diff --git a/Makefile.am b/Makefile.am
index 32ac50f78ae2..efe99142e6a0 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -126,9 +126,9 @@ filter_executable = -exec test -x '{}' \; -print
 PHONY += shellcheck
 shellcheck:
 	@if type shellcheck > /dev/null 2>&1; then \
-		shellcheck --exclude=SC1090 --exclude=SC1117 --format=gcc \
-			$$(find ${top_srcdir}/scripts/*.sh -type f) \
-			$$(find ${top_srcdir}/cmd/zed/zed.d/*.sh -type f) \
+		shellcheck --exclude=SC1090,SC1117,SC1091 --format=gcc \
+			$$(find ${top_srcdir} -name "config*" -prune -name tests -prune \
+				-o -name "*.sh" -o -name "*.sh.in" -type f) \
 			$$(find ${top_srcdir}/cmd/zpool/zpool.d/* \
 			-type f ${filter_executable}); \
 	else \
diff --git a/cmd/fsck_zfs/fsck.zfs.in b/cmd/fsck_zfs/fsck.zfs.in
index 32c8043e68fb..37096902cb94 100755
--- a/cmd/fsck_zfs/fsck.zfs.in
+++ b/cmd/fsck_zfs/fsck.zfs.in
@@ -26,15 +26,15 @@ for dataset in "$@"; do
 
 	case "$(@sbindir@/zpool list -Ho health "$pool")" in
 		DEGRADED)
-			ret=$(( $ret | 4 ))
+			ret=$(( ret | 4 ))
 			;;
 		FAULTED)
 			awk '!/^([[:space:]]*#.*)?$/ && $1 == "'"$dataset"'" && $3 == "zfs" {exit 1}' /etc/fstab || \
-				ret=$(( $ret | 8 ))
+				ret=$(( ret | 8 ))
 			;;
 		"")
 			# Pool not found, error printed by zpool(8)
-			ret=$(( $ret | 8 ))
+			ret=$(( ret | 8 ))
 			;;
 		*)
 			;;
diff --git a/cmd/zed/zed.d/zed-functions.sh b/cmd/zed/zed.d/zed-functions.sh
index 7c1a7b6ce06a..c4ed5aa8ac7a 100644
--- a/cmd/zed/zed.d/zed-functions.sh
+++ b/cmd/zed/zed.d/zed-functions.sh
@@ -267,7 +267,7 @@ zed_notify_email()
                 -e "s/@SUBJECT@/${subject}/g")"
 
     # shellcheck disable=SC2086
-    eval "${ZED_EMAIL_PROG}" ${ZED_EMAIL_OPTS} < "${pathname}" >/dev/null 2>&1
+    ${ZED_EMAIL_PROG} ${ZED_EMAIL_OPTS} < "${pathname}" >/dev/null 2>&1
     rv=$?
     if [ "${rv}" -ne 0 ]; then
         zed_log_err "$(basename "${ZED_EMAIL_PROG}") exit=${rv}"
diff --git a/cmd/zvol_wait/zvol_wait b/cmd/zvol_wait/zvol_wait
index cc6ba5e62572..2aa929b0ca2b 100755
--- a/cmd/zvol_wait/zvol_wait
+++ b/cmd/zvol_wait/zvol_wait
@@ -20,6 +20,7 @@ filter_out_deleted_zvols() {
 	OIFS="$IFS"
 	IFS="
 "
+	# shellcheck disable=SC2086
 	zfs list -H -o name $zvols 2>/dev/null
 	IFS="$OIFS"
 }
diff --git a/contrib/dracut/02zfsexpandknowledge/module-setup.sh.in b/contrib/dracut/02zfsexpandknowledge/module-setup.sh.in
index 12f5d91e93ec..d21ab74cc0d0 100755
--- a/contrib/dracut/02zfsexpandknowledge/module-setup.sh.in
+++ b/contrib/dracut/02zfsexpandknowledge/module-setup.sh.in
@@ -14,21 +14,16 @@ get_pool_devices() {
   local poolconfigtemp
   local poolconfigoutput
   local pooldev
-  local prefix
   local resolved
-  poolconfigtemp=`mktemp`
+  poolconfigtemp="$(mktemp)"
   if ! @sbindir@/zpool list -v -H -P "$1" > "$poolconfigtemp" 2>&1 ; then
-    poolconfigoutput=$(cat "$poolconfigtemp")
+    poolconfigoutput="$(cat "$poolconfigtemp")"
     dinfo "zfsexpandknowledge: pool $1 cannot be listed: $poolconfigoutput"
   else
-    cat "$poolconfigtemp" |  awk -F '\t' '/\t\/dev/ { print $2 }' | \
-    while read pooldev ; do
-        if [ -n "$pooldev" -a -e "$pooldev" ] ; then
-          if [ -h "$pooldev" ] ; then
-              resolved=`readlink -f "$pooldev"`
-          else
-              resolved="$pooldev"
-          fi
+    awk -F '\t' '/\t\/dev/ { print $2 }' "$poolconfigtemp" | \
+    while read -r pooldev ; do
+        if [ -e "$pooldev" ] ; then
+          resolved="$(readlink -f "$pooldev")"
           dinfo "zfsexpandknowledge: pool $1 has device $pooldev (which resolves to $resolved)"
           echo "$resolved"
         fi
@@ -39,22 +34,20 @@ get_pool_devices() {
 
