diff --git a/Library/Homebrew/shims/linux/super/make b/Library/Homebrew/shims/linux/super/make
index e8bd9f82ef..69b6a8290d 100755
--- a/Library/Homebrew/shims/linux/super/make
+++ b/Library/Homebrew/shims/linux/super/make
@@ -1,26 +1,29 @@
 #!/bin/bash
 
+# HOMEBREW_CCCFG is set by extend/ENV/super.rb
+# HOMEBREW_LIBRARY is set by bin/brew
+# shellcheck disable=SC2154,SC2250
 pathremove() {
         local IFS=':' NEWPATH="" DIR="" PATHVARIABLE=${2:-PATH}
         for DIR in ${!PATHVARIABLE} ; do
-                if [ "$DIR" != "$1" ] ; then
-                  NEWPATH=${NEWPATH:+$NEWPATH:}$DIR
+                if [ "${DIR}" != "$1" ] ; then
+                  NEWPATH=${NEWPATH:+$NEWPATH:}${DIR}
                 fi
         done
-        export "$PATHVARIABLE"="$NEWPATH"
+        export "${PATHVARIABLE}"="${NEWPATH}"
 }
 
-if [[ -n "$HOMEBREW_MAKE" && "$HOMEBREW_MAKE" != "make" ]]
+if [[ -n "${HOMEBREW_MAKE}" && "${HOMEBREW_MAKE}" != "make" ]]
 then
-  export MAKE="$HOMEBREW_MAKE"
+  export MAKE="${HOMEBREW_MAKE}"
 else
-  SAVED_PATH="$PATH"
-  pathremove "$HOMEBREW_LIBRARY/Homebrew/shims/linux/super"
-  MAKE="$(which make)"
+  SAVED_PATH="${PATH}"
+  pathremove "${HOMEBREW_LIBRARY}/Homebrew/shims/linux/super"
+  MAKE="$(command -v make)"
   export MAKE
-  export PATH="$SAVED_PATH"
+  export PATH="${SAVED_PATH}"
 fi
 
-export HOMEBREW_CCCFG="O$HOMEBREW_CCCFG"
+export HOMEBREW_CCCFG="O${HOMEBREW_CCCFG}"
 
-exec "$MAKE" "$@"
+exec "${MAKE}" "$@"
diff --git a/Library/Homebrew/shims/mac/super/ant b/Library/Homebrew/shims/mac/super/ant
index 3d686024e5..835586479a 100755
--- a/Library/Homebrew/shims/mac/super/ant
+++ b/Library/Homebrew/shims/mac/super/ant
@@ -1,7 +1,9 @@
 #!/bin/bash
 
-export HOMEBREW_CCCFG="O$HOMEBREW_CCCFG"
+export HOMEBREW_CCCFG="O${HOMEBREW_CCCFG}"
 
 ant=/usr/bin/ant
-[[ -x "$ant" ]] || ant="$("$HOMEBREW_BREW_FILE" --prefix ant)/bin/ant"
-exec "$ant" "$@"
+# HOMEBREW_BREW_FILE is set by bin/brew
+# shellcheck disable=SC2154
+[[ -x "${ant}" ]] || ant="$("${HOMEBREW_BREW_FILE}" --prefix ant)/bin/ant"
+exec "${ant}" "$@"
diff --git a/Library/Homebrew/shims/mac/super/apr-1-config b/Library/Homebrew/shims/mac/super/apr-1-config
index e608fce1e6..c877ab11b7 100755
--- a/Library/Homebrew/shims/mac/super/apr-1-config
+++ b/Library/Homebrew/shims/mac/super/apr-1-config
@@ -1,12 +1,14 @@
 #!/bin/bash
 
-if [[ "$HOMEBREW_CCCFG" = *a* ]]
+# HOMEBREW_CCCFG and HOMEBREW_SDKROOT are set by extend/ENV/super.rb
+# shellcheck disable=SC2154
+if [[ "${HOMEBREW_CCCFG}" = *a* ]]
 then
   case "$1" in
     --cc)          echo "cc" ;;
     --cpp)         echo "cpp" ;;
-    --includedir)  echo "$HOMEBREW_SDKROOT/usr/include/apr-1" ;;
-    --includes)    echo "-isystem$HOMEBREW_SDKROOT/usr/include/apr-1" ;;
+    --includedir)  echo "${HOMEBREW_SDKROOT}/usr/include/apr-1" ;;
+    --includes)    echo "-isystem${HOMEBREW_SDKROOT}/usr/include/apr-1" ;;
     --apr-libtool) echo "glibtool" ;;
     *)
       exec xcrun apr-1-config "$@"
diff --git a/Library/Homebrew/shims/mac/super/bsdmake b/Library/Homebrew/shims/mac/super/bsdmake
index da05a16b2f..893e19f7f6 100755
--- a/Library/Homebrew/shims/mac/super/bsdmake
+++ b/Library/Homebrew/shims/mac/super/bsdmake
@@ -1,4 +1,4 @@
 #!/bin/bash
 
