diff --git a/test/TEST-50-DISSECT/test.sh b/test/TEST-50-DISSECT/test.sh
index 9d42e4891c..86a4f079bb 100755
--- a/test/TEST-50-DISSECT/test.sh
+++ b/test/TEST-50-DISSECT/test.sh
@@ -23,6 +23,7 @@ test_append_files() {
         install_dmevent
         generate_module_dependencies
         inst_binary losetup
+        inst_binary wc
         install_verity_minimal
     )
 }
diff --git a/test/units/testsuite-02.sh b/test/units/testsuite-02.sh
index 1ff1c3347b..da02304a32 100755
--- a/test/units/testsuite-02.sh
+++ b/test/units/testsuite-02.sh
@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
-#set -ex
-#set -o pipefail
+set -eux
+set -o pipefail
 
 NPROC=$(nproc)
 MAX_QUEUE_SIZE=${NPROC:-2}
-IFS=$'\n' TEST_LIST=($(ls /usr/lib/systemd/tests/test-*))
+mapfile -t TEST_LIST < <(find /usr/lib/systemd/tests/ -maxdepth 1 -type f -name "test-*")
 
 # reset state
-rm /failed-tests /skipped-tests /skipped
+rm -fv /failed-tests /skipped-tests /skipped
 
 # Check & report test results
 # Arguments:
@@ -54,10 +54,9 @@ for task in "${TEST_LIST[@]}"; do
     # until one of the tasks finishes, so we can replace it.
     while [[ ${#running[@]} -ge $MAX_QUEUE_SIZE ]]; do
         for key in "${!running[@]}"; do
-            if ! kill -0 ${running[$key]} &>/dev/null; then
+            if ! kill -0 "${running[$key]}" &>/dev/null; then
                 # Task has finished, report its result and drop it from the queue
-                wait ${running[$key]}
-                ec=$?
+                wait "${running[$key]}" && ec=0 || ec=$?
                 report_result "$key" $ec
                 unset running["$key"]
                 # Break from inner for loop and outer while loop to skip
diff --git a/test/units/testsuite-03.sh b/test/units/testsuite-03.sh
index 5a2dadd6b8..8a8ba870e8 100755
--- a/test/units/testsuite-03.sh
+++ b/test/units/testsuite-03.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
+set -o pipefail
 
 # Test merging of a --job-mode=ignore-dependencies job into a previously
 # installed job.
@@ -17,7 +18,7 @@ grep 'hello\.service.*waiting' /root/list-jobs.txt
 START_SEC=$(date -u '+%s')
 systemctl start --job-mode=ignore-dependencies hello
 END_SEC=$(date -u '+%s')
-ELAPSED=$(($END_SEC-$START_SEC))
+ELAPSED=$((END_SEC-START_SEC))
 
 test "$ELAPSED" -lt 3
 
@@ -75,14 +76,14 @@ EOF
 START_SEC=$(date -u '+%s')
 systemctl start --wait wait2.service
 END_SEC=$(date -u '+%s')
-ELAPSED=$(($END_SEC-$START_SEC))
+ELAPSED=$((END_SEC-START_SEC))
 [[ "$ELAPSED" -ge 2 ]] && [[ "$ELAPSED" -le 4 ]] || exit 1
 
 # wait5fail fails, so systemctl should fail
 START_SEC=$(date -u '+%s')
 systemctl start --wait wait2.service wait5fail.service && { echo 'unexpected success'; exit 1; }
 END_SEC=$(date -u '+%s')
-ELAPSED=$(($END_SEC-$START_SEC))
+ELAPSED=$((END_SEC-START_SEC))
 [[ "$ELAPSED" -ge 5 ]] && [[ "$ELAPSED" -le 7 ]] || exit 1
 
 # Test time-limited scopes
@@ -91,7 +92,7 @@ set +e
 systemd-run --scope --property=RuntimeMaxSec=3s sleep 10
 RESULT=$?
 END_SEC=$(date -u '+%s')
-ELAPSED=$(($END_SEC-$START_SEC))
+ELAPSED=$((END_SEC-START_SEC))
 [[ "$ELAPSED" -ge 3 ]] && [[ "$ELAPSED" -le 5 ]] || exit 1
 [[ "$RESULT" -ne 0 ]] || exit 1
 
diff --git a/test/units/testsuite-04.sh b/test/units/testsuite-04.sh
index a2a1292380..da5f9ee2af 100755
--- a/test/units/testsuite-04.sh
+++ b/test/units/testsuite-04.sh
@@ -1,20 +1,19 @@
 #!/usr/bin/env bash
-set -x
-set -e
+set -eux
 set -o pipefail
 
 # Test stdout stream
 
 # Skip empty lines
 ID=$(journalctl --new-id128 | sed -n 2p)
->/expected
+: >/expected
 printf $'\n\n\n' | systemd-cat -t "$ID" --level-prefix false
 journalctl --sync
 journalctl -b -o cat -t "$ID" >/output
 cmp /expected /output
 
 ID=$(journalctl --new-id128 | sed -n 2p)
->/expected
+: >/expected
 printf $'<5>\n<6>\n<7>\n' | systemd-cat -t "$ID" --level-prefix true
 journalctl --sync
 journalctl -b -o cat -t "$ID" >/output
@@ -55,7 +54,7 @@ ID=$(journalctl --new-id128 | sed -n 2p)
 printf $'foo' | systemd-cat -t "$ID" --level-prefix false
 journalctl --sync
 journalctl -b -o export --output-fields=MESSAGE,FOO --output-fields=PRIORITY,MESSAGE -t "$ID" >/output
-[[ `grep -c . /output` -eq 6 ]]
+[[ $(grep -c . /output) -eq 6 ]]
 grep -q '^__CURSOR=' /output
 grep -q '^MESSAGE=foo$' /output
 grep -q '^PRIORITY=6$' /output
@@ -83,7 +82,7 @@ journalctl --sync
 # We can drop this grep when https://github.com/systemd/systemd/issues/13937
 # has a fix.
 journalctl -b -o export -t "$ID" --output-fields=_PID | grep '^_PID=' >/output
-[[ `grep -c . /output` -eq 2 ]]
+[[ $(grep -c . /output) -eq 2 ]]
 grep -q "^_PID=$PID" /output
 grep -vq "^_PID=$PID" /output
 
diff --git a/test/units/testsuite-05.sh b/test/units/testsuite-05.sh
index 9168e72799..c98d849b08 100755
--- a/test/units/testsuite-05.sh
+++ b/test/units/testsuite-05.sh
@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
-set -x
-set -e
+set -eux
 set -o pipefail
 
 P=/run/systemd/system.conf.d
@@ -19,7 +18,9 @@ systemctl daemon-reload
 [[ "$(systemctl show -P LimitNOFILESoft testsuite-05.service)" = "10000" ]]
 [[ "$(systemctl show -P LimitNOFILE testsuite-05.service)" = "16384" ]]
 
+# shellcheck disable=SC2016
 systemd-run --wait -t bash -c '[[ "$(ulimit -n -S)" = "10000" ]]'
+# shellcheck disable=SC2016
 systemd-run --wait -t bash -c '[[ "$(ulimit -n -H)" = "16384" ]]'
 
 touch /testok
diff --git a/test/units/testsuite-06.sh b/test/units/testsuite-06.sh
index f9b106da7b..f89698ded4 100755
--- a/test/units/testsuite-06.sh
+++ b/test/units/testsuite-06.sh
@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
-set -x
-set -e
+set -eux
 set -o pipefail
 
 echo 1 >/sys/fs/selinux/enforce || {
diff --git a/test/units/testsuite-07.sh b/test/units/testsuite-07.sh
index fbb2d1d30a..bd1da341ac 100755
--- a/test/units/testsuite-07.sh
+++ b/test/units/testsuite-07.sh
@@ -1,31 +1,31 @@
 #!/usr/bin/env bash
-set -x
-set -e
+set -eux
+set -o pipefail
 
->/failed
+: >/failed
 
-cat <<'EOL' >/lib/systemd/system/my.service
+cat >/lib/systemd/system/my.service <<EOF
 [Service]
 Type=oneshot
 ExecStart=/bin/echo Timer runs me
-EOL
+EOF
 
-cat <<'EOL' >/lib/systemd/system/my.timer
+cat >/lib/systemd/system/my.timer <<EOF
 [Timer]
 OnBootSec=10s
 OnUnitInactiveSec=1h
-EOL
+EOF
 
 systemctl unmask my.timer
 
 systemctl start my.timer
 
 mkdir -p /etc/systemd/system/my.timer.d/
-cat <<'EOL' >/etc/systemd/system/my.timer.d/override.conf
+cat >/etc/systemd/system/my.timer.d/override.conf <<EOF
 [Timer]
 OnBootSec=10s
 OnUnitInactiveSec=1h
-EOL
+EOF
 
 systemctl daemon-reload
 
diff --git a/test/units/testsuite-11.sh b/test/units/testsuite-11.sh
index 708c7cebb7..97ab8be757 100755
--- a/test/units/testsuite-11.sh
+++ b/test/units/testsuite-11.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
-set -x
+set -eux
+set -o pipefail
 
-systemctl start fail-on-restart.service
+systemctl --no-block start fail-on-restart.service
 active_state=$(systemctl show --value --property ActiveState fail-on-restart.service)
 while [[ "$active_state" == "activating" || "$active_state" == "active" ]]; do
     sleep 1
diff --git a/test/units/testsuite-12.sh b/test/units/testsuite-12.sh
index 7e7b0ec25a..c4ee600abe 100755
--- a/test/units/testsuite-12.sh
+++ b/test/units/testsuite-12.sh
@@ -1,10 +1,9 @@
 #!/usr/bin/env bash
-set -x
-set -e
+set -eux
 set -o pipefail
 
 U=/run/systemd/system/test12.socket
-cat <<'EOF' >$U
+cat >$U <<EOF
 [Unit]
 Description=Test 12 socket
 [Socket]
@@ -14,7 +13,7 @@ SocketGroup=adm
 SocketMode=0660
 EOF
 
-cat <<'EOF' >/run/systemd/system/test12@.service
+cat >/run/systemd/system/test12@.service <<EOF
 [Unit]
 Description=Test service
 [Service]
diff --git a/test/units/testsuite-13.sh b/test/units/testsuite-13.sh
index 3e66aa9d54..0d468b2db1 100755
--- a/test/units/testsuite-13.sh
+++ b/test/units/testsuite-13.sh
@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
-set -x
-set -e
-set -u
+# shellcheck disable=SC2016
+set -eux
 set -o pipefail
 
 export SYSTEMD_LOG_LEVEL=debug
@@ -31,10 +30,10 @@ if unshare -U sh -c :; then
     is_user_ns_supported=yes
 fi
 
-SUSE_OPTS=""
+SUSE_OPTS=()
 ID_LIKE=$(awk -F= '$1=="ID_LIKE" { print $2 ;}' /etc/os-release)
 if [[ "$ID_LIKE" = *"suse"* ]]; then
-    SUSE_OPTS="--bind /lib64 --bind /usr/lib64 "
+    SUSE_OPTS+=(--bind /lib64 --bind /usr/lib64)
 fi
 
 function check_bind_tmp_path {
@@ -42,8 +41,8 @@ function check_bind_tmp_path {
     local _root="/var/lib/machines/testsuite-13.bind-tmp-path"
     rm -rf "$_root"
     /usr/lib/systemd/tests/testdata/create-busybox-container "$_root"
-    >/tmp/bind
-    systemd-nspawn $SUSE_OPTS--register=no -D "$_root" --bind=/tmp/bind /bin/sh -c 'test -e /tmp/bind'
+    : >/tmp/bind
+    systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D "$_root" --bind=/tmp/bind /bin/sh -c 'test -e /tmp/bind'
 }
 
 function check_norbind {
@@ -55,15 +54,15 @@ function check_norbind {
     mount -t tmpfs tmpfs /tmp/binddir/subdir
     echo -n "inner" >/tmp/binddir/subdir/file
     /usr/lib/systemd/tests/testdata/create-busybox-container "$_root"
-    systemd-nspawn $SUSE_OPTS--register=no -D "$_root" --bind=/tmp/binddir:/mnt:norbind /bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi'
+    systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D "$_root" --bind=/tmp/binddir:/mnt:norbind /bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi'
 }
 
 function check_notification_socket {
     # https://github.com/systemd/systemd/issues/4944
     local _cmd='echo a | $(busybox which nc) -U -u -w 1 /run/host/notify'
     # /testsuite-13.nc-container is prepared by test.sh
-    systemd-nspawn $SUSE_OPTS--register=no -D /testsuite-13.nc-container /bin/sh -x -c "$_cmd"
-    systemd-nspawn $SUSE_OPTS--register=no -D /testsuite-13.nc-container -U /bin/sh -x -c "$_cmd"
+    systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D /testsuite-13.nc-container /bin/sh -x -c "$_cmd"
+    systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D /testsuite-13.nc-container -U /bin/sh -x -c "$_cmd"
 }
 
 function check_os_release {
@@ -77,15 +76,15 @@ if echo test >>/run/host/os-release; then exit 1; fi
 '
 
     local _os_release_source="/etc/os-release"
-    if [ ! -r "${_os_release_source}" ]; then
+    if [[ ! -r "${_os_release_source}" ]]; then
         _os_release_source="/usr/lib/os-release"
-    elif [ -L "${_os_release_source}" ] && rm /etc/os-release; then
+    elif [[ -L "${_os_release_source}" ]] && rm /etc/os-release; then
         # Ensure that /etc always wins if available
         cp /usr/lib/os-release /etc
         echo MARKER=1 >>/etc/os-release
     fi
 