 find_zfs_block_devices() {
     local dev
-    local blockdev
     local mp
     local fstype
     local pool
-    local key
-    local n
-    local poolconfigoutput
-    numfields=`head -1 /proc/self/mountinfo | awk '{print NF}'`
-    if [ "$numfields" == "10" ] ; then
-        fields="n n n n mp n n fstype dev n"
+    local _
+    numfields="$(awk '{print NF; exit}' /proc/self/mountinfo)"
+    if [ "$numfields" = "10" ] ; then
+        fields="_ _ _ _ mp _ _ fstype dev _"
     else
-        fields="n n n n mp n n n fstype dev n"
+        fields="_ _ _ _ mp _ _ _ fstype dev _"
     fi
-    while read $fields ; do
-       if [ "$fstype" != "zfs" ]; then continue ; fi
-       if [ "$mp" == "$1" ]; then
+    # shellcheck disable=SC2086
+    while read -r ${fields?} ; do
+       [ "$fstype" = "zfs" ] || continue
+       if [ "$mp" = "$1" ]; then
            pool=$(echo "$dev" | cut -d / -f 1)
            get_pool_devices "$pool"
        fi
@@ -76,10 +69,9 @@ check() {
     local _depdev
     local _depdevname
     local _depdevtype
-    local _depmajmin
-    local _dev
 
-if [[ $hostonly ]]; then
+# shellcheck disable=SC2154
+if [ -n "$hostonly" ]; then
 
     for mp in \
         "/" \
@@ -106,13 +98,12 @@ if [[ $hostonly ]]; then
             fstype=$(get_devtype "$dev")
             host_fs_types["$dev"]="$fstype"
             majmin=$(get_maj_min "$dev")
-            if [[ -d /sys/dev/block/$majmin/slaves ]] ; then
-                for _depdev in /sys/dev/block/$majmin/slaves/*; do
+            if [ -d "/sys/dev/block/$majmin/slaves" ] ; then
+                for _depdev in "/sys/dev/block/$majmin/slaves"/*; do
                     [[ -f $_depdev/dev ]] || continue
                     _depdev=/dev/$(basename "$_depdev")
                     _depdevname=$(udevadm info --query=property --name="$_depdev" | grep "^DEVNAME=" | sed 's|^DEVNAME=||')
                     _depdevtype=$(get_devtype "$_depdevname")
-                    _depmajmin=$(get_maj_min "$_depdevname")
                     dinfo "zfsexpandknowledge: underlying block device backing ZFS dataset $mp: ${_depdevname//$'\n'/ }"
                     array_contains "$_depdevname" "${host_devs[@]}" || host_devs+=("$_depdevname")
                     host_fs_types["$_depdevname"]="$_depdevtype"
diff --git a/contrib/dracut/90zfs/module-setup.sh.in b/contrib/dracut/90zfs/module-setup.sh.in
index 416282f009de..b0318de92ee6 100755
--- a/contrib/dracut/90zfs/module-setup.sh.in
+++ b/contrib/dracut/90zfs/module-setup.sh.in
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# shellcheck disable=SC2154
 