-export HOMEBREW_CCCFG="O$HOMEBREW_CCCFG"
+export HOMEBREW_CCCFG="O${HOMEBREW_CCCFG}"
 exec xcrun bsdmake "$@"
diff --git a/Library/Homebrew/shims/mac/super/make b/Library/Homebrew/shims/mac/super/make
index 46de531310..d4191b67cc 100755
--- a/Library/Homebrew/shims/mac/super/make
+++ b/Library/Homebrew/shims/mac/super/make
@@ -1,10 +1,12 @@
 #!/bin/bash
 
-if [[ -n "$HOMEBREW_MAKE" && "$HOMEBREW_MAKE" != "make" ]]
+# shellcheck disable=SC2154
+# HOMEBREW_CCCFG is set by extend/ENV/super.rb
+if [[ -n "${HOMEBREW_MAKE}" && "${HOMEBREW_MAKE}" != "make" ]]
 then
-  export MAKE="$HOMEBREW_MAKE"
+  export MAKE="${HOMEBREW_MAKE}"
 else
   MAKE="make"
 fi
-export HOMEBREW_CCCFG="O$HOMEBREW_CCCFG"
-exec xcrun "$MAKE" "$@"
+export HOMEBREW_CCCFG="O${HOMEBREW_CCCFG}"
+exec xcrun "${MAKE}" "$@"
diff --git a/Library/Homebrew/shims/mac/super/mig b/Library/Homebrew/shims/mac/super/mig
index 51e852da47..08cae8a2e8 100755
--- a/Library/Homebrew/shims/mac/super/mig
+++ b/Library/Homebrew/shims/mac/super/mig
@@ -1,4 +1,4 @@
 #!/bin/bash
 
 pwd="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-exec xcrun mig -cc "$pwd/cc" "$@"
+exec xcrun mig -cc "${pwd}/cc" "$@"
diff --git a/Library/Homebrew/shims/mac/super/pkg-config b/Library/Homebrew/shims/mac/super/pkg-config
index cca704592f..b0666879ba 100755
--- a/Library/Homebrew/shims/mac/super/pkg-config
+++ b/Library/Homebrew/shims/mac/super/pkg-config
@@ -1,11 +1,13 @@
 #!/bin/sh
 
-pkg_config="$HOMEBREW_OPT/pkg-config/bin/pkg-config"
+# HOMEBREW_OPT and HOMEBREW_SDKROOT are set by extend/ENV/super.rb
+# shellcheck disable=SC2154
+pkg_config="${HOMEBREW_OPT}/pkg-config/bin/pkg-config"
 
-if [ -z "$HOMEBREW_SDKROOT" ]; then
-  exec "$pkg_config" "$@"
+if [ -z "${HOMEBREW_SDKROOT}" ]; then
+  exec "${pkg_config}" "$@"
 fi
 
-exec "$pkg_config" \
-  "--define-variable=homebrew_sdkroot=$HOMEBREW_SDKROOT" \
+exec "${pkg_config}" \
+  "--define-variable=homebrew_sdkroot=${HOMEBREW_SDKROOT}" \
   "$@"
diff --git a/Library/Homebrew/shims/mac/super/pod2man b/Library/Homebrew/shims/mac/super/pod2man
index 1ad2cd2018..468f33259e 100755
--- a/Library/Homebrew/shims/mac/super/pod2man
+++ b/Library/Homebrew/shims/mac/super/pod2man
@@ -1,8 +1,10 @@
 #!/bin/bash
 
+# HOMEBREW_PREFIX is set by bin/brew
+# shellcheck disable=SC2154
 POD2MAN="$(type -P pod2man5.18 ||
            type -P pod2man5.16 ||
            type -P pod2man5.12 ||
-           type -P "$HOMEBREW_PREFIX/opt/pod2man/bin/pod2man" ||
+           type -P "${HOMEBREW_PREFIX}/opt/pod2man/bin/pod2man" ||
            echo /usr/bin/pod2man)"
-exec "$POD2MAN" "$@"
+exec "${POD2MAN}" "$@"
diff --git a/Library/Homebrew/shims/mac/super/ruby b/Library/Homebrew/shims/mac/super/ruby
index 9a125dc7e2..2bda4f4277 100755
--- a/Library/Homebrew/shims/mac/super/ruby
+++ b/Library/Homebrew/shims/mac/super/ruby
@@ -3,13 +3,15 @@
 # System Ruby's mkmf on Mojave (10.14) and later require SDKROOT set to work correctly.
 
