diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index 2ef9f636eb..1472a1d2f6 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -178,9 +178,6 @@
 ./staging/src/k8s.io/metrics/hack/verify-codegen.sh
 ./staging/src/k8s.io/node-api/hack/update-codegen.sh
 ./staging/src/k8s.io/node-api/hack/verify-codegen.sh
-./staging/src/k8s.io/sample-apiserver/hack/build-image.sh
-./staging/src/k8s.io/sample-apiserver/hack/update-codegen.sh
-./staging/src/k8s.io/sample-apiserver/hack/verify-codegen.sh
 ./test/cmd/apply.sh
 ./test/cmd/apps.sh
 ./test/cmd/authorization.sh
diff --git a/staging/src/k8s.io/sample-apiserver/hack/build-image.sh b/staging/src/k8s.io/sample-apiserver/hack/build-image.sh
index c1b3c76858..1402e366a9 100755
--- a/staging/src/k8s.io/sample-apiserver/hack/build-image.sh
+++ b/staging/src/k8s.io/sample-apiserver/hack/build-image.sh
@@ -14,8 +14,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+set -o errexit
+set -o nounset
+set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/../../../../..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/../../../../..
 source "${KUBE_ROOT}/hack/lib/util.sh"
 
 # Register function to be called on EXIT to remove generated binary.
diff --git a/staging/src/k8s.io/sample-apiserver/hack/update-codegen.sh b/staging/src/k8s.io/sample-apiserver/hack/update-codegen.sh
index 98c9ae9e1a..d4883f401b 100755
--- a/staging/src/k8s.io/sample-apiserver/hack/update-codegen.sh
+++ b/staging/src/k8s.io/sample-apiserver/hack/update-codegen.sh
@@ -18,24 +18,24 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-SCRIPT_ROOT=$(dirname ${BASH_SOURCE})/..
-CODEGEN_PKG=${CODEGEN_PKG:-$(cd ${SCRIPT_ROOT}; ls -d -1 ./vendor/k8s.io/code-generator 2>/dev/null || echo ../code-generator)}
+SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+CODEGEN_PKG=${CODEGEN_PKG:-$(cd "${SCRIPT_ROOT}"; ls -d -1 ./vendor/k8s.io/code-generator 2>/dev/null || echo ../code-generator)}
 
 # generate the code with:
 # --output-base    because this script should also be able to run inside the vendor dir of
 #                  k8s.io/kubernetes. The output-base is needed for the generators to output into the vendor dir
 #                  instead of the $GOPATH directly. For normal projects this can be dropped.
-${CODEGEN_PKG}/generate-groups.sh all \
+"${CODEGEN_PKG}/generate-groups.sh" all \
   k8s.io/sample-apiserver/pkg/client k8s.io/sample-apiserver/pkg/apis \
   "wardle:v1alpha1,v1beta1" \
-  --output-base "$(dirname ${BASH_SOURCE})/../../.." \
-  --go-header-file ${SCRIPT_ROOT}/hack/boilerplate.go.txt
+  --output-base "$(dirname "${BASH_SOURCE[0]}")/../../.." \
+  --go-header-file "${SCRIPT_ROOT}"/hack/boilerplate.go.txt
 
-${CODEGEN_PKG}/generate-internal-groups.sh "deepcopy,defaulter,conversion" \
+"${CODEGEN_PKG}/generate-internal-groups.sh" "deepcopy,defaulter,conversion" \
   k8s.io/sample-apiserver/pkg/client k8s.io/sample-apiserver/pkg/apis k8s.io/sample-apiserver/pkg/apis \
   "wardle:v1alpha1,v1beta1" \
-  --output-base "$(dirname ${BASH_SOURCE})/../../.." \
-  --go-header-file ${SCRIPT_ROOT}/hack/boilerplate.go.txt
+  --output-base "$(dirname "${BASH_SOURCE[0]}")/../../.." \
+  --go-header-file "${SCRIPT_ROOT}/hack/boilerplate.go.txt"
 
 # To use your own boilerplate text use:
-#   --go-header-file ${SCRIPT_ROOT}/hack/custom-boilerplate.go.txt
+#   --go-header-file "${SCRIPT_ROOT}/hack/custom-boilerplate.go.txt"
diff --git a/staging/src/k8s.io/sample-apiserver/hack/verify-codegen.sh b/staging/src/k8s.io/sample-apiserver/hack/verify-codegen.sh
index ab43ba23d0..d91566e622 100755
--- a/staging/src/k8s.io/sample-apiserver/hack/verify-codegen.sh
+++ b/staging/src/k8s.io/sample-apiserver/hack/verify-codegen.sh
@@ -18,8 +18,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")/..
-SCRIPT_BASE=${SCRIPT_ROOT}/../..
+SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 DIFFROOT="${SCRIPT_ROOT}/pkg"
 TMP_DIFFROOT="${SCRIPT_ROOT}/_tmp/pkg"