 check() {
 	# We depend on udev-rules being loaded
@@ -56,6 +57,7 @@ install() {
 		# Fallback: Guess the path and include all matches
 		dracut_install /usr/lib/gcc/*/*/libgcc_s.so*
 	fi
+	# shellcheck disable=SC2050
 	if [ @LIBFETCH_DYNAMIC@ != 0 ]; then
 		for d in $libdirs; do
 			[ -e "$d"/@LIBFETCH_SONAME@ ] && dracut_install "$d"/@LIBFETCH_SONAME@
diff --git a/contrib/dracut/90zfs/mount-zfs.sh.in b/contrib/dracut/90zfs/mount-zfs.sh.in
index 5ad6a0f2601c..4f2a51ca66f4 100755
--- a/contrib/dracut/90zfs/mount-zfs.sh.in
+++ b/contrib/dracut/90zfs/mount-zfs.sh.in
@@ -1,4 +1,5 @@
 #!/bin/sh
+# shellcheck disable=SC2034,SC2154
 
 . /lib/dracut-zfs-lib.sh
 
@@ -39,6 +40,7 @@ udevadm settle
 
 if [ "${root}" = "zfs:AUTO" ] ; then
 	if ! ZFS_DATASET="$(find_bootfs)" ; then
+		# shellcheck disable=SC2086
 		zpool import -N -a ${ZPOOL_IMPORT_OPTS}
 		if ! ZFS_DATASET="$(find_bootfs)" ; then
 			warn "ZFS: No bootfs attribute found in importable pools."
diff --git a/contrib/dracut/90zfs/parse-zfs.sh.in b/contrib/dracut/90zfs/parse-zfs.sh.in
index 768de9dd2512..fe786a880699 100755
--- a/contrib/dracut/90zfs/parse-zfs.sh.in
+++ b/contrib/dracut/90zfs/parse-zfs.sh.in
@@ -1,4 +1,5 @@
 #!/bin/sh
+# shellcheck disable=SC2034,SC2154
 
 . /lib/dracut-lib.sh
 
@@ -28,7 +29,7 @@ case "${root}" in
 		info "ZFS: Enabling autodetection of bootfs after udev settles."
 		;;
 
-	ZFS\=*|zfs:*|zfs:FILESYSTEM\=*|FILESYSTEM\=*)
+	ZFS=*|zfs:*|FILESYSTEM=*)
 		# root is explicit ZFS root.  Parse it now.  We can handle
 		# a root=... param in any of the following formats:
 		# root=ZFS=rpool/ROOT
diff --git a/contrib/dracut/90zfs/zfs-generator.sh.in b/contrib/dracut/90zfs/zfs-generator.sh.in
index e3fbf334f7d0..b57c64c688b1 100755
--- a/contrib/dracut/90zfs/zfs-generator.sh.in
+++ b/contrib/dracut/90zfs/zfs-generator.sh.in
@@ -1,4 +1,5 @@
 #!/bin/sh
+# shellcheck disable=SC2016,SC1004
 
 grep -wq debug /proc/cmdline && debug=1
 [ -n "$debug" ] && echo "zfs-generator: starting" >> /dev/kmsg
diff --git a/contrib/dracut/90zfs/zfs-lib.sh.in b/contrib/dracut/90zfs/zfs-lib.sh.in
index 98e4452a791b..10b0b701a233 100755
--- a/contrib/dracut/90zfs/zfs-lib.sh.in
+++ b/contrib/dracut/90zfs/zfs-lib.sh.in
@@ -59,6 +59,7 @@ import_pool() {
 
     if ! zpool list -H "${pool}" > /dev/null 2>&1; then
         info "ZFS: Importing pool ${pool}..."
+        # shellcheck disable=SC2086
         if ! zpool import -N ${ZPOOL_IMPORT_OPTS} "${pool}" ; then
             warn "ZFS: Unable to import pool ${pool}"
             return 1
@@ -123,13 +124,12 @@ for_relevant_root_children() {
 # export_all OPTS
 #   exports all imported zfs pools.
 export_all() {
-    opts="${@}"
     ret=0
 
