diff --git a/scripts/flake-regressions.sh b/scripts/flake-regressions.sh
index 56941285d0d..c8c6bee941d 100755
--- a/scripts/flake-regressions.sh
+++ b/scripts/flake-regressions.sh
@@ -9,7 +9,7 @@ cd flake-regressions
 
 status=0
 
-flakes=$(ls -d tests/*/*/* | sort | head -n50)
+flakes=$(find tests -mindepth 3 -maxdepth 3 -type d -not -path '*/.*' | sort | head -n50)
 
 echo "Running flake tests..."
 
@@ -21,7 +21,7 @@ for flake in $flakes; do
         continue
     fi
 
-    if ! REGENERATE=0 ./eval-flake.sh $flake; then
+    if ! REGENERATE=0 ./eval-flake.sh "$flake"; then
         status=1
         echo "❌ $flake"
     else
diff --git a/tests/functional/flakes/lazy-trees.sh b/tests/functional/flakes/lazy-trees.sh
index 607c7e9d0db..56943f3737d 100644
--- a/tests/functional/flakes/lazy-trees.sh
+++ b/tests/functional/flakes/lazy-trees.sh
@@ -1,10 +1,12 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 flake1Dir=$TEST_ROOT/flake1
 
-mkdir -p $flake1Dir
+mkdir -p "$flake1Dir"
 
-cat > $flake1Dir/flake.nix <<EOF
+cat > "$flake1Dir/flake.nix" <<EOF
 {
   outputs = { self }: {
     everything = builtins.path { path = ./.; name = "source"; };
@@ -32,40 +34,41 @@ cat > $flake1Dir/flake.nix <<EOF
 }
 EOF
 
-cp ../config.nix $flake1Dir/
-echo foo > $flake1Dir/foo
+cp ../config.nix "$flake1Dir/"
+echo foo > "$flake1Dir/foo"
 
 # Add an uncopyable file to test laziness.
-mkfifo $flake1Dir/fifo
+mkfifo "$flake1Dir/fifo"
 
-expectStderr 1 nix build --json --out-link $TEST_ROOT/result $flake1Dir#everything | grep 'has an unsupported type'
+expectStderr 1 nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#everything" | grep 'has an unsupported type'
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#foo
-[[ $(cat $TEST_ROOT/result) = foo ]]
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#foo"
+[[ $(cat "$TEST_ROOT/result") = foo ]]
 # FIXME: check that the name of `result` is `foo`, not `source`.
 
 # Check that traces/errors refer to the pretty-printed source path, not a virtual path.
-nix eval $flake1Dir#trace 2>&1 | grep "trace: path $flake1Dir/foo"
-expectStderr 1 nix eval $flake1Dir#throw 2>&1 | grep "error: path $flake1Dir/foo"
-expectStderr 1 nix eval $flake1Dir#abort 2>&1 | grep "error:.*path $flake1Dir/foo"
+nix eval "$flake1Dir#trace" 2>&1 | grep "trace: path $flake1Dir/foo"
+expectStderr 1 nix eval "$flake1Dir#throw" 2>&1 | grep "error: path $flake1Dir/foo"
+expectStderr 1 nix eval "$flake1Dir#abort" 2>&1 | grep "error:.*path $flake1Dir/foo"
 
-nix build --out-link $TEST_ROOT/result $flake1Dir#drv1
-[[ $(cat $TEST_ROOT/result/foo) = foo ]]
-[[ $(realpath $TEST_ROOT/result/foo) =~ $NIX_STORE_DIR/.*-foo$ ]]
+nix build --out-link "$TEST_ROOT/result" "$flake1Dir#drv1"
+[[ $(cat "$TEST_ROOT/result/foo") = foo ]]
+[[ $(realpath "$TEST_ROOT/result/foo") =~ $NIX_STORE_DIR/.*-foo$ ]]
 
