_CONFIG="config"
-  DEFAULT_ENCRYPT="encrypt"
-  DEFAULT_ARCHIVE="files.gpg"
+  export DEFAULT_YADM_DIR="$HOME/.yadm"
+  export DEFAULT_REPO="repo.git"
+  export DEFAULT_CONFIG="config"
+  export DEFAULT_ENCRYPT="encrypt"
+  export DEFAULT_ARCHIVE="files.gpg"
 
-  T_YADM="$PWD/yadm"
-  T_TMP="$BATS_TMPDIR/ytmp"
-  T_DIR_YADM="$T_TMP/.yadm"
-  T_DIR_WORK="$T_TMP/yadm-work"
-  T_DIR_REPO="$T_DIR_YADM/repo.git"
-  T_YADM_CONFIG="$T_DIR_YADM/config"
-  T_YADM_ENCRYPT="$T_DIR_YADM/encrypt"
-  T_YADM_ARCHIVE="$T_DIR_YADM/files.gpg"
-  T_YADM_Y="$T_YADM -Y $T_DIR_YADM"
+  export T_YADM="$PWD/yadm"
+  export T_TMP="$BATS_TMPDIR/ytmp"
+  export T_DIR_YADM="$T_TMP/.yadm"
+  export T_DIR_WORK="$T_TMP/yadm-work"
+  export T_DIR_REPO="$T_DIR_YADM/repo.git"
+  export T_YADM_CONFIG="$T_DIR_YADM/config"
+  export T_YADM_ENCRYPT="$T_DIR_YADM/encrypt"
+  export T_YADM_ARCHIVE="$T_DIR_YADM/files.gpg"
 
+  export T_YADM_Y
+  T_YADM_Y=( "$T_YADM" -Y "$T_DIR_YADM" )
+
+  export T_SYS
   T_SYS=$(uname -s)
+  export T_HOST
   T_HOST=$(hostname -s)
+  export T_USER
   T_USER=$(id -u -n)
 }
 
@@ -27,10 +32,17 @@ function configure_git() {
   (git config user.email || git config --global user.email 'test@test.test') > /dev/null
 }
 
+function make_parents() {
+  local parent_dir
+  parent_dir=$(dirname "$@")
+  mkdir -p "$parent_dir"
+}
+
 function test_perms() {
   local test_path="$1"
   local regex="$2"
-  local ls=$(ls -ld "$test_path")
+  local ls
+  ls=$(ls -ld "$test_path")
   local perms="${ls:0:10}"
   if [[ ! $perms =~ $regex ]]; then
     echo "ERROR: Found permissions $perms for $test_path"
@@ -43,7 +55,8 @@ function test_repo_attribute() {
   local repo_dir="$1"
   local attribute="$2"
   local expected="$3"
-  local actual=$(GIT_DIR="$repo_dir" git config --local "$attribute")
+  local actual
+  actual=$(GIT_DIR="$repo_dir" git config --local "$attribute")
   if [ "$actual" != "$expected" ]; then
     echo "ERROR: repo attribute $attribute set to $actual"
     return 1
@@ -103,7 +116,7 @@ function create_worktree() {
     .vimrc                             \
   ;
   do
-    mkdir -p $(dirname "$DIR_WORKTREE/$f")
+    make_parents "$DIR_WORKTREE/$f"
     echo "$f" > "$DIR_WORKTREE/$f"
   done
 
@@ -114,7 +127,7 @@ function create_worktree() {
 
 #; create a repo in T_DIR_REPO
 function build_repo() {
-  local files_to_add="$@"
+  local files_to_add=( "$@" )
 
   #; create a worktree
   create_worktree "$T_DIR_WORK"
@@ -133,8 +146,8 @@ function build_repo() {
   GIT_DIR="$T_DIR_REPO" git config status.showUntrackedFiles no
   GIT_DIR="$T_DIR_REPO" git config yadm.managed 'true'
 
-  if [ -n "$files_to_add" ]; then
-    for f in $files_to_add; do
+  if [ ${#files_to_add[@]} -ne 0 ]; then
+    for f in "${files_to_add[@]}"; do
       GIT_DIR="$T_DIR_REPO" git add "$T_DIR_WORK/$f" >/dev/null
     done
     GIT_DIR="$T_DIR_REPO" git commit -m 'Create repo template' >/dev/null