     IFS="${NEWLINE}"
     for pool in $(zpool list -H -o name) ; do
         if zpool list -H "${pool}" > /dev/null 2>&1; then
-            zpool export "${pool}" ${opts} || ret=$?
+            zpool export "${pool}" "$@" || ret=$?
         fi
     done
     IFS="${OLDIFS}"
diff --git a/contrib/dracut/90zfs/zfs-load-key.sh.in b/contrib/dracut/90zfs/zfs-load-key.sh.in
index f17f0c7af8eb..8fd3e5fd52c8 100755
--- a/contrib/dracut/90zfs/zfs-load-key.sh.in
+++ b/contrib/dracut/90zfs/zfs-load-key.sh.in
@@ -1,4 +1,5 @@
 #!/bin/sh
+# shellcheck disable=SC2154
 
 # only run this on systemd systems, we handle the decrypt in mount-zfs.sh in the mount hook otherwise
 [ -e /bin/systemctl ] || [ -e /usr/bin/systemctl ] || return 0
diff --git a/contrib/initramfs/hooks/zfs.in b/contrib/initramfs/hooks/zfs.in
index 7e401d1e87e1..bdf169fd96c2 100755
--- a/contrib/initramfs/hooks/zfs.in
+++ b/contrib/initramfs/hooks/zfs.in
@@ -26,12 +26,13 @@ fi
 
 # We use pthreads, but i-t from buster doesn't automatically
 # copy this indirect dependency: this can be removed when buster finally dies.
-for libgcc in $(find /lib/ -type f -name libgcc_s.so.[1-9]); do
+find /lib/ -type f -name "libgcc_s.so.[1-9]" | while read -r libgcc; do
 	copy_exec "$libgcc"
 done
 
+# shellcheck disable=SC2050
 if [ @LIBFETCH_DYNAMIC@ != 0 ]; then
-	for libfetch in $(find /lib/ -name @LIBFETCH_SONAME@); do
+	find /lib/ -name @LIBFETCH_SONAME@ | while read -r libfetch; do
 		copy_exec "$libfetch"
 	done
 fi
diff --git a/contrib/initramfs/scripts/local-top/zfs b/contrib/initramfs/scripts/local-top/zfs
index e8e5cd26451c..6b80e9f43607 100755
--- a/contrib/initramfs/scripts/local-top/zfs
+++ b/contrib/initramfs/scripts/local-top/zfs
@@ -1,18 +1,11 @@
 #!/bin/sh
-PREREQ="mdadm mdrun multipath"
+# shellcheck disable=SC2154
 
-prereqs()
-{
-        echo "$PREREQ"
-}
 
-case $1 in
-# get pre-requisites
-prereqs)
-        prereqs
+if [ "$1" = "prereqs" ]; then
+        echo mdadm mdrun multipath
         exit 0
-        ;;
-esac
+fi
 
 
 #
@@ -20,10 +13,10 @@ esac
 #
 message()
 {
-        if [ -x /bin/plymouth ] && plymouth --ping; then
-                plymouth message --text="$@"
+        if plymouth --ping 2>/dev/null; then
+                plymouth message --text="$*"
         else
-                echo "$@" >&2
+                echo "$*" >&2
         fi
         return 0
 }
diff --git a/scripts/zfs-tests.sh b/scripts/zfs-tests.sh
index 45e08473d35c..edb9c9f106c2 100755
--- a/scripts/zfs-tests.sh
+++ b/scripts/zfs-tests.sh
@@ -355,7 +355,6 @@ while getopts 'hvqxkfScn:d:s:r:?t:T:u:I:' OPTION; do
 		exit 1
 		;;
 	v)
-		# shellcheck disable=SC2034
 		VERBOSE="yes"
 		;;
 	q)
diff --git a/scripts/zimport.sh b/scripts/zimport.sh
index 0490f785d5b0..0e9c01182b8b 100755
--- a/scripts/zimport.sh
+++ b/scripts/zimport.sh
@@ -164,15 +164,13 @@ populate() {
 	local MAX_DIR_SIZE=$2
 	local MAX_FILE_SIZE=$3
 
