diff --git a/Library/Homebrew/cmd/gist-logs.rb b/Library/Homebrew/cmd/gist-logs.rb
index 92bfb9d030..d9a184a948 100644
--- a/Library/Homebrew/cmd/gist-logs.rb
+++ b/Library/Homebrew/cmd/gist-logs.rb
@@ -85,9 +85,9 @@ module Homebrew
 
   # Causes some terminals to display secure password entry indicators.
   def noecho_gets
-    system "stty -echo"
+    system "stty", "-echo"
     result = $stdin.gets
-    system "stty echo"
+    system "stty", "echo"
     puts
     result
   end
diff --git a/Library/Homebrew/cmd/log.rb b/Library/Homebrew/cmd/log.rb
index 42344b700b..6c3e39829e 100644
--- a/Library/Homebrew/cmd/log.rb
+++ b/Library/Homebrew/cmd/log.rb
@@ -51,7 +51,7 @@ module Homebrew
 
   def git_log(cd_dir, path = nil, tap = nil, args:)
     cd cd_dir
-    repo = Utils.popen_read("git rev-parse --show-toplevel").chomp
+    repo = Utils.popen_read("git", "rev-parse", "--show-toplevel").chomp
     if tap
       name = tap.to_s
       git_cd = "$(brew --repo #{tap})"
diff --git a/Library/Homebrew/dev-cmd/bump-formula-pr.rb b/Library/Homebrew/dev-cmd/bump-formula-pr.rb
index 33fb4bb2cb..f88704091a 100644
--- a/Library/Homebrew/dev-cmd/bump-formula-pr.rb
+++ b/Library/Homebrew/dev-cmd/bump-formula-pr.rb
@@ -103,7 +103,7 @@ module Homebrew
     end
 
     formula.tap.path.cd do
-      unless Utils.popen_read("git remote -v").match?(%r{^homebrew.*Homebrew/homebrew-core.*$})
+      unless Utils.popen_read("git", "remote", "-v").match?(%r{^homebrew.*Homebrew/homebrew-core.*$})
         ohai "Adding #{homebrew_core_remote} remote"
         safe_system "git", "remote", "add", homebrew_core_remote, homebrew_core_url
       end
@@ -193,7 +193,7 @@ module Homebrew
         end
         check_new_version(formula, tap_full_name, url: old_url, tag: new_tag, args: args) if new_version.blank?
         resource_path, forced_version = fetch_resource(formula, new_version, old_url, tag: new_tag)
-        new_revision = Utils.popen_read("git -C \"#{resource_path}\" rev-parse -q --verify HEAD")
+        new_revision = Utils.popen_read("git", "-C", resource_path.to_s, "rev-parse", "-q", "--verify", "HEAD")
         new_revision = new_revision.strip
       elsif new_revision.blank?
         odie "#{formula}: the current URL requires specifying a `--revision=` argument."
diff --git a/Library/Homebrew/language/node.rb b/Library/Homebrew/language/node.rb
index d59d433295..524e5c3e16 100644
--- a/Library/Homebrew/language/node.rb
+++ b/Library/Homebrew/language/node.rb
@@ -30,7 +30,7 @@ module Language
         prepack_removed = pkg_json["scripts"]&.delete("prepack")
         package.atomic_write(JSON.pretty_generate(pkg_json)) if prepare_removed || prepack_removed
       end
-      output = Utils.popen_read("npm pack --ignore-scripts")
+      output = Utils.popen_read("npm", "pack", "--ignore-scripts")
       raise "npm failed to pack #{Dir.pwd}" if !$CHILD_STATUS.exitstatus.zero? || output.lines.empty?
 
       output.lines.last.chomp
diff --git a/Library/Homebrew/os/linux.rb b/Library/Homebrew/os/linux.rb
index 5436d6f00a..25a1291d07 100644
--- a/Library/Homebrew/os/linux.rb
+++ b/Library/Homebrew/os/linux.rb
@@ -11,7 +11,7 @@ module OS
     sig { returns(String) }
     def os_version
       if which("lsb_release")
-        lsb_info = Utils.popen_read("lsb_release -a")
+        lsb_info = Utils.popen_read("lsb_release", "-a")
         description = lsb_info[/^Description:\s*(.*)$/, 1]
         codename = lsb_info[/^Codename:\s*(.*)$/, 1]
         if codename.blank? || (codename == "n/a")
diff --git a/Library/Homebrew/os/mac/xcode.rb b/Library/Homebrew/os/mac/xcode.rb
index 89b7bb51ba..0edc942ae4 100644
--- a/Library/Homebrew/os/mac/xcode.rb
+++ b/Library/Homebrew/os/mac/xcode.rb
@@ -348,7 +348,7 @@ module OS
       end
 