 # Don't need shellcheck to follow the `source`.
-# shellcheck disable=SC1090
-source "$HOMEBREW_LIBRARY/Homebrew/shims/utils.sh"
+# HOMEBREW_LIBRARY is set by bin/brew
+# HOMEBREW_SDKROOT is set by extend/ENV/super.rb
+# shellcheck disable=SC1090,SC2154
+source "${HOMEBREW_LIBRARY}/Homebrew/shims/utils.sh"
 
-try_exec_non_system "$SHIM_FILE" "$@"
+try_exec_non_system "${SHIM_FILE}" "$@"
 
-if [[ -z "$SDKROOT" && -n "$HOMEBREW_SDKROOT" ]]; then
-  export SDKROOT=$HOMEBREW_SDKROOT
+if [[ -z "${SDKROOT}" && -n "${HOMEBREW_SDKROOT}" ]]; then
+  export SDKROOT=${HOMEBREW_SDKROOT}
 fi
 
-safe_exec "/usr/bin/$SHIM_FILE" "$@"
+safe_exec "/usr/bin/${SHIM_FILE}" "$@"
diff --git a/Library/Homebrew/shims/mac/super/xcrun b/Library/Homebrew/shims/mac/super/xcrun
index 00c34f31b7..100a606b9a 100755
--- a/Library/Homebrew/shims/mac/super/xcrun
+++ b/Library/Homebrew/shims/mac/super/xcrun
@@ -5,21 +5,24 @@
 # it and attempts to avoid these issues.
 
 # These could be used in conjunction with `--sdk` which ignores SDKROOT.
-if [[ "$*" =~ (^| )-?-show-sdk-(path|version|build) && -n "$HOMEBREW_DEVELOPER_DIR" ]]; then
-  export DEVELOPER_DIR=$HOMEBREW_DEVELOPER_DIR
+# HOMEBREW_DEVELOPER_DIR, HOMEBREW_SDKROOT and HOMEBREW_PREFER_CLT_PROXIES are set by extend/ENV/super.rb
+# shellcheck disable=SC2154
+if [[ "$*" =~ (^| )-?-show-sdk-(path|version|build) && -n "${HOMEBREW_DEVELOPER_DIR}" ]]; then
+  export DEVELOPER_DIR=${HOMEBREW_DEVELOPER_DIR}
 else
   # Some build tools set DEVELOPER_DIR, so discard it
   unset DEVELOPER_DIR
 fi
 
-if [[ -z "$SDKROOT" && -n "$HOMEBREW_SDKROOT" ]]; then
-  export SDKROOT=$HOMEBREW_SDKROOT
+if [[ -z "${SDKROOT}" && -n "${HOMEBREW_SDKROOT}" ]]; then
+  export SDKROOT=${HOMEBREW_SDKROOT}
 fi
 
 if [ $# -eq 0 ]; then
   exec /usr/bin/xcrun "$@"
 fi
 
+# shellcheck disable=SC2249
 case "$1" in
   -*) exec /usr/bin/xcrun "$@" ;;
 esac
@@ -28,34 +31,34 @@ arg0=$1
 shift
 
 exe="/usr/bin/${arg0}"
-if [[ -x "$exe" ]]; then
-  if [[ -n "$HOMEBREW_PREFER_CLT_PROXIES" ]]; then
-    exec "$exe" "$@"
-  elif [[ -z "$HOMEBREW_SDKROOT" || ! -d "$HOMEBREW_SDKROOT" ]]; then
-    exec "$exe" "$@"
+if [[ -x "${exe}" ]]; then
+  if [[ -n "${HOMEBREW_PREFER_CLT_PROXIES}" ]]; then
+    exec "${exe}" "$@"
+  elif [[ -z "${HOMEBREW_SDKROOT}" || ! -d "${HOMEBREW_SDKROOT}" ]]; then
+    exec "${exe}" "$@"
   fi
 fi
 
 SUPERBIN=$(cd "${0%/*}" && pwd -P)
 
