diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index d4734a1e89..21b38d59c0 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -95,17 +95,8 @@
 ./hack/update-all.sh
 ./hack/update-bazel.sh
 ./hack/update-codegen.sh
-./hack/update-generated-device-plugin-dockerized.sh
-./hack/update-generated-device-plugin.sh
-./hack/update-generated-docs.sh
 ./hack/update-generated-kms-dockerized.sh
-./hack/update-generated-kms.sh
-./hack/update-generated-kubelet-plugin-registration-dockerized.sh
-./hack/update-generated-kubelet-plugin-registration.sh
-./hack/update-generated-pod-resources-dockerized.sh
-./hack/update-generated-pod-resources.sh
 ./hack/update-generated-protobuf-dockerized.sh
-./hack/update-generated-protobuf.sh
 ./hack/update-generated-runtime-dockerized.sh
 ./hack/update-generated-runtime.sh
 ./hack/update-generated-swagger-docs.sh
diff --git a/hack/update-generated-device-plugin-dockerized.sh b/hack/update-generated-device-plugin-dockerized.sh
index 62c5fb34d0..4812baeebd 100755
--- a/hack/update-generated-device-plugin-dockerized.sh
+++ b/hack/update-generated-device-plugin-dockerized.sh
@@ -18,10 +18,10 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE}")/../" && pwd -P)"
+KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../" && pwd -P)"
 DEVICE_PLUGIN_ALPHA="${KUBE_ROOT}/pkg/kubelet/apis/deviceplugin/v1alpha/"
 DEVICE_PLUGIN_V1BETA1="${KUBE_ROOT}/pkg/kubelet/apis/deviceplugin/v1beta1/"
 
 source "${KUBE_ROOT}/hack/lib/protoc.sh"
-kube::protoc::generate_proto ${DEVICE_PLUGIN_ALPHA}
-kube::protoc::generate_proto ${DEVICE_PLUGIN_V1BETA1}
+kube::protoc::generate_proto "${DEVICE_PLUGIN_ALPHA}"
+kube::protoc::generate_proto "${DEVICE_PLUGIN_V1BETA1}"
diff --git a/hack/update-generated-device-plugin.sh b/hack/update-generated-device-plugin.sh
index bfd63d8659..6652500887 100755
--- a/hack/update-generated-device-plugin.sh
+++ b/hack/update-generated-device-plugin.sh
@@ -18,10 +18,10 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 # NOTE: All output from this script needs to be copied back to the calling
 # source tree.  This is managed in kube::build::copy_output in build/common.sh.
 # If the output set is changed update that function.
 
-${KUBE_ROOT}/build/run.sh hack/update-generated-device-plugin-dockerized.sh "$@"
+"${KUBE_ROOT}/build/run.sh" hack/update-generated-device-plugin-dockerized.sh "$@"
diff --git a/hack/update-generated-docs.sh b/hack/update-generated-docs.sh
index e1d621085b..220c2dc3da 100755
--- a/hack/update-generated-docs.sh
+++ b/hack/update-generated-docs.sh
@@ -22,7 +22,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::golang::setup_env
diff --git a/hack/update-generated-kms.sh b/hack/update-generated-kms.sh
index 431b1bf41b..6ae29450d0 100755
--- a/hack/update-generated-kms.sh
+++ b/hack/update-generated-kms.sh
@@ -18,12 +18,12 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 # NOTE: All output from this script needs to be copied back to the calling
 # source tree.  This is managed in kube::build::copy_output in build/common.sh.
 # If the output set is changed update that function.
 
-${KUBE_ROOT}/build/run.sh hack/update-generated-kms-dockerized.sh "$@"
+"${KUBE_ROOT}/build/run.sh" hack/update-generated-kms-dockerized.sh "$@"
 