-	# shellcheck disable=SC2086
-	mkdir -p $ROOT/{a,b,c,d,e,f,g}/{h,i}
+	mkdir -p "$ROOT"/{a,b,c,d,e,f,g}/{h,i}
 	DIRS=$(find "$ROOT")
 
 	for DIR in $DIRS; do
 		COUNT=$((RANDOM % MAX_DIR_SIZE))
 
-		# shellcheck disable=SC2034
-		for i in $(seq $COUNT); do
+		for _ in $(seq $COUNT); do
 			FILE=$(mktemp -p "$DIR")
 			SIZE=$((RANDOM % MAX_FILE_SIZE))
 			dd if=/dev/urandom of="$FILE" bs=1k \
@@ -334,9 +332,8 @@ fi
 for TAG in $POOL_TAGS; do
 
 	if  [ "$TAG" = "all" ]; then
-		# shellcheck disable=SC2010
-		ALL_TAGS=$(ls "$IMAGES_DIR" | grep "tar.bz2" | \
-		    sed 's/.tar.bz2//' | tr '\n' ' ')
+		ALL_TAGS=$(echo "$IMAGES_DIR"/*.tar.bz2 | \
+		    sed "s|$IMAGES_DIR/||g;s|.tar.bz2||g")
 		NEW_TAGS="$NEW_TAGS $ALL_TAGS"
 	else
 		NEW_TAGS="$NEW_TAGS $TAG"
diff --git a/scripts/zloop.sh b/scripts/zloop.sh
index f2eff6e94096..546e7001776d 100755
--- a/scripts/zloop.sh
+++ b/scripts/zloop.sh
@@ -91,8 +91,8 @@ esac
 
 function core_file
 {
-	# shellcheck disable=SC2012 disable=2086
-        printf "%s" "$(ls -tr1 $coreglob 2> /dev/null | head -1)"
+	# shellcheck disable=SC2012,SC2086
+	ls -tr1 $coreglob 2>/dev/null | head -1
 }
 
 function core_prog
@@ -100,8 +100,7 @@ function core_prog
 	prog=$ZTEST
 	core_id=$($GDB --batch -c "$1" | grep "Core was generated by" | \
 	    tr  \' ' ')
-	# shellcheck disable=SC2076
-	if [[ "$core_id" =~ "zdb "  ]]; then
+	if [[ "$core_id" == *"zdb "* ]]; then
 		prog=$ZDB
 	fi
 	printf "%s" "$prog"
@@ -303,8 +302,7 @@ while [[ $timeout -eq 0 ]] || [[ $curtime -le $((starttime + timeout)) ]]; do
 	zopt="$zopt -s $size"
 	zopt="$zopt -f $workdir"
 
-	# shellcheck disable=SC2124
-	cmd="$ZTEST $zopt $@"
+	cmd="$ZTEST $zopt $*"
 	desc="$(date '+%m/%d %T') $cmd"
 	echo "$desc" | tee -a ztest.history
 	echo "$desc" >>ztest.out
diff --git a/tests/zfs-tests/tests/functional/cli_root/zpool_events/zpool_events_duplicates.ksh b/tests/zfs-tests/tests/functional/cli_root/zpool_events/zpool_events_duplicates.ksh
index d4194a5b8f5b..595eacf5b4b0 100755
--- a/tests/zfs-tests/tests/functional/cli_root/zpool_events/zpool_events_duplicates.ksh
+++ b/tests/zfs-tests/tests/functional/cli_root/zpool_events/zpool_events_duplicates.ksh
@@ -102,8 +102,7 @@ function do_dup_test
 
