diff --git a/ctdb/config/events/legacy/13.per_ip_routing.script b/ctdb/config/events/legacy/13.per_ip_routing.script
index e25647613bb..d7949c6dedb 100755
--- a/ctdb/config/events/legacy/13.per_ip_routing.script
+++ b/ctdb/config/events/legacy/13.per_ip_routing.script
@@ -346,7 +346,7 @@ remove_bogus_routes ()
 	# be done with grep, but let's do it with shell prefix removal
 	# to avoid unnecessary processes.  This falls through if
 	# "@${_i}@" isn't present in $_ips.
-	[ "$_ips" = "${_ips#*@${_i}@}" ] || continue
+	[ "$_ips" = "${_ips#*@"${_i}"@}" ] || continue
 
 	echo "Removing ip rule/routes for unhosted public address $_i"
 	del_routing_for_ip "$_i"
diff --git a/ctdb/tests/run_tests.sh b/ctdb/tests/run_tests.sh
index cb7884054aa..ff431f8831f 100755
--- a/ctdb/tests/run_tests.sh
+++ b/ctdb/tests/run_tests.sh
@@ -235,7 +235,7 @@ run_one_test ()
     local test_dir test_suite_dir reldir
     test_dir=$(cd "$CTDB_TEST_DIR" && pwd)
     test_suite_dir=$(cd "$CTDB_TEST_SUITE_DIR" && pwd)
-    reldir="${test_suite_dir#${test_dir}/}"
+    reldir="${test_suite_dir#"${test_dir}"/}"
 
     export CTDB_TEST_TMP_DIR="${test_state_dir}/${reldir}"
     rm -rf "$CTDB_TEST_TMP_DIR"
@@ -260,7 +260,7 @@ run_tests ()
 			# Can't find it?  Check relative to CTDB_TEST_DIR.
 			# Strip off current directory from beginning,
 			# if there, just to make paths more friendly.
-			f="${CTDB_TEST_DIR#${PWD}/}/${f}"
+			f="${CTDB_TEST_DIR#"${PWD}"/}/${f}"
 		fi
 
 		if [ -d "$f" ] ; then
@@ -268,7 +268,7 @@ run_tests ()
 
 			test_dir=$(cd "$CTDB_TEST_DIR" && pwd)
 			dir=$(cd "$f" && pwd)
-			reldir="${dir#${test_dir}/}"
+			reldir="${dir#"${test_dir}"/}"
 
 			case "$reldir" in
 			*/*/*)
diff --git a/ctdb/tests/scripts/integration.bash b/ctdb/tests/scripts/integration.bash
index dbf9af0b346..65e974e4e36 100644
--- a/ctdb/tests/scripts/integration.bash
+++ b/ctdb/tests/scripts/integration.bash
@@ -469,8 +469,10 @@ node_has_status ()
 		while read -r line ; do
 			# This needs to be done in 2 steps to
 			# avoid false matches.
-			local line_bits="${line#|${pnn}|*|}"
+			local line_bits="${line#|"${pnn}"|*|}"
 			[ "$line_bits" = "$line" ] && continue
+			# shellcheck disable=SC2295
+			# This depends on $bits being a pattern
 			[ "${line_bits#${bits}}" != "$line_bits" ] && \
 				return 0
 		done
diff --git a/ctdb/tools/onnode b/ctdb/tools/onnode
index f2be62e5af4..425db8047cc 100755
--- a/ctdb/tools/onnode
+++ b/ctdb/tools/onnode
@@ -148,7 +148,7 @@ get_nodes_with_status ()
 	fi
 	local nl="
 "
-	ctdb_status_output="${ctdb_status_output#*${nl}}"
+	ctdb_status_output="${ctdb_status_output#*"${nl}"}"
     fi
 
     (
@@ -301,7 +301,7 @@ else
     # If $nodes contains a space or a newline then assume multiple nodes.
     nl="
 "
-    [ "$nodes" != "${nodes%[ ${nl}]*}" ] && verbose=true
+    [ "$nodes" != "${nodes%[ "${nl}"]*}" ] && verbose=true
 fi
 
 pids=""