-    systemd-nspawn $SUSE_OPTS--register=no -D /testsuite-13.nc-container --bind="${_os_release_source}":/tmp/os-release /bin/sh -x -e -c "$_cmd"
+    systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D /testsuite-13.nc-container --bind="${_os_release_source}":/tmp/os-release /bin/sh -x -e -c "$_cmd"
 
     if grep -q MARKER /etc/os-release; then
         rm /etc/os-release
@@ -96,10 +95,10 @@ if echo test >>/run/host/os-release; then exit 1; fi
 function check_machinectl_bind {
     local _cmd='for i in $(seq 1 20); do if test -f /tmp/marker; then exit 0; fi; sleep 0.5; done; exit 1;'
 
-    cat <<EOF >/run/systemd/system/nspawn_machinectl_bind.service
+    cat >/run/systemd/system/nspawn_machinectl_bind.service <<EOF
 [Service]
 Type=notify
-ExecStart=systemd-nspawn $SUSE_OPTS -D /testsuite-13.nc-container --notify-ready=no /bin/sh -x -e -c "$_cmd"
+ExecStart=systemd-nspawn ${SUSE_OPTS[@]} -D /testsuite-13.nc-container --notify-ready=no /bin/sh -x -e -c "$_cmd"
 EOF
 
     systemctl start nspawn_machinectl_bind.service
@@ -113,7 +112,7 @@ EOF
         sleep 0.1
     done
 
-    return $(systemctl show -P ExecMainStatus nspawn_machinectl_bind.service)
+    return "$(systemctl show -P ExecMainStatus nspawn_machinectl_bind.service)"
 }
 
 function run {
@@ -129,65 +128,54 @@ function run {
     local _root="/var/lib/machines/testsuite-13.unified-$1-cgns-$2-api-vfs-writable-$3"
     rm -rf "$_root"
     /usr/lib/systemd/tests/testdata/create-busybox-container "$_root"
-    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" -b
-    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" --private-network -b
+    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D "$_root" -b
+    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D "$_root" --private-network -b
 
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" -U -b; then
+    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D "$_root" -U -b; then
         [[ "$is_user_ns_supported" = "yes" && "$3" = "network" ]] && return 1
     else
         [[ "$is_user_ns_supported" = "no" && "$3" = "network" ]] && return 1
     fi
 
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" --private-network -U -b; then
+    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D "$_root" --private-network -U -b; then
         [[ "$is_user_ns_supported" = "yes" && "$3" = "yes" ]] && return 1
     else
         [[ "$is_user_ns_supported" = "no" && "$3" = "yes" ]] && return 1
     fi
 
     local _netns_opt="--network-namespace-path=/proc/self/ns/net"
+    local _net_opts=(
+        "--network-bridge=lo"
+        "--network-interface=lo"
+        "--network-ipvlan=lo"
+        "--network-macvlan=lo"
+        "--network-veth"
+        "--network-veth-extra=lo"
+        "--network-zone=zone"
+    )
 
     # --network-namespace-path and network-related options cannot be used together
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" "$_netns_opt" --network-interface=lo -b; then
-        return 1
-    fi
-
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" "$_netns_opt" --network-macvlan=lo -b; then
-        return 1
-    fi
-
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" "$_netns_opt" --network-ipvlan=lo -b; then
-        return 1
-    fi
-
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" "$_netns_opt" --network-veth -b; then
-        return 1
-    fi
-
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" "$_netns_opt" --network-veth-extra=lo -b; then
-        return 1
-    fi
-
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" "$_netns_opt" --network-bridge=lo -b; then
-        return 1
-    fi
-
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" "$_netns_opt" --network-zone=zone -b; then
-        return 1
-    fi
+    for netopt in "${_net_opts[@]}"; do
+        echo "$_netns_opt in combination with $netopt should fail"
+        if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D "$_root" -b "$_netns_opt" "$netopt"; then
+            echo >&2 "unexpected pass"
+            return 1
+        fi
+    done
 
     # allow combination of --network-namespace-path and --private-network
-    if ! SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" "$_netns_opt" --private-network -b; then
+    if ! SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D "$_root" -b "$_netns_opt" --private-network; then
         return 1
     fi
 
     # test --network-namespace-path works with a network namespace created by "ip netns"
     ip netns add nspawn_test
     _netns_opt="--network-namespace-path=/run/netns/nspawn_test"
-    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn $SUSE_OPTS--register=no -D "$_root" "$_netns_opt" /bin/ip a | grep -v -E '^1: lo.*UP'
+    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn "${SUSE_OPTS[@]}" --register=no -D "$_root" "$_netns_opt" /bin/ip a | grep -v -E '^1: lo.*UP'
     local r=$?
     ip netns del nspawn_test
 
-    if [ $r -ne 0 ]; then
+    if [[ $r -ne 0 ]]; then
         return 1
     fi
 
diff --git a/test/units/testsuite-14.sh b/test/units/testsuite-14.sh
index 95ac9b65ae..7a64d93736 100755
--- a/test/units/testsuite-14.sh
+++ b/test/units/testsuite-14.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-set -e
-set -x
+set -eux
+set -o pipefail
 
 function setup_root {
     local _root="$1"
@@ -21,18 +21,18 @@ r="$(pwd)/overwrite-broken-machine-id"
 setup_root "$r"
 systemd-machine-id-setup --print --root "$r"
 echo abc >>"$r/etc/machine-id"
-id=$(systemd-machine-id-setup --print --root "$r")
-echo $id >expected
+id="$(systemd-machine-id-setup --print --root "$r")"
+echo "$id" >expected
 check expected "$r/etc/machine-id"
 
-r="$(pwd)/transient-machine-id"
+r="$PWD/transient-machine-id"
 setup_root "$r"
 systemd-machine-id-setup --print --root "$r"
 echo abc >>"$r/etc/machine-id"
 mount -o remount,ro "$r"
 mount -t tmpfs tmpfs "$r/run"
-transient_id=$(systemd-machine-id-setup --print --root "$r")
+transient_id="$(systemd-machine-id-setup --print --root "$r")"
 mount -o remount,rw "$r"
-commited_id=$(systemd-machine-id-setup --print --commit --root "$r")
+commited_id="$(systemd-machine-id-setup --print --commit --root "$r")"
 [[ "$transient_id" = "$commited_id" ]]
 check "$r/etc/machine-id" "$r/run/machine-id"
diff --git a/test/units/testsuite-15.sh b/test/units/testsuite-15.sh
index fc392c584d..23c2156501 100755
--- a/test/units/testsuite-15.sh
+++ b/test/units/testsuite-15.sh
@@ -1,53 +1,55 @@
-#! /bin/bash
-set -e
-set -x
+#!/bin/bash
+set -eux
+set -o pipefail
 
 _clear_service () {
-    systemctl stop $1.service 2>/dev/null || :
-    rm -f  /{etc,run,usr/lib}/systemd/system/$1.service
-    rm -fr /{etc,run,usr/lib}/systemd/system/$1.service.d
-    rm -fr /{etc,run,usr/lib}/systemd/system/$1.service.{wants,requires}
-    if [[ $1 == *@ ]]; then
-        systemctl stop $1*.service 2>/dev/null || :
-        rm -f  /{etc,run,usr/lib}/systemd/system/$1*.service
-        rm -fr /{etc,run,usr/lib}/systemd/system/$1*.service.d
-        rm -fr /{etc,run,usr/lib}/systemd/system/$1*.service.{wants,requires}
+    local SERVICE_NAME="${1:?_clear_service: missing argument}"
+    systemctl stop "$SERVICE_NAME.service" 2>/dev/null || :
+    rm -f  /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME".service
+    rm -fr /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME".service.d
+    rm -fr /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME".service.{wants,requires}
+    if [[ $SERVICE_NAME == *@ ]]; then
+        systemctl stop "$SERVICE_NAME"*.service 2>/dev/null || :
+        rm -f  /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME"*.service
+        rm -fr /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME"*.service.d
+        rm -fr /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME"*.service.{wants,requires}
     fi
 }
 
 clear_services () {
-    for u in $*; do
-        _clear_service $u
+    for u in "$@"; do
+        _clear_service "$u"
     done
     systemctl daemon-reload
 }
 
 create_service () {
-    clear_services $1
+    local SERVICE_NAME="${1:?create_service: missing argument}"
+    clear_services "$SERVICE_NAME"
 
-    cat >/etc/systemd/system/$1.service<<EOF
+    cat >/etc/systemd/system/"$SERVICE_NAME".service <<EOF
 [Unit]
-Description=$1 unit
+Description=$SERVICE_NAME unit
 
 [Service]
 ExecStart=/bin/sleep 100000
 EOF
-    mkdir -p /{etc,run,usr/lib}/systemd/system/$1.service.d
-    mkdir -p /etc/systemd/system/$1.service.{wants,requires}
-    mkdir -p /run/systemd/system/$1.service.{wants,requires}
-    mkdir -p /usr/lib/systemd/system/$1.service.{wants,requires}
+    mkdir -p /{etc,run,usr/lib}/systemd/system/"$SERVICE_NAME".service.d
+    mkdir -p /etc/systemd/system/"$SERVICE_NAME".service.{wants,requires}
+    mkdir -p /run/systemd/system/"$SERVICE_NAME".service.{wants,requires}
+    mkdir -p /usr/lib/systemd/system/"$SERVICE_NAME".service.{wants,requires}
 }
 
 create_services () {
-    for u in $*; do
-        create_service $u
+    for u in "$@"; do
+        create_service "$u"
     done
 }
 
 check_ok () {
     [ $# -eq 3 ] || return
 
-    x="$(systemctl show --value -p $2 $1)"
+    x="$(systemctl show --value -p "$2" "$1")"
     case "$x" in
         *$3*) return 0 ;;
         *)    return 1 ;;
diff --git a/test/units/testsuite-16.sh b/test/units/testsuite-16.sh
index 8388ef7a5d..9f3a843da6 100755
--- a/test/units/testsuite-16.sh
+++ b/test/units/testsuite-16.sh
@@ -1,25 +1,24 @@
 #!/usr/bin/env bash
-set -v -x
+set -eux
+set -o pipefail
 
 rm -f /test.log
 
-TL=/test.log.XXXXXXXX
+TESTLOG=/test.log.XXXXXXXX
 
 function wait_for()
 {
-    service=${1}
-    result=${2:-success}
-    time=${3:-45}
+    local service="${1:-wait_for: missing service argument}"
+    local result="${2:-success}"
+    local time="${3:-45}"
 
-    while [[ ! -f /${service}.terminated && ! -f /${service}.success && $time -gt 0  ]]
-    do
+    while [[ ! -f /${service}.terminated && ! -f /${service}.success && $time -gt 0 ]]; do
         sleep 1
-        time=$(( $time - 1 ))
+        time=$((time - 1))
     done
 
-    if [[ ! -f /${service}.${result} ]]
-    then
-        journalctl -u ${service/_/-}.service >> "${TL}"
+    if [[ ! -f /${service}.${result} ]]; then
+        journalctl -u "${service/_/-}.service" >>"$TESTLOG"
     fi
 }
 
@@ -44,12 +43,11 @@ wait_for fail_start startfail
 wait_for fail_stop stopfail
 wait_for fail_runtime runtimefail
 
-if [[ -f "${TL}" ]]
-then
+if [[ -f "$TESTLOG" ]]; then
     # no mv
-    cp "${TL}" /test.log
+    cp "$TESTLOG" /test.log
     exit 1
-else
-    touch /testok
-    exit 0
 fi
+
+touch /testok
+exit 0
diff --git a/test/units/testsuite-17.03.sh b/test/units/testsuite-17.03.sh
index e5178ce554..0452a06126 100755
--- a/test/units/testsuite-17.03.sh
+++ b/test/units/testsuite-17.03.sh
@@ -27,7 +27,7 @@ run_test() {
 
     echo add >/sys/class/net/lo/uevent
 
-    for n in {1..20}; do
+    for _ in {1..20}; do
         sleep 5
         if coredumpctl --since "$since" --no-legend --no-pager | grep /bin/udevadm ; then
             return 0
diff --git a/test/units/testsuite-17.sh b/test/units/testsuite-17.sh
index afce85aceb..65d0802969 100755
--- a/test/units/testsuite-17.sh
+++ b/test/units/testsuite-17.sh
@@ -1,12 +1,12 @@
 #!/usr/bin/env bash
 