 		# Read the file a few times to generate some
 		# duplicate errors of the same blocks
-		# shellcheck disable=SC2034
-		for i in {1..15}; do
+		for _ in {1..15}; do
 			dd if=$FILEPATH of=/dev/null bs=128K > /dev/null 2>&1
 		done
 		log_must zinject -c all
diff --git a/tests/zfs-tests/tests/perf/scripts/prefetch_io.sh b/tests/zfs-tests/tests/perf/scripts/prefetch_io.sh
index b8d8ae8859da..d8181f2e8792 100755
--- a/tests/zfs-tests/tests/perf/scripts/prefetch_io.sh
+++ b/tests/zfs-tests/tests/perf/scripts/prefetch_io.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# shellcheck disable=SC1004
 
 #
 # This file and its contents are supplied under the terms of the
@@ -24,38 +25,37 @@ zfs_kstats="/proc/spl/kstat/zfs"
 
 function get_prefetch_ios
 {
-        typeset -l data_misses=`awk '$1 == "prefetch_data_misses" \
-            { print $3 }' $zfs_kstats/arcstats`
-        typeset -l metadata_misses=`awk '$1 == "prefetch_metadata_misses" \
-            { print $3 }' $zfs_kstats/arcstats`
-        typeset -l total_misses=$(( $data_misses + $metadata_misses ))
+	typeset -l data_misses="$(awk '$1 == "prefetch_data_misses" \
+	    { print $3; exit }' "$zfs_kstats/arcstats")"
+	typeset -l metadata_misses="$(awk '$1 == "prefetch_metadata_misses" \
+	    { print $3; exit }' "$zfs_kstats/arcstats")"
+	typeset -l total_misses=$(( data_misses + metadata_misses ))
 
-        echo $total_misses
+	echo "$total_misses"
 }
 
 function get_prefetched_demand_reads
 {
-	typeset -l demand_reads=`awk '$1 == "demand_hit_predictive_prefetch" \
-	    { print $3 }' $zfs_kstats/arcstats`
+	typeset -l demand_reads="$(awk '$1 == "demand_hit_predictive_prefetch" \
+	    { print $3; exit }' "$zfs_kstats/arcstats")"
 
-	echo $demand_reads
+	echo "$demand_reads"
 }
 
 function get_async_upgrade_sync
 {
-	typeset -l sync_wait=`awk '$1 == "async_upgrade_sync" \
-	    { print $3 }' $zfs_kstats/arcstats`
+	typeset -l sync_wait="$(awk '$1 == "async_upgrade_sync" \
+	    { print $3; exit }' "$zfs_kstats/arcstats")"
 
-	echo $sync_wait
+	echo "$sync_wait"
 }
 
 if [ $# -ne 2 ]
 then
-	echo "Usage: `basename $0` <poolname> interval" >&2
+	echo "Usage: ${0##*/} poolname interval" >&2
 	exit 1
 fi
 
-poolname=$1
 interval=$2
 prefetch_ios=$(get_prefetch_ios)
 prefetched_demand_reads=$(get_prefetched_demand_reads)
@@ -64,19 +64,19 @@ async_upgrade_sync=$(get_async_upgrade_sync)
 while true
 do
 	new_prefetch_ios=$(get_prefetch_ios)
-	printf "%u\n%-24s\t%u\n" $(date +%s) "prefetch_ios" \
-	    $(( $new_prefetch_ios - $prefetch_ios ))
+	printf "%u\n%-24s\t%u\n" "$(date +%s)" "prefetch_ios" \
+	    $(( new_prefetch_ios - prefetch_ios ))
 	prefetch_ios=$new_prefetch_ios
 
 	new_prefetched_demand_reads=$(get_prefetched_demand_reads)
 	printf "%-24s\t%u\n" "prefetched_demand_reads" \
-	    $(( $new_prefetched_demand_reads - $prefetched_demand_reads ))
+	    $(( new_prefetched_demand_reads - prefetched_demand_reads ))
 	prefetched_demand_reads=$new_prefetched_demand_reads
 
 	new_async_upgrade_sync=$(get_async_upgrade_sync)
 	printf "%-24s\t%u\n" "async_upgrade_sync" \
-	    $(( $new_async_upgrade_sync - $async_upgrade_sync ))
+	    $(( new_async_upgrade_sync - async_upgrade_sync ))
 	async_upgrade_sync=$new_async_upgrade_sync
 
-	sleep $interval
+	sleep "$interval"
 done