       def detect_clang_version
-        version_output = Utils.popen_read("#{PKG_PATH}/usr/bin/clang --version")
+        version_output = Utils.popen_read("#{PKG_PATH}/usr/bin/clang", "--version")
         version_output[/clang-(\d+\.\d+\.\d+(\.\d+)?)/, 1]
       end
 
diff --git a/Library/Homebrew/test/language/node_spec.rb b/Library/Homebrew/test/language/node_spec.rb
index 5202296e40..5aaac0f581 100644
--- a/Library/Homebrew/test/language/node_spec.rb
+++ b/Library/Homebrew/test/language/node_spec.rb
@@ -4,7 +4,7 @@
 require "language/node"
 
 describe Language::Node do
-  let(:npm_pack_cmd) { "npm pack --ignore-scripts" }
+  let(:npm_pack_cmd) { ["npm", "pack", "--ignore-scripts"] }
 
   describe "#setup_npm_environment" do
     it "calls prepend_path when node formula exists only during the first call" do
@@ -31,7 +31,7 @@ describe Language::Node do
       mktmpdir.cd do
         path = Pathname("package.json")
         path.atomic_write("{\"scripts\":{\"prepare\": \"ls\", \"prepack\": \"ls\", \"test\": \"ls\"}}")
-        allow(Utils).to receive(:popen_read).with(npm_pack_cmd).and_return(`echo pack.tgz`)
+        allow(Utils).to receive(:popen_read).with(*npm_pack_cmd).and_return(`echo pack.tgz`)
         described_class.pack_for_installation
         expect(path.read).not_to include("prepare")
         expect(path.read).not_to include("prepack")
@@ -44,19 +44,19 @@ describe Language::Node do
     npm_install_arg = Pathname("libexec")
 
     it "raises error with non zero exitstatus" do
-      allow(Utils).to receive(:popen_read).with(npm_pack_cmd).and_return(`false`)
+      allow(Utils).to receive(:popen_read).with(*npm_pack_cmd).and_return(`false`)
       expect { described_class.std_npm_install_args(npm_install_arg) }.to \
         raise_error("npm failed to pack #{Dir.pwd}")
     end
 
     it "raises error with empty npm pack output" do
-      allow(Utils).to receive(:popen_read).with(npm_pack_cmd).and_return(`true`)
+      allow(Utils).to receive(:popen_read).with(*npm_pack_cmd).and_return(`true`)
       expect { described_class.std_npm_install_args(npm_install_arg) }.to \
         raise_error("npm failed to pack #{Dir.pwd}")
     end
 
     it "does not raise error with a zero exitstatus" do
-      allow(Utils).to receive(:popen_read).with(npm_pack_cmd).and_return(`echo pack.tgz`)
+      allow(Utils).to receive(:popen_read).with(*npm_pack_cmd).and_return(`echo pack.tgz`)
       resp = described_class.std_npm_install_args(npm_install_arg)
       expect(resp).to include("--prefix=#{npm_install_arg}", "#{Dir.pwd}/pack.tgz")
     end
diff --git a/Library/Homebrew/utils/github.rb b/Library/Homebrew/utils/github.rb
index 4e6549c6f3..acef79b932 100644
--- a/Library/Homebrew/utils/github.rb
+++ b/Library/Homebrew/utils/github.rb
@@ -481,7 +481,7 @@ module GitHub
     pr_message = info[:pr_message]
 
     sourcefile_path.parent.cd do
-      git_dir = Utils.popen_read("git rev-parse --git-dir").chomp
+      git_dir = Utils.popen_read("git", "rev-parse", "--git-dir").chomp
       shallow = !git_dir.empty? && File.exist?("#{git_dir}/shallow")
       changed_files = [sourcefile_path]
       changed_files += additional_files if additional_files.present?
@@ -500,7 +500,7 @@ module GitHub
 
         unless args.commit?
           if args.no_fork?
-            remote_url = Utils.popen_read("git remote get-url --push origin").chomp
+            remote_url = Utils.popen_read("git", "remote", "get-url", "--push", "origin").chomp
             username = tap.user
           else
             begin