-set -x
-set -e
+set -eux
+set -o pipefail
 
->/failed
+: >/failed
 
-for t in ${0%.sh}.*.sh; do
-    echo "Running $t"; ./$t
+for t in "${0%.sh}".*.sh; do
+    echo "Running $t"; ./"$t"
 done
 
 touch /testok
diff --git a/test/units/testsuite-18.sh b/test/units/testsuite-18.sh
index c4e3ca2110..fe4f9ce5e0 100755
--- a/test/units/testsuite-18.sh
+++ b/test/units/testsuite-18.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 systemd-run --wait -p FailureAction=poweroff true
diff --git a/test/units/testsuite-19.sh b/test/units/testsuite-19.sh
index dea2f4ba1f..8ea89e6cfe 100755
--- a/test/units/testsuite-19.sh
+++ b/test/units/testsuite-19.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 if grep -q cgroup2 /proc/filesystems ; then
diff --git a/test/units/testsuite-20.sh b/test/units/testsuite-20.sh
index 6003e4f181..7876a9d10c 100755
--- a/test/units/testsuite-20.sh
+++ b/test/units/testsuite-20.sh
@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 systemd-analyze log-level debug
 systemd-analyze log-target console
 
-test `systemctl show -P MainPID testsuite-20.service` -eq $$
+test "$(systemctl show -P MainPID testsuite-20.service)" -eq $$
 
 # Start a test process inside of our own cgroup
 sleep infinity &
@@ -14,45 +14,45 @@ disown
 
 # Start a test process outside of our own cgroup
 systemd-run -p DynamicUser=1 --unit=test20-sleep.service /bin/sleep infinity
-EXTERNALPID=`systemctl show -P MainPID test20-sleep.service`
+EXTERNALPID="$(systemctl show -P MainPID test20-sleep.service)"
 
 # Update our own main PID to the external test PID, this should work
-systemd-notify MAINPID=$EXTERNALPID
-test `systemctl show -P MainPID testsuite-20.service` -eq $EXTERNALPID
+systemd-notify MAINPID="$EXTERNALPID"
+test "$(systemctl show -P MainPID testsuite-20.service)" -eq "$EXTERNALPID"
 
 # Update our own main PID to the internal test PID, this should work, too
 systemd-notify MAINPID=$INTERNALPID
-test `systemctl show -P MainPID testsuite-20.service` -eq $INTERNALPID
+test "$(systemctl show -P MainPID testsuite-20.service)" -eq "$INTERNALPID"
 
 # Update it back to our own PID, this should also work
 systemd-notify MAINPID=$$
-test `systemctl show -P MainPID testsuite-20.service` -eq $$
+test "$(systemctl show -P MainPID testsuite-20.service)" -eq $$
 
 # Try to set it to PID 1, which it should ignore, because that's the manager
 systemd-notify MAINPID=1
-test `systemctl show -P MainPID testsuite-20.service` -eq $$
+test "$(systemctl show -P MainPID testsuite-20.service)" -eq $$
 
 # Try to set it to PID 0, which is invalid and should be ignored
 systemd-notify MAINPID=0
-test `systemctl show -P MainPID testsuite-20.service` -eq $$
+test "$(systemctl show -P MainPID testsuite-20.service)" -eq $$
 
 # Try to set it to a valid but non-existing PID, which should be ignored. (Note
 # that we set the PID to a value well above any known /proc/sys/kernel/pid_max,
 # which means we can be pretty sure it doesn't exist by coincidence)
 systemd-notify MAINPID=1073741824
-test `systemctl show -P MainPID testsuite-20.service` -eq $$
+test "$(systemctl show -P MainPID testsuite-20.service)" -eq $$
 
 # Change it again to the external PID, without privileges this time. This should be ignored, because the PID is from outside of our cgroup and we lack privileges.
-systemd-notify --uid=1000 MAINPID=$EXTERNALPID
-test `systemctl show -P MainPID testsuite-20.service` -eq $$
+systemd-notify --uid=1000 MAINPID="$EXTERNALPID"
+test "$(systemctl show -P MainPID testsuite-20.service)" -eq $$
 
 # Change it again to the internal PID, without privileges this time. This should work, as the process is on our cgroup, and that's enough even if we lack privileges.
-systemd-notify --uid=1000 MAINPID=$INTERNALPID
-test `systemctl show -P MainPID testsuite-20.service` -eq $INTERNALPID
+systemd-notify --uid=1000 MAINPID="$INTERNALPID"
+test "$(systemctl show -P MainPID testsuite-20.service)" -eq "$INTERNALPID"
 
 # Update it back to our own PID, this should also work
 systemd-notify --uid=1000 MAINPID=$$
-test `systemctl show -P MainPID testsuite-20.service` -eq $$
+test "$(systemctl show -P MainPID testsuite-20.service)" -eq $$
 
 cat >/tmp/test20-mainpid.sh <<EOF
 #!/usr/bin/env bash
@@ -76,7 +76,7 @@ EOF
 chmod +x /tmp/test20-mainpid.sh
 
 systemd-run --unit=test20-mainpidsh.service -p StandardOutput=tty -p StandardError=tty -p Type=forking -p RuntimeDirectory=mainpidsh -p PIDFile=/run/mainpidsh/pid /tmp/test20-mainpid.sh
-test `systemctl show -P MainPID test20-mainpidsh.service` -eq `cat /run/mainpidsh/pid`
+test "$(systemctl show -P MainPID test20-mainpidsh.service)" -eq "$(cat /run/mainpidsh/pid)"
 
 cat >/tmp/test20-mainpid2.sh <<EOF
 #!/usr/bin/env bash
@@ -101,7 +101,7 @@ EOF
 chmod +x /tmp/test20-mainpid2.sh
 
 systemd-run --unit=test20-mainpidsh2.service -p StandardOutput=tty -p StandardError=tty -p Type=forking -p RuntimeDirectory=mainpidsh2 -p PIDFile=/run/mainpidsh2/pid /tmp/test20-mainpid2.sh
-test `systemctl show -P MainPID test20-mainpidsh2.service` -eq `cat /run/mainpidsh2/pid`
+test "$(systemctl show -P MainPID test20-mainpidsh2.service)" -eq "$(cat /run/mainpidsh2/pid)"
 
 cat >/dev/shm/test20-mainpid3.sh <<EOF
 #!/usr/bin/env bash
@@ -140,7 +140,7 @@ systemd-run --unit=test20-mainpidsh3.service \
     && { echo 'unexpected success'; exit 1; }
 
 # Test that this failed due to timeout, and not some other error
-test $(systemctl show -P Result test20-mainpidsh3.service) = timeout
+test "$(systemctl show -P Result test20-mainpidsh3.service)" = timeout
 
 systemd-analyze log-level info
 
diff --git a/test/units/testsuite-22.01.sh b/test/units/testsuite-22.01.sh
index b10b5aaa1a..7975980799 100755
--- a/test/units/testsuite-22.01.sh
+++ b/test/units/testsuite-22.01.sh
@@ -1,10 +1,11 @@
-#! /bin/bash
+#!/bin/bash
 #
 # With "e" don't attempt to set permissions when file doesn't exist, see
 # https://github.com/systemd/systemd/pull/6682.
 #
 
-set -e
+set -eux
+set -o pipefail
 
 rm -fr /tmp/test
 
diff --git a/test/units/testsuite-22.02.sh b/test/units/testsuite-22.02.sh
index c337cd6e05..94fa11ba88 100755
--- a/test/units/testsuite-22.02.sh
+++ b/test/units/testsuite-22.02.sh
@@ -1,10 +1,10 @@
-#! /bin/bash
+#!/bin/bash
 #
 # Basic tests for types creating directories
 #
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 rm -fr /tmp/{C,d,D,e}
 mkdir  /tmp/{C,d,D,e}
@@ -21,10 +21,10 @@ d     /tmp/d/2    0755 daemon daemon - -
 EOF
 
 test -d /tmp/d/1
-test $(stat -c %U:%G:%a /tmp/d/1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/d/1)" = "daemon:daemon:755"
 
 test -d /tmp/d/2
-test $(stat -c %U:%G:%a /tmp/d/2) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/d/2)" = "daemon:daemon:755"
 
 #
 # 'D'
@@ -39,10 +39,10 @@ D     /tmp/D/2    0755 daemon daemon - -
 EOF
 
 test -d /tmp/D/1
-test $(stat -c %U:%G:%a /tmp/D/1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/D/1)" = "daemon:daemon:755"
 
 test -d /tmp/D/2
-test $(stat -c %U:%G:%a /tmp/D/2) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/D/2)" = "daemon:daemon:755"
 
 systemd-tmpfiles --remove - <<EOF
 D     /tmp/D/2    0755 daemon daemon - -
@@ -66,12 +66,12 @@ EOF
 test ! -d /tmp/e/1
 
 test -d /tmp/e/2
-test $(stat -c %U:%G:%a /tmp/e/2) = "root:root:777"
+test "$(stat -c %U:%G:%a /tmp/e/2)" = "root:root:777"
 
 test -d /tmp/e/2/d1
-test $(stat -c %U:%G:%a /tmp/e/2/d1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/e/2/d1)" = "daemon:daemon:755"
 test -d /tmp/e/2/d2
-test $(stat -c %U:%G:%a /tmp/e/2/d2) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/e/2/d2)" = "daemon:daemon:755"
 
 # 'e' operates on directories only
 mkdir -p /tmp/e/3/{d1,d2}
@@ -87,12 +87,12 @@ EOF
 # the directories should have been processed although systemd-tmpfiles failed
 # previously due to the presence of a file.
 test -d /tmp/e/3/d1
-test $(stat -c %U:%G:%a /tmp/e/3/d1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/e/3/d1)" = "daemon:daemon:755"
 test -d /tmp/e/3/d2
-test $(stat -c %U:%G:%a /tmp/e/3/d2) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/e/3/d2)" = "daemon:daemon:755"
 
 test -f /tmp/e/3/f1
-test $(stat -c %U:%G:%a /tmp/e/3/f1) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/e/3/f1)" = "root:root:644"
 
 #
 # 'C'
@@ -111,12 +111,12 @@ C     /tmp/C/2    0755 daemon daemon - /tmp/C/2-origin
 EOF
 
 test -d /tmp/C/1
-test $(stat -c %U:%G:%a /tmp/C/1/f1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/C/1/f1)" = "daemon:daemon:755"
 test -d /tmp/C/2
-test $(stat -c %U:%G:%a /tmp/C/2/f1) = "daemon:daemon:755"
+test "$(stat -c %U:%G:%a /tmp/C/2/f1)" = "daemon:daemon:755"
 
 systemd-tmpfiles --create - <<EOF
 C     /tmp/C/3    0755 daemon daemon - /tmp/C/3-origin
 EOF
 
-test $(stat -c %U:%G:%a /tmp/C/3/f1) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/C/3/f1)" = "root:root:644"
diff --git a/test/units/testsuite-22.03.sh b/test/units/testsuite-22.03.sh
index c905784bee..1ed026eb70 100755
--- a/test/units/testsuite-22.03.sh
+++ b/test/units/testsuite-22.03.sh
@@ -1,10 +1,10 @@
-#! /bin/bash
+#!/bin/bash
 #
 # Basic tests for types creating/writing files
 #
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 rm -fr /tmp/{f,F,w}
 mkdir  /tmp/{f,F,w}
@@ -20,9 +20,9 @@ EOF
 
 ### '1' should exist and be empty
 test -f /tmp/f/1; test ! -s /tmp/f/1
-test $(stat -c %U:%G:%a /tmp/f/1) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/f/1)" = "root:root:644"
 
-test $(stat -c %U:%G:%a /tmp/f/2) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/f/2)" = "root:root:644"
 test "$(< /tmp/f/2)" = "This string should be written"
 
 ### The perms are supposed to be updated even if the file already exists.
@@ -32,7 +32,7 @@ EOF
 
 # file should be empty
 test ! -s /tmp/f/1
-test $(stat -c %U:%G:%a /tmp/f/1) = "daemon:daemon:666"
+test "$(stat -c %U:%G:%a /tmp/f/1)" = "daemon:daemon:666"
 
 ### But we shouldn't try to set perms on an existing file which is not a
 ### regular one.
@@ -44,7 +44,7 @@ f     /tmp/f/fifo    0666 daemon daemon - This string should not be written
 EOF
 
 test -p /tmp/f/fifo
-test $(stat -c %U:%G:%a /tmp/f/fifo) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/f/fifo)" = "root:root:644"
 
 ### 'f' should not follow symlinks.
 ln -s missing /tmp/f/dangling
@@ -55,7 +55,7 @@ f     /tmp/f/dangling    0644 daemon daemon - -
 f     /tmp/f/symlink     0644 daemon daemon - -
 EOF
 test ! -e /tmp/f/missing
-test $(stat -c %U:%G:%a /tmp/file-owned-by-root) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/file-owned-by-root)" = "root:root:644"
 
 ### Handle read-only filesystem gracefully: we shouldn't fail if the target
 ### already exists and have the correct perms.
@@ -75,7 +75,7 @@ test -f /tmp/f/ro-fs/foo; test ! -s /tmp/f/ro-fs/foo
 systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
 f     /tmp/f/ro-fs/foo    0666 - - - -
 EOF
-test $(stat -c %U:%G:%a /tmp/f/fifo) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/f/fifo)" = "root:root:644"
 
 systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
 f     /tmp/f/ro-fs/bar    0644 - - - -
@@ -109,9 +109,9 @@ test -f /tmp/F/created; test ! -s /tmp/F/created
 test -f /tmp/F/created-with-content
 test "$(< /tmp/F/created-with-content)" = "new content"
 test -f /tmp/F/truncated; test ! -s /tmp/F/truncated
-test $(stat -c %U:%G:%a /tmp/F/truncated) = "daemon:daemon:666"
+test "$(stat -c %U:%G:%a /tmp/F/truncated)" = "daemon:daemon:666"
 test -s /tmp/F/truncated-with-content
-test $(stat -c %U:%G:%a /tmp/F/truncated-with-content) = "daemon:daemon:666"
+test "$(stat -c %U:%G:%a /tmp/F/truncated-with-content)" = "daemon:daemon:666"
 
