diff --git a/board/common/mkrauc.sh b/board/common/mkrauc.sh
index ee97dc8c..a528c7fa 100755
--- a/board/common/mkrauc.sh
+++ b/board/common/mkrauc.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-GIT_VERSION=$(git -C $BR2_EXTERNAL_INFIX_PATH describe --always --dirty --tags)
+GIT_VERSION=$(git -C "$BR2_EXTERNAL_INFIX_PATH" describe --always --dirty --tags)
 
 name=$1
 compat=$2
@@ -11,19 +11,19 @@ sign=$3
 crt=$(ls $sign/*.crt)
 key=$(ls $sign/*.key)
 
-common=$(dirname $(readlink -f "$0"))
+common=$(dirname "$(readlink -f "$0")")
 
 work=$BUILD_DIR/mkrauc
-mkdir -p $work
+mkdir -p "$work"
 
-cp -f $common/rauc-hooks.sh $work/hooks.sh
+cp -f "$common/rauc-hooks.sh" "$work/hooks.sh"
 
 # RAUC internally uses the file extension to find a suitable install
 # handler, hence the name must be .img
-cp -f $BINARIES_DIR/rootfs.squashfs $work/rootfs.img
-cp -f $BINARIES_DIR/rootfs.itbh $work/rootfs.itbh
+cp -f "$BINARIES_DIR/rootfs.squashfs" "$work/rootfs.img"
+cp -f "$BINARIES_DIR/rootfs.itbh"     "$work/rootfs.itbh"
 
-cat >$work/manifest.raucm <<EOF
+cat >"$work/manifest.raucm" <<EOF
 [update]
 compatible=${compat}
 version=${GIT_VERSION}
@@ -39,7 +39,7 @@ filename=rootfs.img
 hooks=post-install
 EOF
 
-rm -f $BINARIES_DIR/$name.pkg
+rm -f "$BINARIES_DIR/$name.pkg"
 
-rauc --cert=$crt --key=$key \
-    bundle $work $BINARIES_DIR/$name.pkg
+rauc --cert="$crt" --key="$key" \
+     bundle "$work" "$BINARIES_DIR/$name.pkg"