diff --git a/releasenotes/notes/fix-shellcheck-errors-04d1683561e9ecc9.yaml b/releasenotes/notes/fix-shellcheck-errors-04d1683561e9ecc9.yaml
new file mode 100644
index 000000000..b237658ca
--- /dev/null
+++ b/releasenotes/notes/fix-shellcheck-errors-04d1683561e9ecc9.yaml
@@ -0,0 +1,4 @@
+---
+fixes:
+  - |
+    Address several linting errors in scripts, mostly unquoted variables
diff --git a/shell/openstack-cleanup-orphaned-objects.sh b/shell/openstack-cleanup-orphaned-objects.sh
index 59e1edff6..689eab27f 100755
--- a/shell/openstack-cleanup-orphaned-objects.sh
+++ b/shell/openstack-cleanup-orphaned-objects.sh
@@ -83,11 +83,11 @@ trap _rmtemp EXIT
 # Output the initial list of object UUIDs to a temporary file
 if [[ -n ${filters} ]]; then
     # If a filter/match condition is requested/set
-    openstack --os-cloud "$os_cloud" "${object}" list -f value -c ID $attributes \
+    openstack --os-cloud "$os_cloud" "${object}" list -f value -c ID "$attributes" \
      | { $filters || true; } | { awk '{print $1}' || true; } > "$tmpfile"
 else
     # Otherwise don't pipe through an additional command
-    openstack --os-cloud "$os_cloud" "${object}" list -f value -c ID $attributes \
+    openstack --os-cloud "$os_cloud" "${object}" list -f value -c ID "$attributes" \
      | { awk '{print $1}' || true; } > "$tmpfile"
 fi
 
diff --git a/shell/release-job.sh b/shell/release-job.sh
index 57e403870..e01d3a93c 100644
--- a/shell/release-job.sh
+++ b/shell/release-job.sh
@@ -97,7 +97,7 @@ set_variables_common(){
 
     TAG_RELEASE="${TAG_RELEASE:-None}"
     if [[ $TAG_RELEASE == "None" ]]; then
-        if grep -q "tag_release" $release_file ; then
+        if grep -q "tag_release" "$release_file"; then
             TAG_RELEASE=$(yq -r .tag_release "$release_file")
         else
             TAG_RELEASE=true
@@ -183,7 +183,7 @@ set_variables_packagecloud(){
         VERSION=$(yq -r ".version" "$release_file")
     fi
     if [[ -z ${GIT_TAG:-} ]]; then
-        if grep -q "git_tag" $release_file ; then
+        if grep -q "git_tag" "$release_file"; then
             GIT_TAG=$(yq -r ".git_tag" "$release_file")
         else
             GIT_TAG="$VERSION"
@@ -385,8 +385,8 @@ artifact_release_file(){
     mkdir artifacts
     ORG=$(echo "$NEXUS_URL" | awk -F'.' '{print $2}')
 
-    for namequoted in $(yq '.artifacts[].name' $release_file); do
-        pathquoted=$(yq ".artifacts[] |select(.name==$namequoted) |.path" $release_file)
+    for namequoted in $(yq '.artifacts[].name' "$release_file"); do
+        pathquoted=$(yq ".artifacts[] |select(.name==$namequoted) |.path" "$release_file")
 
         #Remove extra yaml quotes
         name="${namequoted#\"}"
@@ -420,8 +420,8 @@ container_release_file(){
     local lfn_umbrella
     lfn_umbrella="$(echo "$GERRIT_URL" | awk -F"." '{print $2}')"
 
-    for namequoted in $(yq '.containers[].name' $release_file); do
-        versionquoted=$(yq ".containers[] |select(.name==$namequoted) |.version" $release_file)
+    for namequoted in $(yq '.containers[].name' "$release_file"); do
+        versionquoted=$(yq ".containers[] |select(.name==$namequoted) |.version" "$release_file")
 
         #Remove extra yaml quotes
         name="${namequoted#\"}"
@@ -657,7 +657,7 @@ case $DISTRIBUTION_TYPE in
         fi
         set_variables_packagecloud
         verify_packagecloud_match_release
-        for name in $(yq -r '.packages[].name' $release_file); do
+        for name in $(yq -r '.packages[].name' "$release_file"); do
             package=$name
             packagecloud_verify "$package" "$packagecloud_account"
             if [[ "$JOB_NAME" =~ "merge" ]] && ! $DRY_RUN; then