 # ex: ts=2 sw=2 et filetype=sh
diff --git a/hack/update-generated-kubelet-plugin-registration-dockerized.sh b/hack/update-generated-kubelet-plugin-registration-dockerized.sh
index 4cdbd21136..3176a16f85 100755
--- a/hack/update-generated-kubelet-plugin-registration-dockerized.sh
+++ b/hack/update-generated-kubelet-plugin-registration-dockerized.sh
@@ -18,14 +18,14 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE}")/../" && pwd -P)"
+KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../" && pwd -P)"
 KUBELET_PLUGIN_REGISTRATION_V1ALPHA="${KUBE_ROOT}/pkg/kubelet/apis/pluginregistration/v1alpha1/"
 KUBELET_PLUGIN_REGISTRATION_V1BETA="${KUBE_ROOT}/pkg/kubelet/apis/pluginregistration/v1beta1/"
 KUBELET_EXAMPLE_PLUGIN_V1BETA1="${KUBE_ROOT}/pkg/kubelet/util/pluginwatcher/example_plugin_apis/v1beta1/"
 KUBELET_EXAMPLE_PLUGIN_V1BETA2="${KUBE_ROOT}/pkg/kubelet/util/pluginwatcher/example_plugin_apis/v1beta2/"
 
 source "${KUBE_ROOT}/hack/lib/protoc.sh"
-kube::protoc::generate_proto ${KUBELET_PLUGIN_REGISTRATION_V1ALPHA}
-kube::protoc::generate_proto ${KUBELET_PLUGIN_REGISTRATION_V1BETA}
-kube::protoc::generate_proto ${KUBELET_EXAMPLE_PLUGIN_V1BETA1}
-kube::protoc::generate_proto ${KUBELET_EXAMPLE_PLUGIN_V1BETA2}
+kube::protoc::generate_proto "${KUBELET_PLUGIN_REGISTRATION_V1ALPHA}"
+kube::protoc::generate_proto "${KUBELET_PLUGIN_REGISTRATION_V1BETA}"
+kube::protoc::generate_proto "${KUBELET_EXAMPLE_PLUGIN_V1BETA1}"
+kube::protoc::generate_proto "${KUBELET_EXAMPLE_PLUGIN_V1BETA2}"
diff --git a/hack/update-generated-kubelet-plugin-registration.sh b/hack/update-generated-kubelet-plugin-registration.sh
index 4e4a598d6c..46e3d1f8c8 100755
--- a/hack/update-generated-kubelet-plugin-registration.sh
+++ b/hack/update-generated-kubelet-plugin-registration.sh
@@ -18,10 +18,10 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 # NOTE: All output from this script needs to be copied back to the calling
 # source tree.  This is managed in kube::build::copy_output in build/common.sh.
 # If the output set is changed update that function.
 
-${KUBE_ROOT}/build/run.sh hack/update-generated-kubelet-plugin-registration-dockerized.sh "$@"
+"${KUBE_ROOT}/build/run.sh" hack/update-generated-kubelet-plugin-registration-dockerized.sh "$@"
diff --git a/hack/update-generated-pod-resources-dockerized.sh b/hack/update-generated-pod-resources-dockerized.sh
index d11b136b59..8dcc2b5757 100755
--- a/hack/update-generated-pod-resources-dockerized.sh
+++ b/hack/update-generated-pod-resources-dockerized.sh
@@ -18,8 +18,8 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE}")/../" && pwd -P)"
+KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../" && pwd -P)"
 POD_RESOURCES_ALPHA="${KUBE_ROOT}/pkg/kubelet/apis/podresources/v1alpha1/"
 
 source "${KUBE_ROOT}/hack/lib/protoc.sh"
-kube::protoc::generate_proto ${POD_RESOURCES_ALPHA}
+kube::protoc::generate_proto "${POD_RESOURCES_ALPHA}"
diff --git a/hack/update-generated-pod-resources.sh b/hack/update-generated-pod-resources.sh
index bdf8c584c0..6fa2b1d446 100755
--- a/hack/update-generated-pod-resources.sh
+++ b/hack/update-generated-pod-resources.sh
@@ -18,10 +18,10 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 # NOTE: All output from this script needs to be copied back to the calling
 # source tree.  This is managed in kube::build::copy_output in build/common.sh.
 # If the output set is changed update that function.
 
-${KUBE_ROOT}/build/run.sh hack/update-generated-pod-resources-dockerized.sh "$@"
+"${KUBE_ROOT}/build/run.sh" hack/update-generated-pod-resources-dockerized.sh "$@"
diff --git a/hack/update-generated-protobuf.sh b/hack/update-generated-protobuf.sh
index bf8c5d4002..2077320cc7 100755
--- a/hack/update-generated-protobuf.sh
+++ b/hack/update-generated-protobuf.sh
@@ -18,7 +18,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 # NOTE: All output from this script needs to be copied back to the calling
 # source tree.  This is managed in kube::build::copy_output in build/common.sh.