 ### We shouldn't try to truncate anything but regular files since the behavior is
 ### unspecified in the other cases.
@@ -132,7 +132,7 @@ f     /tmp/F/dangling    0644 daemon daemon - -
 f     /tmp/F/symlink     0644 daemon daemon - -
 EOF
 test ! -e /tmp/F/missing
-test $(stat -c %U:%G:%a /tmp/file-owned-by-root) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/file-owned-by-root)" = "root:root:644"
 
 ### Handle read-only filesystem gracefully: we shouldn't fail if the target
 ### already exists and is empty.
@@ -161,11 +161,11 @@ test -f /tmp/F/ro-fs/foo
 grep -q 'truncating is not allowed' /tmp/F/ro-fs/foo
 
 # Trying to change the perms should fail.
->/tmp/F/rw-fs/foo
+: >/tmp/F/rw-fs/foo
 systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
 F     /tmp/F/ro-fs/foo    0666 - - - -
 EOF
-test $(stat -c %U:%G:%a /tmp/F/ro-fs/foo) = "root:root:644"
+test "$(stat -c %U:%G:%a /tmp/F/ro-fs/foo)" = "root:root:644"
 
 ### Try to create a new file.
 systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
diff --git a/test/units/testsuite-22.04.sh b/test/units/testsuite-22.04.sh
index fc90ab4dc7..d814ed8786 100755
--- a/test/units/testsuite-22.04.sh
+++ b/test/units/testsuite-22.04.sh
@@ -1,10 +1,10 @@
-#! /bin/bash
+#!/bin/bash
 #
 # Basic tests for types creating fifos
 #
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 rm -fr /tmp/p
 mkdir  /tmp/p
@@ -15,7 +15,7 @@ p     /tmp/p/fifo1    0666 - - - -
 EOF
 
 test -p /tmp/p/fifo1
-test $(stat -c %U:%G:%a /tmp/p/fifo1) = "root:root:666"
+test "$(stat -c %U:%G:%a /tmp/p/fifo1)" = "root:root:666"
 
 # Refuse to overwrite an existing file. Error is not propagated.
 systemd-tmpfiles --create - <<EOF
@@ -30,7 +30,7 @@ p+     /tmp/p/f1    0666 - - - -
 EOF
 
 test -p /tmp/p/f1
-test $(stat -c %U:%G:%a /tmp/p/f1) = "root:root:666"
+test "$(stat -c %U:%G:%a /tmp/p/f1)" = "root:root:666"
 
 #
 # Must be fixed
diff --git a/test/units/testsuite-22.05.sh b/test/units/testsuite-22.05.sh
index 13c4ac80fc..eaabbc4517 100755
--- a/test/units/testsuite-22.05.sh
+++ b/test/units/testsuite-22.05.sh
@@ -1,7 +1,7 @@
 #! /bin/bash
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 rm -fr /tmp/{z,Z}
 mkdir  /tmp/{z,Z}
@@ -17,15 +17,15 @@ z     /tmp/z/f1    0755 daemon daemon - -
 z     /tmp/z/d1    0755 daemon daemon - -
 EOF
 
-test $(stat -c %U:%G /tmp/z/f1) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/z/d1) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/z/d1/f11) = "root:root"
+test "$(stat -c %U:%G /tmp/z/f1)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/z/d1)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/z/d1/f11)" = "root:root"
 
 systemd-tmpfiles --create - <<EOF
 z     /tmp/z/d2/*    0755 daemon daemon - -
 EOF
 
-test $(stat -c %U:%G /tmp/z/d2/f21) = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/z/d2/f21)" = "daemon:daemon"
 
 #
 # 'Z'
@@ -38,8 +38,8 @@ Z     /tmp/Z/f1    0755 daemon daemon - -
 Z     /tmp/Z/d1    0755 daemon daemon - -
 EOF
 
-test $(stat -c %U:%G /tmp/Z/f1) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/Z/d1) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/Z/d1/d11) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/Z/d1/f11) = "daemon:daemon"
-test $(stat -c %U:%G /tmp/Z/d1/d11/f111) = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/Z/f1)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/Z/d1)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/Z/d1/d11)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/Z/d1/f11)" = "daemon:daemon"
+test "$(stat -c %U:%G /tmp/Z/d1/d11/f111)" = "daemon:daemon"
diff --git a/test/units/testsuite-22.06.sh b/test/units/testsuite-22.06.sh
index 8ce0a08f68..ce5b1bf698 100755
--- a/test/units/testsuite-22.06.sh
+++ b/test/units/testsuite-22.06.sh
@@ -1,9 +1,10 @@
-#! /bin/bash
+#!/bin/bash
 #
 # Inspired by https://github.com/systemd/systemd/issues/9508
 #
 
-set -e
+set -eux
+set -o pipefail
 
 test_snippet() {
         systemd-tmpfiles "$@" - <<EOF
diff --git a/test/units/testsuite-22.07.sh b/test/units/testsuite-22.07.sh
index 74286a3305..8d61032d27 100755
--- a/test/units/testsuite-22.07.sh
+++ b/test/units/testsuite-22.07.sh
@@ -1,10 +1,10 @@
-#! /bin/bash
+#!/bin/bash
 #
 # Verifies the issues described by https://github.com/systemd/systemd/issues/10191
 #
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 rm -rf /tmp/test-prefix
 
diff --git a/test/units/testsuite-22.08.sh b/test/units/testsuite-22.08.sh
index 01d3bdb50c..e4272f8ea3 100755
--- a/test/units/testsuite-22.08.sh
+++ b/test/units/testsuite-22.08.sh
@@ -1,4 +1,4 @@
-#! /bin/bash
+#!/bin/bash
 #
 # Verify tmpfiles can run in a root directory under a path prefix that contains
 # directories owned by unprivileged users, for example when a root file system
@@ -7,7 +7,8 @@
 # https://github.com/systemd/systemd/pull/11820
 #
 
-set -e
+set -eux
+set -o pipefail
 
 rm -fr /tmp/root /tmp/user
 mkdir -p /tmp/root /tmp/user/root
diff --git a/test/units/testsuite-22.09.sh b/test/units/testsuite-22.09.sh
index c558dfd4db..c852f778ef 100755
--- a/test/units/testsuite-22.09.sh
+++ b/test/units/testsuite-22.09.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 # Make sure that the "stat" output is not locale dependent.
 export LANG=C LC_ALL=C
diff --git a/test/units/testsuite-22.10.sh b/test/units/testsuite-22.10.sh
index 5ec297fbf8..d650b2145c 100755
--- a/test/units/testsuite-22.10.sh
+++ b/test/units/testsuite-22.10.sh
@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 
-set -e
-set -x
+set -eux
 set -o pipefail
 
 systemd-tmpfiles --create - <<EOF
diff --git a/test/units/testsuite-22.sh b/test/units/testsuite-22.sh
index afce85aceb..65d0802969 100755
--- a/test/units/testsuite-22.sh
+++ b/test/units/testsuite-22.sh
@@ -1,12 +1,12 @@
 #!/usr/bin/env bash
 
-set -x
-set -e
+set -eux
+set -o pipefail
 
->/failed
+: >/failed
 
-for t in ${0%.sh}.*.sh; do
-    echo "Running $t"; ./$t
+for t in "${0%.sh}".*.sh; do
+    echo "Running $t"; ./"$t"
 done
 
 touch /testok
diff --git a/test/units/testsuite-23.sh b/test/units/testsuite-23.sh
index a215237562..4ef7c878a8 100755
--- a/test/units/testsuite-23.sh
+++ b/test/units/testsuite-23.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 systemd-analyze log-level debug
@@ -21,8 +21,8 @@ systemd-run --unit=six -p Type=exec /tmp/brokenbinary && { echo 'unexpected succ
 
 systemd-run --unit=seven -p KillSignal=SIGTERM -p RestartKillSignal=SIGINT -p Type=exec /bin/sleep infinity
 # Both TERM and SIGINT happen to have the same number on all architectures
-test $(systemctl show --value -p KillSignal seven.service) -eq 15
-test $(systemctl show --value -p RestartKillSignal seven.service) -eq 2
+test "$(systemctl show --value -p KillSignal seven.service)" -eq 15
+test "$(systemctl show --value -p RestartKillSignal seven.service)" -eq 2
 
 systemctl restart seven.service
 systemctl stop seven.service
diff --git a/test/units/testsuite-25.sh b/test/units/testsuite-25.sh
index d4d2e0f953..fbe2d0b1d4 100755
--- a/test/units/testsuite-25.sh
+++ b/test/units/testsuite-25.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 export SYSTEMD_PAGER=cat
@@ -120,6 +120,7 @@ test ! -f /var/lib/machines/scratch4
 machinectl image-status scratch4 && { echo 'unexpected success'; exit 1; }
 
 # Test import-tar hyphen/stdin pipe behavior
+# shellcheck disable=SC2002
 cat /var/tmp/scratch.tar.gz | machinectl import-tar - scratch5
 test -d /var/lib/machines/scratch5
 machinectl image-status scratch5
diff --git a/test/units/testsuite-26.sh b/test/units/testsuite-26.sh
index 9c1abc5916..7982099307 100755
--- a/test/units/testsuite-26.sh
+++ b/test/units/testsuite-26.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 # Make sure PATH is set
diff --git a/test/units/testsuite-27.sh b/test/units/testsuite-27.sh
index 0e9ffe1189..2248380351 100755
--- a/test/units/testsuite-27.sh
+++ b/test/units/testsuite-27.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 systemd-analyze log-level debug
diff --git a/test/units/testsuite-29.sh b/test/units/testsuite-29.sh
index 4e91aa7336..3408e6d71a 100755
--- a/test/units/testsuite-29.sh
+++ b/test/units/testsuite-29.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
 # ex: ts=8 sw=4 sts=4 et filetype=sh
-set -ex
+set -eux
 set -o pipefail
 
 export SYSTEMD_LOG_LEVEL=debug
diff --git a/test/units/testsuite-30.sh b/test/units/testsuite-30.sh
index cb3b46d2cb..ac8a3e06cf 100755
--- a/test/units/testsuite-30.sh
+++ b/test/units/testsuite-30.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 systemd-analyze log-level debug
diff --git a/test/units/testsuite-31.sh b/test/units/testsuite-31.sh
index 42873bfd83..a9a50e1470 100755
--- a/test/units/testsuite-31.sh
+++ b/test/units/testsuite-31.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -e
+set -eux
 set -o pipefail
 
 if journalctl -b -t systemd --grep '\.device: Changed plugged -> dead'; then
diff --git a/test/units/testsuite-32.sh b/test/units/testsuite-32.sh
index c1704ab34e..2393601a00 100755
--- a/test/units/testsuite-32.sh
+++ b/test/units/testsuite-32.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 # Let's run this test only if the "memory.oom.group" cgroupfs attribute
@@ -9,7 +9,6 @@ set -o pipefail
 # kernels where the concept was still new.
 
 if test -f /sys/fs/cgroup/system.slice/testsuite-32.service/memory.oom.group; then
-
     systemd-analyze log-level debug
     systemd-analyze log-target console
 
@@ -23,12 +22,12 @@ if test -f /sys/fs/cgroup/system.slice/testsuite-32.service/memory.oom.group; th
     echo f >/proc/sysrq-trigger
 
     while : ; do
-        STATE=`systemctl show -P ActiveState oomtest.service`
+        STATE="$(systemctl show -P ActiveState oomtest.service)"
         [ "$STATE" = "failed" ] && break
         sleep .5
     done
 
-    RESULT=`systemctl show -P Result oomtest.service`
+    RESULT="$(systemctl show -P Result oomtest.service)"
     test "$RESULT" = "oom-kill"
 
     systemd-analyze log-level info
diff --git a/test/units/testsuite-33.sh b/test/units/testsuite-33.sh
index 929c76062b..6e750f63a3 100755
--- a/test/units/testsuite-33.sh
+++ b/test/units/testsuite-33.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
 # ex: ts=8 sw=4 sts=4 et filetype=sh
-set -ex
+set -eux
 set -o pipefail
 
 cat >/etc/systemd/system/testservice.service <<EOF
diff --git a/test/units/testsuite-34.sh b/test/units/testsuite-34.sh
index ca54a01f40..394b220d60 100755
--- a/test/units/testsuite-34.sh
+++ b/test/units/testsuite-34.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 systemd-analyze log-level debug
diff --git a/test/units/testsuite-36.sh b/test/units/testsuite-36.sh
index 3decf4b3f3..94fd927a5d 100755
--- a/test/units/testsuite-36.sh
+++ b/test/units/testsuite-36.sh
@@ -1,13 +1,14 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 at_exit() {
-    if [ $? -ne 0 ]; then
+    # shellcheck disable=SC2181
+    if [[ $? -ne 0 ]]; then
         # We're exiting with a non-zero EC, let's dump test artifacts
         # for easier debugging
-        [ -f "$straceLog" ] && cat "$straceLog"
-        [ -f "$journalLog" ] && cat "$journalLog"
+        [[ -v straceLog && -f "$straceLog" ]] && cat "$straceLog"
+        [[ -v journalLog && -f "$journalLog" ]] && cat "$journalLog"
     fi
 }
 