-exe=$(/usr/bin/xcrun --find "$arg0" 2>/dev/null)
-if [[ -x "$exe" && "${exe%/*}" != "$SUPERBIN" ]]; then
-  exec "$exe" "$@"
+exe=$(/usr/bin/xcrun --find "${arg0}" 2>/dev/null)
+if [[ -x "${exe}" && "${exe%/*}" != "${SUPERBIN}" ]]; then
+  exec "${exe}" "$@"
 fi
 
-old_IFS=$IFS
+old_IFS=${IFS}
 IFS=:
-for path in $PATH; do
-  if [ "$path" = "$SUPERBIN" ]; then
+for path in ${PATH}; do
+  if [ "${path}" = "${SUPERBIN}" ]; then
     continue
   fi
 
   exe="${path}/${arg0}"
-  if [ -x "$exe" ]; then
-    exec "$exe" "$@"
+  if [ -x "${exe}" ]; then
+    exec "${exe}" "$@"
   fi
 done
-IFS=$old_IFS
+IFS=${old_IFS}
 
 echo >&2 "
 Failed to execute ${arg0} ${*}
diff --git a/Library/Homebrew/shims/scm/git b/Library/Homebrew/shims/scm/git
index 6b0382ad6e..21616723eb 100755
--- a/Library/Homebrew/shims/scm/git
+++ b/Library/Homebrew/shims/scm/git
@@ -3,7 +3,13 @@
 # This script because we support $HOMEBREW_GIT, $HOMEBREW_SVN, etc., Xcode-only and
 # no Xcode/CLT configurations. Order is careful to be what the user would want.
 
-if [ -z "$HOMEBREW_LIBRARY" ]
+# HOMEBREW_LIBRARY is set by bin/brew
+# SHIM_FILE is set by shims/utils.sh
+# HOMEBREW_GIT is set by brew.sh
+# HOMEBREW_SVN is from the user environment.
+# HOMEBREW_PREFIX is set extend/ENV/super.rb
+# shellcheck disable=SC2154
+if [ -z "${HOMEBREW_LIBRARY}" ]
 then
   echo "${0##*/}: This shim is internal and must be run via brew." >&2
   exit 1
@@ -11,27 +17,28 @@ fi
 
 # Don't need shellcheck to follow the `source`.
 # shellcheck disable=SC1090
-source "$HOMEBREW_LIBRARY/Homebrew/shims/utils.sh"
+source "${HOMEBREW_LIBRARY}/Homebrew/shims/utils.sh"
 
-case "$(lowercase "$SHIM_FILE")" in
+# shellcheck disable=SC2249
+case "$(lowercase "${SHIM_FILE}")" in
   git)
-    if [[ -n "$HOMEBREW_GIT" && "$HOMEBREW_GIT" != git ]]
+    if [[ -n "${HOMEBREW_GIT}" && "${HOMEBREW_GIT}" != git ]]
     then
-      safe_exec "$(type -P "$HOMEBREW_GIT")" "$@"
+      safe_exec "$(type -P "${HOMEBREW_GIT}")" "$@"
     fi
     ;;
   svn)
-    if [[ -n "$HOMEBREW_SVN" && "$HOMEBREW_SVN" != svn ]]
+    if [[ -n "${HOMEBREW_SVN}" && "${HOMEBREW_SVN}" != svn ]]
     then
-      safe_exec "$(type -P "$HOMEBREW_SVN")" "$@"
+      safe_exec "$(type -P "${HOMEBREW_SVN}")" "$@"
     fi
     ;;
 esac
 
-brew_prefix_version="$HOMEBREW_PREFIX/bin/$SHIM_FILE"
-safe_exec "$brew_prefix_version" "$@"
+brew_prefix_version="${HOMEBREW_PREFIX}/bin/${SHIM_FILE}"
+safe_exec "${brew_prefix_version}" "$@"
 
-try_exec_non_system "$SHIM_FILE" "$@"
+try_exec_non_system "${SHIM_FILE}" "$@"
 
 if executable "/usr/bin/xcode-select"
 then
@@ -39,28 +46,28 @@ then
   #   /usr/bin/<tool> will be a popup stub under such configuration.
   # xcrun hangs if xcode-select is set to "/"
   xcode_path="$(/usr/bin/xcode-select -print-path 2>/dev/null)"
-  if [[ -z "$xcode_path" ]]
+  if [[ -z "${xcode_path}" ]]
   then
-    if [[ "$HOMEBREW_MACOS_VERSION_NUMERIC" -ge "100900" ]]
+    if [[ "${HOMEBREW_MACOS_VERSION_NUMERIC}" -ge "100900" ]]
     then
       popup_stub=1
     fi
   fi
-  if [[ -z "$popup_stub" && "$xcode_path" != "/" ]]
+  if [[ -z "${popup_stub}" && "${xcode_path}" != "/" ]]
   then
-    path="$(/usr/bin/xcrun -find "$SHIM_FILE" 2>/dev/null)"
-    safe_exec "$path" "$@"
+    path="$(/usr/bin/xcrun -find "${SHIM_FILE}" 2>/dev/null)"
+    safe_exec "${path}" "$@"
   fi
 fi
 