 # Check for warnings about passing `toString ./path` to a derivation.
-nix build --out-link $TEST_ROOT/result $flake1Dir#drv2 2>&1 | grep "warning: derivation.*has an attribute that refers to source tree"
-[[ $(readlink $TEST_ROOT/result/foo) =~ $NIX_STORE_DIR/lazylazy.*-source/foo$ ]]
+nix build --out-link "$TEST_ROOT/result" "$flake1Dir#drv2" 2>&1 | grep "warning: derivation.*has an attribute that refers to source tree"
+[[ $(readlink "$TEST_ROOT/result/foo") =~ $NIX_STORE_DIR/lazylazy.*-source/foo$ ]]
 
 # If the source tree can be hashed, the virtual path will be rewritten
 # to the path that would exist if the source tree were copied to the
 # Nix store.
-rm $flake1Dir/fifo
-nix build --out-link $TEST_ROOT/result $flake1Dir#drv2
+rm "$flake1Dir/fifo"
+nix build --out-link "$TEST_ROOT/result" "$flake1Dir#drv2"
 
 # But we don't *actually* copy it.
-(! realpath $TEST_ROOT/result/foo)
+(! realpath "$TEST_ROOT/result/foo")
 
 # Force the path to exist.
-path=$(nix eval --raw $flake1Dir#everything)
-realpath $TEST_ROOT/result/foo
+path=$(nix eval --raw "$flake1Dir#everything")
+[[ -e $path ]]
+realpath "$TEST_ROOT/result/foo"
diff --git a/tests/functional/flakes/patch.sh b/tests/functional/flakes/patch.sh
index b276303de28..89f54f78eaf 100644
--- a/tests/functional/flakes/patch.sh
+++ b/tests/functional/flakes/patch.sh
@@ -1,13 +1,15 @@
+#! /usr/bin/env bash
+
 source common.sh
 
 flake1Dir=$TEST_ROOT/flake1
 flake2Dir=$TEST_ROOT/flake2
 flake3Dir=$TEST_ROOT/flake3
 
-rm -rf $flake1Dir $flake2Dir $flake3Dir
-mkdir -p $flake1Dir/dir $flake2Dir $flake3Dir
+rm -rf "$flake1Dir" "$flake2Dir" "$flake3Dir"
+mkdir -p "$flake1Dir/dir" "$flake2Dir" "$flake3Dir"
 
-cat > $flake2Dir/flake.nix <<EOF
+cat > "$flake2Dir/flake.nix" <<EOF
 {
   outputs = { self }: {
     y = 2;
@@ -16,9 +18,9 @@ cat > $flake2Dir/flake.nix <<EOF
 }
 EOF
 
-echo "10 + 20" > $flake2Dir/z.nix
+echo "10 + 20" > "$flake2Dir/z.nix"
 
-cat > $flake1Dir/dir/flake.nix <<EOF
+cat > "$flake1Dir/dir/flake.nix" <<EOF
 {
   inputs.flake2 = {
     url = path://$flake2Dir?lock=1;
@@ -31,7 +33,7 @@ cat > $flake1Dir/dir/flake.nix <<EOF
 }
 EOF
 
-cat > $flake1Dir/p1.patch <<EOF
+cat > "$flake1Dir/p1.patch" <<EOF
 diff -ru a/flake.nix b/flake.nix
 --- a/flake.nix	2023-03-24 13:36:31.152372459 +0100
 +++ b/flake.nix	2023-03-24 13:35:59.309846802 +0100
@@ -45,7 +47,7 @@ diff -ru a/flake.nix b/flake.nix
  }
 EOF
 
-cat > $flake1Dir/p2.patch <<EOF
+cat > "$flake1Dir/p2.patch" <<EOF
 diff -ru a/z.nix b/z.nix
 --- a/z.nix	2023-03-24 13:36:31.152372459 +0100
 +++ b/z.nix	2023-03-24 13:36:12.900071116 +0100
@@ -54,7 +56,7 @@ diff -ru a/z.nix b/z.nix
 +100 + 200
 EOF
 