@@ -26,25 +27,28 @@ testUnitFile="/run/systemd/system/$testUnit"
 testUnitNUMAConf="$testUnitFile.d/numa.conf"
 
 # Sleep constants (we should probably figure out something better but nothing comes to mind)
-journalSleep=5
 sleepAfterStart=1
 
 # Journal cursor for easier navigation
 journalCursorFile="jounalCursorFile"
 
 startStrace() {
-    coproc strace -qq -p 1 -o $straceLog -e set_mempolicy -s 1024 $1
+    coproc strace -qq -p 1 -o "$straceLog" -e set_mempolicy -s 1024 ${1:+"$1"}
     # Wait for strace to properly "initialize"
     sleep $sleepAfterStart
 }
 
 stopStrace() {
-    kill -s TERM $COPROC_PID
+    [[ -v COPROC_PID ]] || return
+
+    local PID=$COPROC_PID
+    kill -s TERM "$PID"
     # Make sure the strace process is indeed dead
-    while kill -0 $COPROC_PID 2>/dev/null; do sleep 0.1; done
+    while kill -0 "$PID" 2>/dev/null; do sleep 0.1; done
 }
 
 startJournalctl() {
+    : >"$journalCursorFile"
     # Save journal's cursor for later navigation
     journalctl --no-pager --cursor-file="$journalCursorFile" -n0 -ocat
 }
@@ -55,7 +59,7 @@ stopJournalctl() {
     # the --sync wait until the synchronization is complete
     echo "Force journald to write all queued messages"
     journalctl --sync
-    journalctl -u $unit --cursor-file="$journalCursorFile" >"$journalLog"
+    journalctl -u "$unit" --cursor-file="$journalCursorFile" >"$journalLog"
 }
 
 checkNUMA() {
@@ -64,21 +68,24 @@ checkNUMA() {
 }
 
 writePID1NUMAPolicy() {
-    echo [Manager] >$confDir/numa.conf
-    echo NUMAPolicy=$1 >>$confDir/numa.conf
-    echo NUMAMask=$2 >>$confDir/numa.conf
+    cat >"$confDir/numa.conf" <<EOF
+[Manager]
+NUMAPolicy=${1:?missing argument: NUMAPolicy}
+NUMAMask=${2:-""}
+EOF
 }
 
 writeTestUnit() {
-    mkdir -p $testUnitFile.d/
-    echo [Service] >$testUnitFile
-    echo ExecStart=/bin/sleep 3600 >>$testUnitFile
+    mkdir -p "$testUnitFile.d/"
+    printf "[Service]\nExecStart=/bin/sleep 3600\n" >"$testUnitFile"
 }
 
 writeTestUnitNUMAPolicy() {
-    echo [Service] >$testUnitNUMAConf
-    echo NUMAPolicy=$1 >>$testUnitNUMAConf
-    echo NUMAMask=$2 >>$testUnitNUMAConf
+    cat >"$testUnitNUMAConf" <<EOF
+[Service]
+NUMAPolicy=${1:?missing argument: NUMAPolicy}
+NUMAMask=${2:-""}
+EOF
     systemctl daemon-reload
 }
 
@@ -97,32 +104,38 @@ pid1ReloadWithJournal() {
 
 pid1StartUnitWithStrace() {
     startStrace '-f'
-    systemctl start $1
+    systemctl start "${1:?missing unit name}"
     sleep $sleepAfterStart
     stopStrace
 }
 
 pid1StartUnitWithJournal() {
     startJournalctl
-    systemctl start $1
+    systemctl start "${1:?missing unit name}"
     sleep $sleepAfterStart
     stopJournalctl
 }
 
 pid1StopUnit() {
-    systemctl stop $1
+    systemctl stop "${1:?missing unit name}"
 }
 
 systemctlCheckNUMAProperties() {
-    local LOGFILE="$(mktemp)"
-    systemctl show -p NUMAPolicy $1 >"$LOGFILE"
-    grep "NUMAPolicy=$2" "$LOGFILE"
+    local UNIT_NAME="${1:?missing unit name}"
+    local NUMA_POLICY="${2:?missing NUMAPolicy}"
+    local NUMA_MASK="${3:-""}"
+    local LOGFILE
 
-    >"$LOGFILE"
+    LOGFILE="$(mktemp)"
 
-    if [ -n "$3" ]; then
-        systemctl show -p NUMAMask $1 >"$LOGFILE"
-        grep "NUMAMask=$3" "$LOGFILE"
+    systemctl show -p NUMAPolicy "$UNIT_NAME" >"$LOGFILE"
+    grep "NUMAPolicy=$NUMA_POLICY" "$LOGFILE"
+
+    : >"$LOGFILE"
+
+    if [ -n "$NUMA_MASK" ]; then
+        systemctl show -p NUMAMask "$UNIT_NAME" >"$LOGFILE"
+        grep "NUMAMask=$NUMA_MASK" "$LOGFILE"
     fi
 }
 
@@ -145,10 +158,10 @@ if ! checkNUMA; then
     echo "systemd-run NUMAPolicy=default && NUMAMask=0 check without NUMA support"
     runUnit='numa-systemd-run-test.service'
     startJournalctl
-    systemd-run -p NUMAPolicy=default -p NUMAMask=0 --unit $runUnit sleep 1000
+    systemd-run -p NUMAPolicy=default -p NUMAMask=0 --unit "$runUnit" sleep 1000
     sleep $sleepAfterStart
-    pid1StopUnit $runUnit
-    stopJournalctl $runUnit
+    pid1StopUnit "$runUnit"
+    stopJournalctl "$runUnit"
     grep "NUMA support not available, ignoring" "$journalLog"
 
 else
@@ -156,43 +169,43 @@ else
     writePID1NUMAPolicy "default"
     pid1ReloadWithStrace
     # Kernel requires that nodemask argument is set to NULL when setting default policy
-    grep "set_mempolicy(MPOL_DEFAULT, NULL" $straceLog
+    grep "set_mempolicy(MPOL_DEFAULT, NULL" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Default policy w/ mask"
     writePID1NUMAPolicy "default" "0"
     pid1ReloadWithStrace
-    grep "set_mempolicy(MPOL_DEFAULT, NULL" $straceLog
+    grep "set_mempolicy(MPOL_DEFAULT, NULL" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Bind policy w/o mask"
     writePID1NUMAPolicy "bind"
     pid1ReloadWithJournal
-    grep "Failed to set NUMA memory policy: Invalid argument" $journalLog
+    grep "Failed to set NUMA memory policy: Invalid argument" "$journalLog"
 
     echo "PID1 NUMAPolicy support - Bind policy w/ mask"
     writePID1NUMAPolicy "bind" "0"
     pid1ReloadWithStrace
-    grep -P "set_mempolicy\(MPOL_BIND, \[0x0*1\]" $straceLog
+    grep -P "set_mempolicy\(MPOL_BIND, \[0x0*1\]" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Interleave policy w/o mask"
     writePID1NUMAPolicy "interleave"
     pid1ReloadWithJournal
-    grep "Failed to set NUMA memory policy: Invalid argument" $journalLog
+    grep "Failed to set NUMA memory policy: Invalid argument" "$journalLog"
 
     echo "PID1 NUMAPolicy support - Interleave policy w/ mask"
     writePID1NUMAPolicy "interleave" "0"
     pid1ReloadWithStrace
-    grep -P "set_mempolicy\(MPOL_INTERLEAVE, \[0x0*1\]" $straceLog
+    grep -P "set_mempolicy\(MPOL_INTERLEAVE, \[0x0*1\]" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Preferred policy w/o mask"
     writePID1NUMAPolicy "preferred"
     pid1ReloadWithJournal
     # Preferred policy with empty node mask is actually allowed and should reset allocation policy to default
-    ! grep "Failed to set NUMA memory policy: Invalid argument" $journalLog
+    grep "Failed to set NUMA memory policy: Invalid argument" "$journalLog" && { echo >&2 "unexpected pass"; exit 1; }
 
     echo "PID1 NUMAPolicy support - Preferred policy w/ mask"
     writePID1NUMAPolicy "preferred" "0"
     pid1ReloadWithStrace
-    grep -P "set_mempolicy\(MPOL_PREFERRED, \[0x0*1\]" $straceLog
+    grep -P "set_mempolicy\(MPOL_PREFERRED, \[0x0*1\]" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Local policy w/o mask"
     writePID1NUMAPolicy "local"
@@ -202,136 +215,133 @@ else
     # return a numerical constant instead (with a comment):
     #   set_mempolicy(0x4 /* MPOL_??? */, NULL, 0) = 0
     # Let's cover this scenario as well
-    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" $straceLog
+    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" "$straceLog"
 
     echo "PID1 NUMAPolicy support - Local policy w/ mask"
     writePID1NUMAPolicy "local" "0"
     pid1ReloadWithStrace
-    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" $straceLog
+    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Default policy w/o mask"
     writeTestUnitNUMAPolicy "default"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "default"
-    pid1StopUnit $testUnit
-    grep "set_mempolicy(MPOL_DEFAULT, NULL" $straceLog
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "default"
+    pid1StopUnit "$testUnit"
+    grep "set_mempolicy(MPOL_DEFAULT, NULL" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Default policy w/ mask"
     writeTestUnitNUMAPolicy "default" "0"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "default" "0"
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "default" "0"
     pid1StopUnit $testUnit
     # Mask must be ignored
-    grep "set_mempolicy(MPOL_DEFAULT, NULL" $straceLog
+    grep "set_mempolicy(MPOL_DEFAULT, NULL" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Bind policy w/o mask"
     writeTestUnitNUMAPolicy "bind"
-    pid1StartUnitWithJournal $testUnit
-    pid1StopUnit $testUnit
-    grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" $journalLog
+    pid1StartUnitWithJournal "$testUnit"
+    pid1StopUnit "$testUnit"
+    grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" "$journalLog"
 
     echo "Unit file NUMAPolicy support - Bind policy w/ mask"
     writeTestUnitNUMAPolicy "bind" "0"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "bind" "0"
-    pid1StopUnit $testUnit
-    grep -P "set_mempolicy\(MPOL_BIND, \[0x0*1\]" $straceLog
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "bind" "0"
+    pid1StopUnit "$testUnit"
+    grep -P "set_mempolicy\(MPOL_BIND, \[0x0*1\]" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Interleave policy w/o mask"
     writeTestUnitNUMAPolicy "interleave"
-    pid1StartUnitWithStrace $testUnit
-    pid1StopUnit $testUnit
-    grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" $journalLog
+    pid1StartUnitWithStrace "$testUnit"
+    pid1StopUnit "$testUnit"
+    grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" "$journalLog"
 
     echo "Unit file NUMAPolicy support - Interleave policy w/ mask"
     writeTestUnitNUMAPolicy "interleave" "0"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "interleave" "0"
-    pid1StopUnit $testUnit
-    grep -P "set_mempolicy\(MPOL_INTERLEAVE, \[0x0*1\]" $straceLog
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "interleave" "0"
+    pid1StopUnit "$testUnit"
+    grep -P "set_mempolicy\(MPOL_INTERLEAVE, \[0x0*1\]" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Preferred policy w/o mask"
     writeTestUnitNUMAPolicy "preferred"
-    pid1StartUnitWithJournal $testUnit
-    systemctlCheckNUMAProperties $testUnit "preferred"
-    pid1StopUnit $testUnit
-    ! grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" $journalLog
+    pid1StartUnitWithJournal "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "preferred"
+    pid1StopUnit "$testUnit"
+    grep "numa-test.service: Main process exited, code=exited, status=242/NUMA" "$journalLog" && { echo >&2 "unexpected pass"; exit 1; }
 
     echo "Unit file NUMAPolicy support - Preferred policy w/ mask"
     writeTestUnitNUMAPolicy "preferred" "0"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "preferred" "0"
-    pid1StopUnit $testUnit
-    grep -P "set_mempolicy\(MPOL_PREFERRED, \[0x0*1\]" $straceLog
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "preferred" "0"
+    pid1StopUnit "$testUnit"
+    grep -P "set_mempolicy\(MPOL_PREFERRED, \[0x0*1\]" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Local policy w/o mask"
     writeTestUnitNUMAPolicy "local"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "local"
-    pid1StopUnit $testUnit
-    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" $straceLog
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "local"
+    pid1StopUnit "$testUnit"
+    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" "$straceLog"
 
     echo "Unit file NUMAPolicy support - Local policy w/ mask"
     writeTestUnitNUMAPolicy "local" "0"
-    pid1StartUnitWithStrace $testUnit
-    systemctlCheckNUMAProperties $testUnit "local" "0"
-    pid1StopUnit $testUnit
+    pid1StartUnitWithStrace "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "local" "0"
+    pid1StopUnit "$testUnit"
     # Mask must be ignored
-    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" $straceLog
+    grep -E "set_mempolicy\((MPOL_LOCAL|0x4 [^,]*), NULL" "$straceLog"
 
     echo "Unit file CPUAffinity=NUMA support"
     writeTestUnitNUMAPolicy "bind" "0"
-    echo "CPUAffinity=numa" >>$testUnitNUMAConf
+    echo "CPUAffinity=numa" >>"$testUnitNUMAConf"
     systemctl daemon-reload
-    systemctl start $testUnit
-    systemctlCheckNUMAProperties $testUnit "bind" "0"
-    pid=$(systemctl show --value -p MainPID $testUnit)
-    cpulist=$(cat /sys/devices/system/node/node0/cpulist)
-    affinity_systemd=$(systemctl show --value -p CPUAffinity $testUnit)
-    [ $cpulist = $affinity_systemd ]
-    pid1StopUnit $testUnit
+    systemctl start "$testUnit"
+    systemctlCheckNUMAProperties "$testUnit" "bind" "0"
+    cpulist="$(cat /sys/devices/system/node/node0/cpulist)"
+    affinity_systemd="$(systemctl show --value -p CPUAffinity "$testUnit")"
+    [ "$cpulist" = "$affinity_systemd" ]
+    pid1StopUnit "$testUnit"
 
     echo "systemd-run NUMAPolicy support"
     runUnit='numa-systemd-run-test.service'
 