-path="/Applications/Xcode.app/Contents/Developer/usr/bin/$SHIM_FILE"
-safe_exec "$path" "$@"
+path="/Applications/Xcode.app/Contents/Developer/usr/bin/${SHIM_FILE}"
+safe_exec "${path}" "$@"
 
-if [[ -z "$popup_stub" && "$HOMEBREW_MACOS_VERSION_NUMERIC" -lt "101500" ]]
+if [[ -z "${popup_stub}" && "${HOMEBREW_MACOS_VERSION_NUMERIC}" -lt "101500" ]]
 then
-  path="/usr/bin/$SHIM_FILE"
-  safe_exec "$path" "$@"
+  path="/usr/bin/${SHIM_FILE}"
+  safe_exec "${path}" "$@"
 fi
 
-echo "You must: brew install $SHIM_FILE" >&2
+echo "You must: brew install ${SHIM_FILE}" >&2
 exit 1
diff --git a/Library/Homebrew/shims/utils.sh b/Library/Homebrew/shims/utils.sh
index 9252bf7653..4b2090529e 100644
--- a/Library/Homebrew/shims/utils.sh
+++ b/Library/Homebrew/shims/utils.sh
@@ -11,7 +11,7 @@ absdir() {
 dirbasepath() {
   local dir="$1"
   local base="${2##*/}"
-  echo "$dir/$base"
+  echo "${dir}/${base}"
 }
 
 realpath() {
@@ -19,28 +19,28 @@ realpath() {
   local dir
   local dest
 
-  dir="$(absdir "$path")"
-  path="$(dirbasepath "$dir" "$path")"
+  dir="$(absdir "${path}")"
+  path="$(dirbasepath "${dir}" "${path}")"
 
-  while [[ -L "$path" ]]
+  while [[ -L "${path}" ]]
   do
-    dest="$(readlink "$path")"
-    if [[ "$dest" = "/"* ]]
+    dest="$(readlink "${path}")"
+    if [[ "${dest}" = "/"* ]]
     then
-      path="$dest"
+      path="${dest}"
     else
-      path="$dir/$dest"
+      path="${dir}/${dest}"
     fi
-    dir="$(absdir "$path")"
-    path="$(dirbasepath "$dir" "$path")"
+    dir="$(absdir "${path}")"
+    path="$(dirbasepath "${dir}" "${path}")"
   done
 
-  echo "$path"
+  echo "${path}"
 }
 
 executable() {
   local file="$1"
-  [[ -f "$file" && -x "$file" ]]
+  [[ -f "${file}" && -x "${file}" ]]
 }
 
 lowercase() {
@@ -49,22 +49,22 @@ lowercase() {
 
 safe_exec() {
   local arg0="$1"
-  if ! executable "$arg0"
+  if ! executable "${arg0}"
   then
     return
   fi
   # prevent fork-bombs
-  if [[ "$(lowercase "$arg0")" = "$SHIM_FILE" || "$(realpath "$arg0")" = "$SHIM_REAL" ]]
+  if [[ "$(lowercase "${arg0}")" = "${SHIM_FILE}" || "$(realpath "${arg0}")" = "${SHIM_REAL}" ]]
   then
     return
   fi
-  if [[ "$HOMEBREW" = "print-path" ]]
+  if [[ "${HOMEBREW}" = "print-path" ]]
   then
     local dir
     dir="$(quiet_safe_cd "${arg0%/*}/" && pwd)"
     local path
-    path="$(dirbasepath "$dir" "$arg0")"
-    echo "$path"
+    path="$(dirbasepath "${dir}" "${arg0}")"
+    echo "${path}"
     exit
   fi
   exec "$@"
@@ -75,11 +75,11 @@ try_exec_non_system() {
   shift
 
 	IFS=$'\n'
-	for path in $(type -aP "$file")
+	for path in $(type -aP "${file}")
 	do
-	  if [[ "$path" != "/usr/bin/$file" ]]
+	  if [[ "${path}" != "/usr/bin/${file}" ]]
 	  then
-	    safe_exec "$path" "$@"
+	    safe_exec "${path}" "$@"
 	  fi
 	done
 	unset IFS