diff --git a/Library/Homebrew/cask/artifact/installer.rb b/Library/Homebrew/cask/artifact/installer.rb
index 899a44b158..612b86c5fb 100644
--- a/Library/Homebrew/cask/artifact/installer.rb
+++ b/Library/Homebrew/cask/artifact/installer.rb
@@ -6,10 +6,10 @@ using HashValidator
 module Cask
   module Artifact
     class Installer < AbstractArtifact
-      VALID_KEYS = Set.new [
-        :manual,
-        :script,
-      ]
+      VALID_KEYS = Set.new([
+                             :manual,
+                             :script,
+                           ]).freeze
 
       module ManualInstaller
         def install_phase(**)
diff --git a/Library/Homebrew/cask/cmd/internal_stanza.rb b/Library/Homebrew/cask/cmd/internal_stanza.rb
index fe6527901a..be830311a0 100644
--- a/Library/Homebrew/cask/cmd/internal_stanza.rb
+++ b/Library/Homebrew/cask/cmd/internal_stanza.rb
@@ -22,8 +22,8 @@ module Cask
       #
 
       ARTIFACTS =
-        DSL::ORDINARY_ARTIFACT_CLASSES.map(&:dsl_key) +
-        DSL::ARTIFACT_BLOCK_CLASSES.map(&:dsl_key)
+        (DSL::ORDINARY_ARTIFACT_CLASSES.map(&:dsl_key) +
+         DSL::ARTIFACT_BLOCK_CLASSES.map(&:dsl_key)).freeze
 
       option "--table",   :table,   false
       option "--quiet",   :quiet,   false
diff --git a/Library/Homebrew/cask/dsl.rb b/Library/Homebrew/cask/dsl.rb
index 57ff905511..7db3d80dfa 100644
--- a/Library/Homebrew/cask/dsl.rb
+++ b/Library/Homebrew/cask/dsl.rb
@@ -46,34 +46,34 @@ module Cask
       Artifact::Zap,
     ].freeze
 
-    ACTIVATABLE_ARTIFACT_CLASSES = ORDINARY_ARTIFACT_CLASSES - [Artifact::StageOnly]
+    ACTIVATABLE_ARTIFACT_CLASSES = (ORDINARY_ARTIFACT_CLASSES - [Artifact::StageOnly]).freeze
 
     ARTIFACT_BLOCK_CLASSES = [
       Artifact::PreflightBlock,
       Artifact::PostflightBlock,
     ].freeze
 
-    DSL_METHODS = Set.new [
-      :appcast,
-      :artifacts,
-      :auto_updates,
-      :caveats,
-      :conflicts_with,
-      :container,
-      :depends_on,
-      :homepage,
-      :language,
-      :languages,
-      :name,
-      :sha256,
-      :staged_path,
-      :url,
-      :version,
-      :appdir,
-      *ORDINARY_ARTIFACT_CLASSES.map(&:dsl_key),
-      *ACTIVATABLE_ARTIFACT_CLASSES.map(&:dsl_key),
-      *ARTIFACT_BLOCK_CLASSES.flat_map { |klass| [klass.dsl_key, klass.uninstall_dsl_key] },
-    ].freeze
+    DSL_METHODS = Set.new([
+                            :appcast,
+                            :artifacts,
+                            :auto_updates,
+                            :caveats,
+                            :conflicts_with,
+                            :container,
+                            :depends_on,
+                            :homepage,
+                            :language,
+                            :languages,
+                            :name,
+                            :sha256,
+                            :staged_path,
+                            :url,
+                            :version,
+                            :appdir,
+                            *ORDINARY_ARTIFACT_CLASSES.map(&:dsl_key),
+                            *ACTIVATABLE_ARTIFACT_CLASSES.map(&:dsl_key),
+                            *ARTIFACT_BLOCK_CLASSES.flat_map { |klass| [klass.dsl_key, klass.uninstall_dsl_key] },
+                          ]).freeze
 