-    systemd-run -p NUMAPolicy=default --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "default"
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=default --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "default"
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=default -p NUMAMask=0 --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "default" ""
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=default -p NUMAMask=0 --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "default" ""
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=bind -p NUMAMask=0 --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "bind" "0"
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=bind -p NUMAMask=0 --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "bind" "0"
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=interleave -p NUMAMask=0 --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "interleave" "0"
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=interleave -p NUMAMask=0 --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "interleave" "0"
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=preferred -p NUMAMask=0 --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "preferred" "0"
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=preferred -p NUMAMask=0 --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "preferred" "0"
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=local --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "local"
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=local --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "local"
+    pid1StopUnit "$runUnit"
 
-    systemd-run -p NUMAPolicy=local -p NUMAMask=0 --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "local" ""
-    pid1StopUnit $runUnit
-
-    systemd-run -p NUMAPolicy=local -p NUMAMask=0 -p CPUAffinity=numa --unit $runUnit sleep 1000
-    systemctlCheckNUMAProperties $runUnit "local" ""
-    systemctl cat $runUnit | grep -q 'CPUAffinity=numa'
-    pid1StopUnit $runUnit
+    systemd-run -p NUMAPolicy=local -p NUMAMask=0 --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "local" ""
+    pid1StopUnit "$runUnit"
 
+    systemd-run -p NUMAPolicy=local -p NUMAMask=0 -p CPUAffinity=numa --unit "$runUnit" sleep 1000
+    systemctlCheckNUMAProperties "$runUnit" "local" ""
+    systemctl cat "$runUnit" | grep -q 'CPUAffinity=numa'
+    pid1StopUnit "$runUnit"
 fi
 
 # Cleanup
-rm -rf $testDir
-rm -rf $confDir
+rm -rf "$confDir"
 systemctl daemon-reload
 
 systemd-analyze log-level info
diff --git a/test/units/testsuite-37.sh b/test/units/testsuite-37.sh
index 3ae0cb32fe..c3eb5344d1 100755
--- a/test/units/testsuite-37.sh
+++ b/test/units/testsuite-37.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
 # ex: ts=8 sw=4 sts=4 et filetype=sh
-set -ex
+set -eux
 set -o pipefail
 
 systemd-mount -p RuntimeDirectory=hoge -p RuntimeDirectoryPreserve=yes -t tmpfs tmpfs /tmp/aaa
diff --git a/test/units/testsuite-38.sh b/test/units/testsuite-38.sh
index 707fd8a864..818f69bc63 100755
--- a/test/units/testsuite-38.sh
+++ b/test/units/testsuite-38.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-set -ex
+set -eux
 set -o pipefail
 
 systemd-analyze log-level debug
@@ -14,11 +14,11 @@ start_test_service() {
 }
 
 dbus_freeze() {
-    local suffix=
-    suffix="${1##*.}"
+    local name object_path suffix
 
-    local name="$(echo ${1%.$suffix} | sed s/-/_2d/g)"
-    local object_path="/org/freedesktop/systemd1/unit/${name}_2e${suffix}"
+    suffix="${1##*.}"
+    name="${1%.$suffix}"
+    object_path="/org/freedesktop/systemd1/unit/${name//-/_2d}_2e${suffix}"
 
     busctl call \
            org.freedesktop.systemd1 \
@@ -28,11 +28,11 @@ dbus_freeze() {
 }
 
 dbus_thaw() {
-    local suffix=
-    suffix="${1##*.}"
+    local name object_path suffix
 
-    local name="$(echo ${1%.$suffix} | sed s/-/_2d/g)"
-    local object_path="/org/freedesktop/systemd1/unit/${name}_2e${suffix}"
+    suffix="${1##*.}"
+    name="${1%.$suffix}"
+    object_path="/org/freedesktop/systemd1/unit/${name//-/_2d}_2e${suffix}"
 
     busctl call \
            org.freedesktop.systemd1 \
@@ -62,11 +62,11 @@ dbus_thaw_unit() {
 }
 
 dbus_can_freeze() {
-    local suffix=
-    suffix="${1##*.}"
+    local name object_path suffix
 
-    local name="$(echo ${1%.$suffix} | sed s/-/_2d/g)"
-    local object_path="/org/freedesktop/systemd1/unit/${name}_2e${suffix}"
+    suffix="${1##*.}"
+    name="${1%.$suffix}"
+    object_path="/org/freedesktop/systemd1/unit/${name//-/_2d}_2e${suffix}"
 
     busctl get-property \
            org.freedesktop.systemd1 \
@@ -76,11 +76,11 @@ dbus_can_freeze() {
 }
 
 check_freezer_state() {
-    local suffix=
-    suffix="${1##*.}"
+    local name object_path suffix
 
-    local name="$(echo ${1%.$suffix} | sed s/-/_2d/g)"
-    local object_path="/org/freedesktop/systemd1/unit/${name}_2e${suffix}"
+    suffix="${1##*.}"
+    name="${1%.$suffix}"
+    object_path="/org/freedesktop/systemd1/unit/${name//-/_2d}_2e${suffix}"
 
     state=$(busctl get-property \
                    org.freedesktop.systemd1 \
diff --git a/test/units/testsuite-39.sh b/test/units/testsuite-39.sh
index 5c0680878f..3b0d893a4c 100755
--- a/test/units/testsuite-39.sh
+++ b/test/units/testsuite-39.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-set -ex
+set -eux
 set -o pipefail
 
 systemd-analyze log-level debug
@@ -18,12 +18,12 @@ ExecReload=/bin/false
 EOF
 
 systemctl daemon-reload
-systemctl start $SERVICE_NAME
-systemctl status $SERVICE_NAME
+systemctl start "$SERVICE_NAME"
+systemctl status "$SERVICE_NAME"
 # The reload SHOULD fail but SHOULD NOT affect the service state
-systemctl reload $SERVICE_NAME && { echo 'unexpected success'; exit 1; }
-systemctl status $SERVICE_NAME
-systemctl stop $SERVICE_NAME
+systemctl reload "$SERVICE_NAME" && { echo 'unexpected success'; exit 1; }
+systemctl status "$SERVICE_NAME"
+systemctl stop "$SERVICE_NAME"
 
 
 echo "[#2] Failing ExecReload= should not kill the service (multiple ExecReload=)"
@@ -36,12 +36,12 @@ ExecReload=/bin/true
 EOF
 
 systemctl daemon-reload
-systemctl start $SERVICE_NAME
-systemctl status $SERVICE_NAME
+systemctl start "$SERVICE_NAME"
+systemctl status "$SERVICE_NAME"
 # The reload SHOULD fail but SHOULD NOT affect the service state
-systemctl reload $SERVICE_NAME && { echo 'unexpected success'; exit 1; }
-systemctl status $SERVICE_NAME
-systemctl stop $SERVICE_NAME
+systemctl reload "$SERVICE_NAME" && { echo 'unexpected success'; exit 1; }
+systemctl status "$SERVICE_NAME"
+systemctl stop "$SERVICE_NAME"
 
 echo "[#3] Failing ExecReload=- should not affect reload's exit code"
 cat >"$SERVICE_PATH" <<EOF
@@ -51,11 +51,11 @@ ExecReload=-/bin/false
 EOF
 
 systemctl daemon-reload
-systemctl start $SERVICE_NAME
-systemctl status $SERVICE_NAME
-systemctl reload $SERVICE_NAME
-systemctl status $SERVICE_NAME
-systemctl stop $SERVICE_NAME
+systemctl start "$SERVICE_NAME"
+systemctl status "$SERVICE_NAME"
+systemctl reload "$SERVICE_NAME"
+systemctl status "$SERVICE_NAME"
+systemctl stop "$SERVICE_NAME"
 
 systemd-analyze log-level info
 
diff --git a/test/units/testsuite-40.sh b/test/units/testsuite-40.sh
index 7593401369..fdb052c39c 100755
--- a/test/units/testsuite-40.sh
+++ b/test/units/testsuite-40.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 systemd-analyze log-level debug
diff --git a/test/units/testsuite-41.sh b/test/units/testsuite-41.sh
index 0a43f8ba57..e7993e8df7 100755
--- a/test/units/testsuite-41.sh
+++ b/test/units/testsuite-41.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 # wait this many secs for each test service to succeed in what is being tested
@@ -12,7 +12,7 @@ systemd-analyze log-target console
 systemd-run --unit=one -p Type=oneshot -p Restart=on-failure /bin/bash -c "exit 1" \
     && { echo 'unexpected success'; exit 1; }
 
-for ((secs=0; secs<$MAX_SECS; secs++)); do
+for ((secs = 0; secs < MAX_SECS; secs++)); do
   [[ "$(systemctl show one.service -P NRestarts)" -le 0 ]] || break
   sleep 1
 done
@@ -35,7 +35,7 @@ systemd-run --unit=two \
     && { echo 'unexpected success'; exit 1; }
 
 # wait for at least 3 restarts
-for ((secs=0; secs<$MAX_SECS; secs++)); do
+for ((secs = 0; secs < MAX_SECS; secs++)); do
   [[ $(cat $TMP_FILE) != "aaa" ]] || break
   sleep 1
 done
diff --git a/test/units/testsuite-42.sh b/test/units/testsuite-42.sh
index ca13c5dec5..e47fab46e6 100755
--- a/test/units/testsuite-42.sh
+++ b/test/units/testsuite-42.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 
 systemd-analyze log-level debug
 
diff --git a/test/units/testsuite-43.sh b/test/units/testsuite-43.sh
index f3c0ca4fd2..c6399f9920 100755
--- a/test/units/testsuite-43.sh
+++ b/test/units/testsuite-43.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 systemd-analyze log-level debug
@@ -7,6 +7,7 @@ systemd-analyze log-level debug
 runas() {
     declare userid=$1
     shift
+    # shellcheck disable=SC2016
     su "$userid" -s /bin/sh -c 'XDG_RUNTIME_DIR=/run/user/$UID exec "$@"' -- sh "$@"
 }
 
@@ -46,6 +47,7 @@ runas testuser systemd-run --wait --user --unit=test-protect-home-tmpfs \
     -P test ! -e /home/testuser
 
 # Confirm that home, /root, and /run/user are inaccessible under "yes"
+# shellcheck disable=SC2016
 runas testuser systemd-run --wait --user --unit=test-protect-home-yes \
     -p PrivateUsers=yes -p ProtectHome=yes \
     -P bash -c '
diff --git a/test/units/testsuite-44.sh b/test/units/testsuite-44.sh
index 0badb71125..50b5c3046f 100755
--- a/test/units/testsuite-44.sh
+++ b/test/units/testsuite-44.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 
 systemd-analyze log-level debug
 
diff --git a/test/units/testsuite-46.sh b/test/units/testsuite-46.sh
index d3f0f71043..808270f33d 100755
--- a/test/units/testsuite-46.sh
+++ b/test/units/testsuite-46.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 # Check if homectl is installed, and if it isn't bail out early instead of failing
@@ -14,8 +14,9 @@ inspect() {
     # avoid unexpected fails. To see the full outputs of both homectl &
     # userdbctl (for debugging purposes) drop the fields just before the
     # comparison.
-    homectl inspect $1 | tee /tmp/a
-    userdbctl user $1 | tee /tmp/b
+    local USERNAME="${1:?missing argument}"
+    homectl inspect "$USERNAME" | tee /tmp/a
+    userdbctl user "$USERNAME" | tee /tmp/b
 
     diff -I '/^\s*Disk (Size|Free|Floor|Ceiling):/' /tmp/{a,b}
     rm /tmp/{a,b}
diff --git a/test/units/testsuite-47.sh b/test/units/testsuite-47.sh
index f8529083a2..c1714d14d0 100755
--- a/test/units/testsuite-47.sh
+++ b/test/units/testsuite-47.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 systemd-analyze log-level debug
diff --git a/test/units/testsuite-48.sh b/test/units/testsuite-48.sh
index ea84b1d723..0ce8e9c067 100755
--- a/test/units/testsuite-48.sh
+++ b/test/units/testsuite-48.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
 # ex: ts=8 sw=4 sts=4 et filetype=sh
-set -ex
+set -eux
 
 cat >/run/systemd/system/testservice-48.target <<EOF
 [Unit]
diff --git a/test/units/testsuite-49.sh b/test/units/testsuite-49.sh
index f92280f884..8e360b4951 100755
--- a/test/units/testsuite-49.sh
+++ b/test/units/testsuite-49.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 
 echo "MARKER_FIXED" >/run/testservice-49-fixed
 mkdir -p /run/inaccessible
diff --git a/test/units/testsuite-50.sh b/test/units/testsuite-50.sh
index b3c120d9a6..505d93c13b 100755
--- a/test/units/testsuite-50.sh
+++ b/test/units/testsuite-50.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
 # ex: ts=8 sw=4 sts=4 et filetype=sh
-set -ex
+set -eux
 set -o pipefail
 
 export SYSTEMD_LOG_LEVEL=debug
@@ -26,48 +26,48 @@ trap cleanup EXIT
 
 cp /usr/share/minimal* "${image_dir}/"
 image="${image_dir}/minimal_0"
-roothash="$(cat ${image}.roothash)"
+roothash="$(cat "${image}.roothash")"
 
