diff --git a/bats/tests/containers/switch-engines.bats b/bats/tests/containers/switch-engines.bats
index f1d0d897d32..94f485146e6 100644
--- a/bats/tests/containers/switch-engines.bats
+++ b/bats/tests/containers/switch-engines.bats
@@ -4,7 +4,7 @@ load '../helpers/load'
 RD_CONTAINER_ENGINE=moby
 
 switch_container_engine() {
-    local name=$1
+    local name="$1"
     RD_CONTAINER_ENGINE="${name}"
     rdctl set --container-engine.name="${name}"
     wait_for_container_engine
@@ -40,7 +40,7 @@ verify_post_switch_containers() {
 }
 
 switch_back_verify_post_switch_containers() {
-    local name=$1
+    local name="$1"
     switch_container_engine "${name}"
     try --max 12 --delay 5 verify_post_switch_containers
     assert_success
diff --git a/bats/tests/helpers/commands.bash b/bats/tests/helpers/commands.bash
index e2d4fb31444..b8d097e0f6e 100644
--- a/bats/tests/helpers/commands.bash
+++ b/bats/tests/helpers/commands.bash
@@ -1,5 +1,5 @@
 EXE=""
-PLATFORM=$OS
+PLATFORM="$OS"
 if is_windows; then
     PLATFORM=linux
     if using_windows_exe; then
diff --git a/bats/tests/helpers/defaults.bash b/bats/tests/helpers/defaults.bash
index bfbc132b2f4..d1adff4bf5a 100644
--- a/bats/tests/helpers/defaults.bash
+++ b/bats/tests/helpers/defaults.bash
@@ -1,5 +1,5 @@
 validate_enum() {
-    local var=$1
+    local var="$1"
     shift
     for value in "$@"; do
         if [ "${!var}" = "$value" ]; then
diff --git a/bats/tests/helpers/kubernetes.bash b/bats/tests/helpers/kubernetes.bash
index d02defe017f..8f7fd0bf8f1 100644
--- a/bats/tests/helpers/kubernetes.bash
+++ b/bats/tests/helpers/kubernetes.bash
@@ -10,8 +10,8 @@ wait_for_apiserver() {
         run kubectl get node -o jsonpath="{.items[0].status.nodeInfo.kubeletVersion}"
         if [ "$status" -eq 0 ]; then
             # Turn "v1.23.4+k3s1" into "1.23.4"
-            local version=${output#v}
-            version=${version%+*}
+            local version="${output#v}"
+            version="${version%+*}"
             [ "$version" == "$desired_version" ] && return 0
         fi
         sleep 1
diff --git a/bats/tests/helpers/load.bash b/bats/tests/helpers/load.bash
index 79013142cc8..a74133588c4 100644
--- a/bats/tests/helpers/load.bash
+++ b/bats/tests/helpers/load.bash
@@ -4,8 +4,8 @@ absolute_path() {
     (cd "$1"; pwd)
 }
 
-PATH_BATS_HELPERS=$(absolute_path "$(dirname "${BASH_SOURCE[0]}")")
-PATH_BATS_ROOT=$(absolute_path "$PATH_BATS_HELPERS/../..")
+PATH_BATS_HELPERS="$(absolute_path "$(dirname "${BASH_SOURCE[0]}")")"
+PATH_BATS_ROOT="$(absolute_path "$PATH_BATS_HELPERS/../..")"
 
 # Use fatal() to abort loading helpers; don't run any tests
 fatal() {
diff --git a/bats/tests/helpers/os.bash b/bats/tests/helpers/os.bash
index ca4a7b8b10b..edab70efaa7 100644
--- a/bats/tests/helpers/os.bash
+++ b/bats/tests/helpers/os.bash
@@ -1,7 +1,7 @@
 # https://www.shellcheck.net/wiki/SC2120 -- disabled due to complaining about not referencing arguments that are optional on functions is_platformName
 # shellcheck disable=SC2120
-UNAME=$(uname)
-ARCH=$(uname -m)
+UNAME="$(uname)"
+ARCH="$(uname -m)"
 
 case $UNAME in
 Darwin)
diff --git a/bats/tests/helpers/paths.bash b/bats/tests/helpers/paths.bash
index c8ea5654512..ba3c81ccf31 100644
--- a/bats/tests/helpers/paths.bash
+++ b/bats/tests/helpers/paths.bash
@@ -1,16 +1,16 @@
 # PATH_BATS_ROOT and PATH_BATS_HELPERS are already set by load.bash
 