-cat > $flake1Dir/dir/p3.patch <<EOF
+cat > "$flake1Dir/dir/p3.patch" <<EOF
 diff -ru a/z.nix b/z.nix
 --- a/z.nix	2023-03-24 13:36:31.152372459 +0100
 +++ b/z.nix	2023-03-24 13:36:12.900071116 +0100
@@ -65,10 +67,10 @@ EOF
 
 # Do this twice. First one will apply the patches in flake.cc, the
 # second in call-flake.nix.
-[[ $(nix eval -vvvvv path://$flake1Dir?dir=dir#x) = 356 ]]
-[[ $(nix eval path://$flake1Dir?dir=dir#x) = 356 ]]
+[[ $(nix eval -vvvvv "path://$flake1Dir?dir=dir#x") = 356 ]]
+[[ $(nix eval "path://$flake1Dir?dir=dir#x") = 356 ]]
 
-cat > $flake3Dir/flake.nix <<EOF
+cat > "$flake3Dir/flake.nix" <<EOF
 {
   inputs.flake1 = {
     url = path://$flake1Dir?dir=dir&lock=1;
@@ -80,7 +82,7 @@ cat > $flake3Dir/flake.nix <<EOF
 }
 EOF
 
-[[ $(nix eval $flake3Dir#a) = 712 ]]
-rm $flake1Dir/dir/flake.lock $flake3Dir/flake.lock
-[[ $(nix eval $flake3Dir#a) = 712 ]]
-[[ $(nix eval $flake3Dir#a) = 712 ]]
+[[ $(nix eval "$flake3Dir#a") = 712 ]]
+rm "$flake1Dir/dir/flake.lock" "$flake3Dir/flake.lock"
+[[ $(nix eval "$flake3Dir#a") = 712 ]]
+[[ $(nix eval "$flake3Dir#a") = 712 ]]
diff --git a/tests/functional/flakes/relative-paths.sh b/tests/functional/flakes/relative-paths.sh
index cecda44d4bc..8b89befb9da 100644
--- a/tests/functional/flakes/relative-paths.sh
+++ b/tests/functional/flakes/relative-paths.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 requireGit
@@ -7,10 +9,10 @@ subflake0=$rootFlake/sub0
 subflake1=$rootFlake/sub1
 subflake2=$rootFlake/sub2
 
-rm -rf $rootFlake
-mkdir -p $rootFlake $subflake0 $subflake1 $subflake2
+rm -rf "$rootFlake"
+mkdir -p "$rootFlake" "$subflake0" "$subflake1" "$subflake2"
 
-cat > $rootFlake/flake.nix <<EOF
+cat > "$rootFlake/flake.nix" <<EOF
 {
   inputs.sub0.url = "./sub0";
   outputs = { self, sub0 }: {
@@ -20,7 +22,7 @@ cat > $rootFlake/flake.nix <<EOF
 }
 EOF
 
-cat > $subflake0/flake.nix <<EOF
+cat > "$subflake0/flake.nix" <<EOF
 {
   outputs = { self }: {
     x = 7;
@@ -28,10 +30,10 @@ cat > $subflake0/flake.nix <<EOF
 }
 EOF
 
-[[ $(nix eval $rootFlake#x) = 2 ]]
-[[ $(nix eval $rootFlake#y) = 14 ]]
+[[ $(nix eval "$rootFlake#x") = 2 ]]
+[[ $(nix eval "$rootFlake#y") = 14 ]]
 
-cat > $subflake1/flake.nix <<EOF
+cat > "$subflake1/flake.nix" <<EOF
 {
   inputs.root.url = "../";
   outputs = { self, root }: {
@@ -41,14 +43,14 @@ cat > $subflake1/flake.nix <<EOF
 }
 EOF
 
-[[ $(nix eval $rootFlake?dir=sub1#y) = 6 ]]
+[[ $(nix eval "$rootFlake?dir=sub1#y") = 6 ]]
 