-os_release=$(test -e /etc/os-release && echo /etc/os-release || echo /usr/lib/os-release)
+os_release="$(test -e /etc/os-release && echo /etc/os-release || echo /usr/lib/os-release)"
 
-systemd-dissect --json=short ${image}.raw | grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
-systemd-dissect ${image}.raw | grep -q -F "MARKER=1"
-systemd-dissect ${image}.raw | grep -q -F -f <(sed 's/"//g' $os_release)
+systemd-dissect --json=short "${image}.raw" | grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
+systemd-dissect "${image}.raw" | grep -q -F "MARKER=1"
+systemd-dissect "${image}.raw" | grep -q -F -f <(sed 's/"//g' "$os_release")
 
-mv ${image}.verity ${image}.fooverity
-mv ${image}.roothash ${image}.foohash
-systemd-dissect --json=short ${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity | grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
-systemd-dissect ${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity | grep -q -F "MARKER=1"
-systemd-dissect ${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity | grep -q -F -f <(sed 's/"//g' $os_release)
-mv ${image}.fooverity ${image}.verity
-mv ${image}.foohash ${image}.roothash
+mv "${image}.verity" "${image}.fooverity"
+mv "${image}.roothash" "${image}.foohash"
+systemd-dissect --json=short "${image}.raw" --root-hash="${roothash}" --verity-data="${image}.fooverity" | grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
+systemd-dissect "${image}.raw" --root-hash="${roothash}" --verity-data="${image}.fooverity" | grep -q -F "MARKER=1"
+systemd-dissect "${image}.raw" --root-hash="${roothash}" --verity-data="${image}.fooverity" | grep -q -F -f <(sed 's/"//g' "$os_release")
+mv "${image}.fooverity" "${image}.verity"
+mv "${image}.foohash" "${image}.roothash"
 
-mkdir -p ${image_dir}/mount ${image_dir}/mount2
-systemd-dissect --mount ${image}.raw ${image_dir}/mount
-cat ${image_dir}/mount/usr/lib/os-release | grep -q -F -f $os_release
-cat ${image_dir}/mount/etc/os-release | grep -q -F -f $os_release
-cat ${image_dir}/mount/usr/lib/os-release | grep -q -F "MARKER=1"
+mkdir -p "${image_dir}/mount" "${image_dir}/mount2"
+systemd-dissect --mount "${image}.raw" "${image_dir}/mount"
+grep -q -F -f "$os_release" "${image_dir}/mount/usr/lib/os-release"
+grep -q -F -f "$os_release" "${image_dir}/mount/etc/os-release"
+grep -q -F "MARKER=1" "${image_dir}/mount/usr/lib/os-release"
 # Verity volume should be shared (opened only once)
-systemd-dissect --mount ${image}.raw ${image_dir}/mount2
-verity_count=$(ls -1 /dev/mapper/ | grep -c verity)
+systemd-dissect --mount "${image}.raw" "${image_dir}/mount2"
+verity_count=$(find /dev/mapper/ -name "*verity*" | wc -l)
 # In theory we should check that count is exactly one. In practice, libdevmapper
 # randomly and unpredictably fails with an unhelpful EINVAL when a device is open
 # (and even mounted and in use), so best-effort is the most we can do for now
-if [ ${verity_count} -lt 1 ]; then
+if [ "${verity_count}" -lt 1 ]; then
     echo "Verity device ${image}.raw not found in /dev/mapper/"
     exit 1
 fi
-umount ${image_dir}/mount
-umount ${image_dir}/mount2
+umount "${image_dir}/mount"
+umount "${image_dir}/mount2"
 
-systemd-run -t -p RootImage=${image}.raw cat /usr/lib/os-release | grep -q -F "MARKER=1"
-mv ${image}.verity ${image}.fooverity
-mv ${image}.roothash ${image}.foohash
-systemd-run -t -p RootImage=${image}.raw -p RootHash=${image}.foohash -p RootVerity=${image}.fooverity cat /usr/lib/os-release | grep -q -F "MARKER=1"
+systemd-run -t -p RootImage="${image}.raw" cat /usr/lib/os-release | grep -q -F "MARKER=1"
+mv "${image}.verity" "${image}.fooverity"
+mv "${image}.roothash" "${image}.foohash"
+systemd-run -t -p RootImage="${image}.raw" -p RootHash="${image}.foohash" -p RootVerity="${image}.fooverity" cat /usr/lib/os-release | grep -q -F "MARKER=1"
 # Let's use the long option name just here as a test
-systemd-run -t --property RootImage=${image}.raw --property RootHash=${roothash} --property RootVerity=${image}.fooverity cat /usr/lib/os-release | grep -q -F "MARKER=1"
-mv ${image}.fooverity ${image}.verity
-mv ${image}.foohash ${image}.roothash
+systemd-run -t --property RootImage="${image}.raw" --property RootHash="${roothash}" --property RootVerity="${image}.fooverity" cat /usr/lib/os-release | grep -q -F "MARKER=1"
+mv "${image}.fooverity" "${image}.verity"
+mv "${image}.foohash" "${image}.roothash"
 
 # Make a GPT disk on the fly, with the squashfs as partition 1 and the verity hash tree as partition 2
 machine="$(uname -m)"
@@ -100,51 +100,54 @@ else
     exit 1
 fi
 # du rounds up to block size, which is more helpful for partitioning
-root_size="$(du -k ${image}.raw | cut -f1)"
-verity_size="$(du -k ${image}.verity | cut -f1)"
+root_size="$(du -k "${image}.raw" | cut -f1)"
+verity_size="$(du -k "${image}.verity" | cut -f1)"
 # 4MB seems to be the minimum size blkid will accept, below that probing fails
-dd if=/dev/zero of=${image}.gpt bs=512 count=$((8192+${root_size}*2+${verity_size}*2))
+dd if=/dev/zero of="${image}.gpt" bs=512 count=$((8192+root_size*2+verity_size*2))
 # sfdisk seems unhappy if the size overflows into the next unit, eg: 1580KiB will be interpreted as 1MiB
 # so do some basic rounding up if the minimal image is more than 1 MB
-if [ ${root_size} -ge 1024 ]; then
-    root_size="$((${root_size}/1024 + 1))MiB"
+if [ "${root_size}" -ge 1024 ]; then
+    root_size="$((root_size/1024 + 1))MiB"
 else
     root_size="${root_size}KiB"
 fi
-verity_size="$((${verity_size} * 2))KiB"
-uuid="$(head -c 32 ${image}.roothash | cut -c -8)-$(head -c 32 ${image}.roothash | cut -c 9-12)-$(head -c 32 ${image}.roothash | cut -c 13-16)-$(head -c 32 ${image}.roothash | cut -c 17-20)-$(head -c 32 ${image}.roothash | cut -c 21-)"
-echo -e "label: gpt\nsize=${root_size}, type=${root_guid}, uuid=${uuid}" | sfdisk ${image}.gpt
-uuid="$(tail -c 32 ${image}.roothash | cut -c -8)-$(tail -c 32 ${image}.roothash | cut -c 9-12)-$(tail -c 32 ${image}.roothash | cut -c 13-16)-$(tail -c 32 ${image}.roothash | cut -c 17-20)-$(tail -c 32 ${image}.roothash | cut -c 21-)"
-echo -e "size=${verity_size}, type=${verity_guid}, uuid=${uuid}" | sfdisk ${image}.gpt --append
-sfdisk --part-label ${image}.gpt 1 "Root Partition"
-sfdisk --part-label ${image}.gpt 2 "Verity Partition"
-loop="$(losetup --show -P -f ${image}.gpt)"
-dd if=${image}.raw of=${loop}p1
-dd if=${image}.verity of=${loop}p2
-losetup -d ${loop}
+verity_size="$((verity_size * 2))KiB"
+# Construct a UUID from hash
+# input:  11111111222233334444555566667777
+# output: 11111111-2222-3333-4444-555566667777
+uuid="$(head -c 32 "${image}.roothash" | sed -r 's/(.{8})(.{4})(.{4})(.{4})(.+)/\1-\2-\3-\4-\5/')"
+echo -e "label: gpt\nsize=${root_size}, type=${root_guid}, uuid=${uuid}" | sfdisk "${image}.gpt"
+uuid="$(tail -c 32 "${image}.roothash" | sed -r 's/(.{8})(.{4})(.{4})(.{4})(.+)/\1-\2-\3-\4-\5/')"
+echo -e "size=${verity_size}, type=${verity_guid}, uuid=${uuid}" | sfdisk "${image}.gpt" --append
+sfdisk --part-label "${image}.gpt" 1 "Root Partition"
+sfdisk --part-label "${image}.gpt" 2 "Verity Partition"
+loop="$(losetup --show -P -f "${image}.gpt")"
+dd if="${image}.raw" of="${loop}p1"
+dd if="${image}.verity" of="${loop}p2"
+losetup -d "${loop}"
 
 # Derive partition UUIDs from root hash, in UUID syntax
-ROOT_UUID=$(systemd-id128 -u show $(head -c 32 ${image}.roothash) -u | tail -n 1 | cut -b 6-)
-VERITY_UUID=$(systemd-id128 -u show $(tail -c 32 ${image}.roothash) -u | tail -n 1 | cut -b 6-)
+ROOT_UUID="$(systemd-id128 -u show "$(head -c 32 "${image}.roothash")" -u | tail -n 1 | cut -b 6-)"
+VERITY_UUID="$(systemd-id128 -u show "$(tail -c 32 "${image}.roothash")" -u | tail -n 1 | cut -b 6-)"
 
-systemd-dissect --json=short --root-hash ${roothash} ${image}.gpt | grep -q '{"rw":"ro","designator":"root","partition_uuid":"'$ROOT_UUID'","partition_label":"Root Partition","fstype":"squashfs","architecture":"'$architecture'","verity":"yes","node":'
-systemd-dissect --json=short --root-hash ${roothash} ${image}.gpt | grep -q '{"rw":"ro","designator":"root-verity","partition_uuid":"'$VERITY_UUID'","partition_label":"Verity Partition","fstype":"DM_verity_hash","architecture":"'$architecture'","verity":null,"node":'
-systemd-dissect --root-hash ${roothash} ${image}.gpt | grep -q -F "MARKER=1"
-systemd-dissect --root-hash ${roothash} ${image}.gpt | grep -q -F -f <(sed 's/"//g' $os_release)
+systemd-dissect --json=short --root-hash "${roothash}" "${image}.gpt" | grep -q '{"rw":"ro","designator":"root","partition_uuid":"'"$ROOT_UUID"'","partition_label":"Root Partition","fstype":"squashfs","architecture":"'"$architecture"'","verity":"yes","node":'
+systemd-dissect --json=short --root-hash "${roothash}" "${image}.gpt" | grep -q '{"rw":"ro","designator":"root-verity","partition_uuid":"'"$VERITY_UUID"'","partition_label":"Verity Partition","fstype":"DM_verity_hash","architecture":"'"$architecture"'","verity":null,"node":'
+systemd-dissect --root-hash "${roothash}" "${image}.gpt" | grep -q -F "MARKER=1"
+systemd-dissect --root-hash "${roothash}" "${image}.gpt" | grep -q -F -f <(sed 's/"//g' "$os_release")
 
-systemd-dissect --root-hash ${roothash} --mount ${image}.gpt ${image_dir}/mount
-cat ${image_dir}/mount/usr/lib/os-release | grep -q -F -f $os_release
-cat ${image_dir}/mount/etc/os-release | grep -q -F -f $os_release
-cat ${image_dir}/mount/usr/lib/os-release | grep -q -F "MARKER=1"
-umount ${image_dir}/mount
+systemd-dissect --root-hash "${roothash}" --mount "${image}.gpt" "${image_dir}/mount"
+grep -q -F -f "$os_release" "${image_dir}/mount/usr/lib/os-release"
+grep -q -F -f "$os_release" "${image_dir}/mount/etc/os-release"
+grep -q -F "MARKER=1" "${image_dir}/mount/usr/lib/os-release"
+umount "${image_dir}/mount"
 
 # add explicit -p MountAPIVFS=yes once to test the parser
-systemd-run -t -p RootImage=${image}.gpt -p RootHash=${roothash} -p MountAPIVFS=yes cat /usr/lib/os-release | grep -q -F "MARKER=1"
+systemd-run -t -p RootImage="${image}.gpt" -p RootHash="${roothash}" -p MountAPIVFS=yes cat /usr/lib/os-release | grep -q -F "MARKER=1"
 