-PATH_REPO_ROOT=$(absolute_path "$PATH_BATS_ROOT/..")
+PATH_REPO_ROOT="$(absolute_path "$PATH_BATS_ROOT/..")"
 
 inside_repo_clone() {
     [ -d "$PATH_REPO_ROOT/pkg/rancher-desktop" ]
 }
 
 set_path_resources() {
-    local system=$1
-    local user=$2
-    local dist=$3
-    local subdir=$4
+    local system="$1"
+    local user="$2"
+    local dist="$3"
+    local subdir="$4"
 
     if [ -z "$RD_LOCATION" ]; then
         if [ -d "$system" ]; then
diff --git a/bats/tests/helpers/utils.bash b/bats/tests/helpers/utils.bash
index 616cbd53d63..1aaa4973f49 100644
--- a/bats/tests/helpers/utils.bash
+++ b/bats/tests/helpers/utils.bash
@@ -32,11 +32,11 @@ try() {
     while [[ $# -gt 0 ]] && [[ $1 == -* ]]; do
         case "$1" in
         --max)
-            max=$2
+            max="$2"
             shift
             ;;
         --delay)
-            delay=$2
+            delay="$2"
             shift
             ;;
         --)
@@ -55,13 +55,13 @@ try() {
         run "$@"
         [ "$status" -eq 0 ] && return
         sleep "$delay"
-        count=$((count + 1))
+        count="$((count + 1))"
     done
 }
 
 update_allowed_patterns() {
-    local enabled=$1
-    local patterns=$2
+    local enabled="$1"
+    local patterns="$2"
     rdctl api settings -X PUT --input - <<EOF
 {
   "version": 7,
diff --git a/bats/tests/k8s/helm-install-rancher.bats b/bats/tests/k8s/helm-install-rancher.bats
index 06a69004356..39bda587206 100644
--- a/bats/tests/k8s/helm-install-rancher.bats
+++ b/bats/tests/k8s/helm-install-rancher.bats
@@ -28,7 +28,7 @@ setup() {
 
 get_host() {
     if is_windows; then
-        local LB_IP=$(kubectl get svc traefik --namespace kube-system | awk 'NR==2{print $4}')
+        local LB_IP="$(kubectl get svc traefik --namespace kube-system | awk 'NR==2{print $4}')"
         echo "$LB_IP.sslip.io"
     else
         echo "localhost"
diff --git a/bats/tests/k8s/up-downgrade-k8s.bats b/bats/tests/k8s/up-downgrade-k8s.bats
index ce2de5e4b09..4870a02eda4 100644
--- a/bats/tests/k8s/up-downgrade-k8s.bats
+++ b/bats/tests/k8s/up-downgrade-k8s.bats
@@ -74,7 +74,7 @@ verify_images() {
 # the current k8s version in that directory.
 
 verify_kuberlr_for_version() {
-    local K8S_VERSION=$1
+    local K8S_VERSION="$1"
     local KUBERLR_DIR="${HOME}/.kuberlr/${OS}-${ARCH_FOR_KUBERLR}"
     rm -f "${KUBERLR_DIR}/kubectl"*
     run kubectl version
diff --git a/bats/tests/k8s/verify-cached-images.bats b/bats/tests/k8s/verify-cached-images.bats
index d187f99592e..2cc5b20383a 100644
--- a/bats/tests/k8s/verify-cached-images.bats
+++ b/bats/tests/k8s/verify-cached-images.bats
@@ -13,8 +13,8 @@ load '../helpers/load'
 }
 
 test_k8s_version_has_correct_cached_extension() {
-    local K8S_VERSION=$1
-    local EXTENSION=$2
+    local K8S_VERSION="$1"
+    local EXTENSION="$2"
     rdctl set --kubernetes-version "$K8S_VERSION"
     wait_for_apiserver "$K8S_VERSION"
     run ls "$PATH_CACHE/k3s/v${K8S_VERSION}"*k3s*/k3s-airgap-images-*."${EXTENSION}"