-git init $rootFlake
-git -C $rootFlake add flake.nix sub0/flake.nix sub1/flake.nix
+git init "$rootFlake"
+git -C "$rootFlake" add flake.nix sub0/flake.nix sub1/flake.nix
 
-[[ $(nix eval $subflake1#y) = 6 ]]
+[[ $(nix eval "$subflake1#y") = 6 ]]
 
-cat > $subflake2/flake.nix <<EOF
+cat > "$subflake2/flake.nix" <<EOF
 {
   inputs.root.url = "../";
   inputs.sub1.url = "../sub1";
@@ -59,19 +61,19 @@ cat > $subflake2/flake.nix <<EOF
 }
 EOF
 
-git -C $rootFlake add flake.nix sub2/flake.nix
+git -C "$rootFlake" add flake.nix sub2/flake.nix
 
-[[ $(nix eval $subflake2#y) = 15 ]]
+[[ $(nix eval "$subflake2#y") = 15 ]]
 
 # Make sure there are no content locks for relative path flakes.
-(! grep "$TEST_ROOT" $subflake2/flake.lock)
-(! grep "$NIX_STORE_DIR" $subflake2/flake.lock)
-(! grep narHash $subflake2/flake.lock)
+(! grep "$TEST_ROOT" "$subflake2/flake.lock")
+(! grep "$NIX_STORE_DIR" "$subflake2/flake.lock")
+(! grep narHash "$subflake2/flake.lock")
 
 # Test circular relative path flakes. FIXME: doesn't work at the moment.
 if false; then
 
-cat > $rootFlake/flake.nix <<EOF
+cat > "$rootFlake/flake.nix" <<EOF
 {
   inputs.sub1.url = "./sub1";
   inputs.sub2.url = "./sub1";
@@ -83,7 +85,7 @@ cat > $rootFlake/flake.nix <<EOF
 }
 EOF
 
-[[ $(nix eval $rootFlake#x) = 30 ]]
-[[ $(nix eval $rootFlake#z) = 90 ]]
+[[ $(nix eval "$rootFlake#x") = 30 ]]
+[[ $(nix eval "$rootFlake#z") = 90 ]]
 
 fi
diff --git a/tests/functional/flakes/tree-operators.sh b/tests/functional/flakes/tree-operators.sh
index 718efa31a32..e401793707c 100644
--- a/tests/functional/flakes/tree-operators.sh
+++ b/tests/functional/flakes/tree-operators.sh
@@ -1,12 +1,14 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 flake1Dir=$TEST_ROOT/flake1
 
-mkdir -p $flake1Dir
+mkdir -p "$flake1Dir"
 
 pwd=$(pwd)
 
-cat > $flake1Dir/flake.nix <<EOF
+cat > "$flake1Dir/flake.nix" <<EOF
 {
   inputs.docs = {
     url = "path://$pwd/..";
@@ -34,12 +36,12 @@ cat > $flake1Dir/flake.nix <<EOF
 }
 EOF
 
-cp ../lang/lib.nix $flake1Dir/
+cp ../lang/lib.nix "$flake1Dir/"
 
-nix build --out-link $TEST_ROOT/result $flake1Dir#shOnly
+nix build --out-link "$TEST_ROOT/result" "$flake1Dir#shOnly"
 [[ -e $TEST_ROOT/result/flakes/tree-operators.sh ]]
-(! find $TEST_ROOT/result/ -type f | grep -v '.sh$')
+(! find "$TEST_ROOT/result/" -type f | grep -v '.sh$')
 
-nix build --out-link $TEST_ROOT/result $flake1Dir#lang
+nix build --out-link "$TEST_ROOT/result" "$flake1Dir#lang"
 [[ -e $TEST_ROOT/result/dir1 ]]
-(! [[ -e $TEST_ROOT/result/readDir ]])
+[[ ! -e $TEST_ROOT/result/readDir ]]