-systemd-run -t -p RootImage=${image}.raw -p RootImageOptions="root:nosuid,dev home:ro,dev ro,noatime" mount | grep -F "squashfs" | grep -q -F "nosuid"
-systemd-run -t -p RootImage=${image}.gpt -p RootImageOptions="root:ro,noatime root:ro,dev" mount | grep -F "squashfs" | grep -q -F "noatime"
+systemd-run -t -p RootImage="${image}.raw" -p RootImageOptions="root:nosuid,dev home:ro,dev ro,noatime" mount | grep -F "squashfs" | grep -q -F "nosuid"
+systemd-run -t -p RootImage="${image}.gpt" -p RootImageOptions="root:ro,noatime root:ro,dev" mount | grep -F "squashfs" | grep -q -F "noatime"
 
-mkdir -p mkdir -p ${image_dir}/result
+mkdir -p "${image_dir}/result"
 cat >/run/systemd/system/testservice-50a.service <<EOF
 [Service]
 Type=oneshot
@@ -156,8 +159,8 @@ RootImageOptions=root:ro,noatime home:ro,dev relatime,dev
 RootImageOptions=nosuid,dev
 EOF
 systemctl start testservice-50a.service
-grep -F "squashfs" ${image_dir}/result/a | grep -q -F "noatime"
-grep -F "squashfs" ${image_dir}/result/a | grep -q -F -v "nosuid"
+grep -F "squashfs" "${image_dir}/result/a" | grep -q -F "noatime"
+grep -F "squashfs" "${image_dir}/result/a" | grep -q -F -v "nosuid"
 
 cat >/run/systemd/system/testservice-50b.service <<EOF
 [Service]
@@ -172,7 +175,7 @@ RootImageOptions=home:ro,dev nosuid,dev,%%foo
 MountAPIVFS=yes
 EOF
 systemctl start testservice-50b.service
-grep -F "squashfs" ${image_dir}/result/b | grep -q -F "noatime"
+grep -F "squashfs" "${image_dir}/result/b" | grep -q -F "noatime"
 
 # Check that specifier escape is applied %%foo → %foo
 busctl get-property org.freedesktop.systemd1 /org/freedesktop/systemd1/unit/testservice_2d50b_2eservice org.freedesktop.systemd1.Service RootImageOptions | grep -F "nosuid,dev,%foo"
@@ -184,9 +187,9 @@ systemd-run -t -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2:nos
 systemd-run -t -p MountImages="${image}.gpt:/run/img1:root:nosuid ${image}.raw:/run/img2:home:suid" mount | grep -F "squashfs" | grep -q -F "nosuid"
 systemd-run -t -p MountImages="${image}.raw:/run/img2\:3" cat /run/img2:3/usr/lib/os-release | grep -q -F "MARKER=1"
 systemd-run -t -p MountImages="${image}.raw:/run/img2\:3:nosuid" mount | grep -F "squashfs" | grep -q -F "nosuid"
-systemd-run -t -p TemporaryFileSystem=/run -p RootImage=${image}.raw -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /usr/lib/os-release | grep -q -F "MARKER=1"
-systemd-run -t -p TemporaryFileSystem=/run -p RootImage=${image}.raw -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img1/usr/lib/os-release | grep -q -F "MARKER=1"
-systemd-run -t -p TemporaryFileSystem=/run -p RootImage=${image}.gpt -p RootHash=${roothash} -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img2/usr/lib/os-release | grep -q -F "MARKER=1"
+systemd-run -t -p TemporaryFileSystem=/run -p RootImage="${image}.raw" -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /usr/lib/os-release | grep -q -F "MARKER=1"
+systemd-run -t -p TemporaryFileSystem=/run -p RootImage="${image}.raw" -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img1/usr/lib/os-release | grep -q -F "MARKER=1"
+systemd-run -t -p TemporaryFileSystem=/run -p RootImage="${image}.gpt" -p RootHash="${roothash}" -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img2/usr/lib/os-release | grep -q -F "MARKER=1"
 cat >/run/systemd/system/testservice-50c.service <<EOF
 [Service]
 MountAPIVFS=yes
@@ -201,9 +204,9 @@ BindPaths=${image_dir}/result:/run/result
 Type=oneshot
 EOF
 systemctl start testservice-50c.service
-grep -q -F "MARKER=1" ${image_dir}/result/c
-grep -F "squashfs" ${image_dir}/result/c | grep -q -F "noatime"
-grep -F "squashfs" ${image_dir}/result/c | grep -q -F -v "nosuid"
+grep -q -F "MARKER=1" "${image_dir}/result/c"
+grep -F "squashfs" "${image_dir}/result/c" | grep -q -F "noatime"
+grep -F "squashfs" "${image_dir}/result/c" | grep -q -F -v "nosuid"
 
 # Adding a new mounts at runtime works if the unit is in the active state,
 # so use Type=notify to make sure there's no race condition in the test
@@ -218,7 +221,7 @@ ExecStart=/bin/sh -c 'systemd-notify --ready; while ! grep -q -F MARKER /tmp/img
 EOF
 systemctl start testservice-50d.service
 
-systemctl mount-image --mkdir testservice-50d.service ${image}.raw /tmp/img root:nosuid
+systemctl mount-image --mkdir testservice-50d.service "${image}.raw" /tmp/img root:nosuid
 
 while systemctl show -P SubState testservice-50d.service | grep -q running
 do
@@ -228,12 +231,12 @@ done
 systemctl is-active testservice-50d.service
 
 # ExtensionImages will set up an overlay
-systemd-run -t --property ExtensionImages=/usr/share/app0.raw --property RootImage=${image}.raw cat /opt/script0.sh | grep -q -F "extension-release.app0"
-systemd-run -t --property ExtensionImages=/usr/share/app0.raw --property RootImage=${image}.raw cat /usr/lib/systemd/system/some_file | grep -q -F "MARKER=1"
-systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage=${image}.raw cat /opt/script0.sh | grep -q -F "extension-release.app0"
-systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage=${image}.raw cat /usr/lib/systemd/system/some_file | grep -q -F "MARKER=1"
-systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage=${image}.raw cat /opt/script1.sh | grep -q -F "extension-release.app1"
-systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage=${image}.raw cat /usr/lib/systemd/system/other_file | grep -q -F "MARKER=1"
+systemd-run -t --property ExtensionImages=/usr/share/app0.raw --property RootImage="${image}.raw" cat /opt/script0.sh | grep -q -F "extension-release.app0"
+systemd-run -t --property ExtensionImages=/usr/share/app0.raw --property RootImage="${image}.raw" cat /usr/lib/systemd/system/some_file | grep -q -F "MARKER=1"
+systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage="${image}.raw" cat /opt/script0.sh | grep -q -F "extension-release.app0"
+systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage="${image}.raw" cat /usr/lib/systemd/system/some_file | grep -q -F "MARKER=1"
+systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage="${image}.raw" cat /opt/script1.sh | grep -q -F "extension-release.app1"
+systemd-run -t --property ExtensionImages="/usr/share/app0.raw /usr/share/app1.raw" --property RootImage="${image}.raw" cat /usr/lib/systemd/system/other_file | grep -q -F "MARKER=1"
 cat >/run/systemd/system/testservice-50e.service <<EOF
 [Service]
 MountAPIVFS=yes
diff --git a/test/units/testsuite-51.sh b/test/units/testsuite-51.sh
index 246412a079..06bc1602f8 100755
--- a/test/units/testsuite-51.sh
+++ b/test/units/testsuite-51.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 systemctl start testsuite-51-repro-1
diff --git a/test/units/testsuite-53.sh b/test/units/testsuite-53.sh
index 3536c24271..3eef94bc14 100755
--- a/test/units/testsuite-53.sh
+++ b/test/units/testsuite-53.sh
@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
->/failed
+: >/failed
 
 # Reset host date to current time, 3 days in the past.
 date -s "-3 days"
diff --git a/test/units/testsuite-54.sh b/test/units/testsuite-54.sh
index d145d7e33e..f8ddff4a30 100755
--- a/test/units/testsuite-54.sh
+++ b/test/units/testsuite-54.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-set -ex
+# shellcheck disable=SC2016
+set -eux
 
 systemd-analyze log-level debug
 
diff --git a/test/units/testsuite-55-slowgrowth.sh b/test/units/testsuite-55-slowgrowth.sh
index ff5a747348..68bffad454 100755
--- a/test/units/testsuite-55-slowgrowth.sh
+++ b/test/units/testsuite-55-slowgrowth.sh
@@ -1,32 +1,39 @@
 #!/usr/bin/env bash
-set -eu -o pipefail
+# Don't use set -x here, since it generates a lot of output and slows
+# the script down, causing unexpected test fails.
+set -eu
+set -o pipefail
 
 PAGE_SIZE=$(getconf PAGE_SIZE)
-BLOAT_ITERATION_TARGET=$(( 100 << 20 )) # 100 MB
+BLOAT_ITERATION_TARGET=$((100 << 20)) # 100 MB
 BLOAT_HOLDER=()
 PID="$$"
 
 function bloat {
-        local set_size=$(cat "/proc/$PID/statm" | cut -d " " -f2)
-        local mem_usage=$(( "$set_size" * "$PAGE_SIZE" ))
-        local target_mem_size=$(( "$mem_usage" + "$1" ))
+        local set_size mem_usage target_mem_size
+
+        # Following `| cat` weirdness is intentional to generate some reclaim
+        # activity in case there's no swap available.
+        set_size=$(cut -d " " -f2 "/proc/$PID/statm" | cat)
+        mem_usage=$((set_size * PAGE_SIZE))
+        target_mem_size=$((mem_usage + $1))
 
         BLOAT_HOLDER=()
         while [[ "$mem_usage" -lt "$target_mem_size" ]]; do
                 echo "target $target_mem_size"
                 echo "mem usage $mem_usage"
-                BLOAT_HOLDER+=( $(printf "%0.sg" {1..1000000}) )
-                set_size=$(cat "/proc/$PID/statm" | cut -d " " -f2)
-                mem_usage=$(( "$set_size" * "$PAGE_SIZE" ))
+                BLOAT_HOLDER+=("$(printf "=%0.s" {1..1000000})")
+                set_size=$(cut -d " " -f2 "/proc/$PID/statm" | cat)
+                mem_usage=$((set_size * PAGE_SIZE))
         done
 }
 
 function run {
         local arr=()
 
-        while [[ true ]]; do
+        while :; do
                 bloat "$BLOAT_ITERATION_TARGET"
-                arr+=( "$BLOAT_HOLDER" )
+                arr+=("${BLOAT_HOLDER[@]}")
                 sleep 1
         done
 }
diff --git a/test/units/testsuite-55.sh b/test/units/testsuite-55.sh
index d73f4b1e7a..63549c8a78 100755
--- a/test/units/testsuite-55.sh
+++ b/test/units/testsuite-55.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 set -o pipefail
 
 systemd-analyze log-level debug
@@ -7,14 +7,17 @@ systemd-analyze log-target console
 
 # Loose checks to ensure the environment has the necessary features for systemd-oomd
 [[ -e /proc/pressure ]] || echo "no PSI" >>/skipped
-cgroup_type=$(stat -fc %T /sys/fs/cgroup/)
+cgroup_type="$(stat -fc %T /sys/fs/cgroup/)"
 if [[ "$cgroup_type" != *"cgroup2"* ]] && [[ "$cgroup_type" != *"0x63677270"* ]]; then
     echo "no cgroup2" >>/skipped
 fi
 if [ ! -f /usr/lib/systemd/systemd-oomd ] && [ ! -f /lib/systemd/systemd-oomd ]; then
     echo "no oomd" >>/skipped
 fi
-[[ -e /skipped ]] && exit 0 || true
+
+if [[ -e /skipped ]]; then
+    exit 0
+fi
 
 rm -rf /etc/systemd/system/testsuite-55-testbloat.service.d
 
@@ -30,7 +33,7 @@ oomctl | grep "Default Memory Pressure Duration: 5s"
 
 # systemd-oomd watches for elevated pressure for 5 seconds before acting.
 # It can take time to build up pressure so either wait 2 minutes or for the service to fail.
-timeout=$(date -ud "2 minutes" +%s)
+timeout="$(date -ud "2 minutes" +%s)"
 while [[ $(date -u +%s) -le $timeout ]]; do
     if ! systemctl status testsuite-55-testbloat.service; then
         break
@@ -55,8 +58,8 @@ if setfattr -n user.xattr_test -v 1 /sys/fs/cgroup/; then
     systemctl start testsuite-55-testmunch.service
     systemctl start testsuite-55-testbloat.service
 
-    timeout=$(date -ud "2 minutes" +%s)
-    while [[ $(date -u +%s) -le $timeout ]]; do
+    timeout="$(date -ud "2 minutes" +%s)"
+    while [[ "$(date -u +%s)" -le "$timeout" ]]; do
         if ! systemctl status testsuite-55-testmunch.service; then
             break
         fi
diff --git a/test/units/testsuite-56.sh b/test/units/testsuite-56.sh
index 079da07201..27bd3ca8f7 100755
--- a/test/units/testsuite-56.sh
+++ b/test/units/testsuite-56.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -eux
 
 systemd-analyze log-level debug