     attr_reader :cask, :token
 
diff --git a/Library/Homebrew/cask/dsl/container.rb b/Library/Homebrew/cask/dsl/container.rb
index 9e5e678c4d..9c49e2da12 100644
--- a/Library/Homebrew/cask/dsl/container.rb
+++ b/Library/Homebrew/cask/dsl/container.rb
@@ -3,10 +3,10 @@ require "unpack_strategy"
 module Cask
   class DSL
     class Container
-      VALID_KEYS = Set.new [
-        :type,
-        :nested,
-      ]
+      VALID_KEYS = Set.new([
+                             :type,
+                             :nested,
+                           ]).freeze
 
       attr_accessor(*VALID_KEYS)
       attr_accessor :pairs
diff --git a/Library/Homebrew/cask/dsl/depends_on.rb b/Library/Homebrew/cask/dsl/depends_on.rb
index 6608b641b1..13c8381d7d 100644
--- a/Library/Homebrew/cask/dsl/depends_on.rb
+++ b/Library/Homebrew/cask/dsl/depends_on.rb
@@ -3,14 +3,14 @@ require "rubygems"
 module Cask
   class DSL
     class DependsOn < DelegateClass(Hash)
-      VALID_KEYS = Set.new [
-        :formula,
-        :cask,
-        :macos,
-        :arch,
-        :x11,
-        :java,
-      ].freeze
+      VALID_KEYS = Set.new([
+                             :formula,
+                             :cask,
+                             :macos,
+                             :arch,
+                             :x11,
+                             :java,
+                           ]).freeze
 
       VALID_ARCHES = {
         intel:  { type: :intel, bits: 64 },
diff --git a/Library/Homebrew/cleanup.rb b/Library/Homebrew/cleanup.rb
index efd16d022f..cfce53568a 100644
--- a/Library/Homebrew/cleanup.rb
+++ b/Library/Homebrew/cleanup.rb
@@ -119,7 +119,7 @@ module Homebrew
   class Cleanup
     extend Predicable
 
-    PERIODIC_CLEAN_FILE = HOMEBREW_CACHE/".cleaned"
+    PERIODIC_CLEAN_FILE = (HOMEBREW_CACHE/".cleaned").freeze
 
     attr_predicate :dry_run?, :scrub?
     attr_reader :args, :days, :cache
diff --git a/Library/Homebrew/compilers.rb b/Library/Homebrew/compilers.rb
index aa1bdfcba1..a76f2ba1da 100644
--- a/Library/Homebrew/compilers.rb
+++ b/Library/Homebrew/compilers.rb
@@ -8,8 +8,8 @@ module CompilerConstants
     "llvm_clang" => :llvm_clang,
   }.freeze
 
-  COMPILERS = COMPILER_SYMBOL_MAP.values +
-              GNU_GCC_VERSIONS.map { |n| "gcc-#{n}" }
+  COMPILERS = (COMPILER_SYMBOL_MAP.values +
+               GNU_GCC_VERSIONS.map { |n| "gcc-#{n}" }).freeze
 end
 
 class CompilerFailure
diff --git a/Library/Homebrew/config.rb b/Library/Homebrew/config.rb
index 0e4642c953..7dec7452c2 100644
--- a/Library/Homebrew/config.rb
+++ b/Library/Homebrew/config.rb
@@ -1,7 +1,7 @@
 raise "HOMEBREW_BREW_FILE was not exported! Please call bin/brew directly!" unless ENV["HOMEBREW_BREW_FILE"]
 
 # Path to `bin/brew` main executable in `HOMEBREW_PREFIX`
-HOMEBREW_BREW_FILE = Pathname.new(ENV["HOMEBREW_BREW_FILE"])
+HOMEBREW_BREW_FILE = Pathname.new(ENV["HOMEBREW_BREW_FILE"]).freeze
 
 class MissingEnvironmentVariables < RuntimeError; end
 
@@ -11,42 +11,46 @@ def get_env_or_raise(env)
   ENV[env]
 end
 
+require "extend/git_repository"
+
 # Where we link under
-HOMEBREW_PREFIX = Pathname.new(get_env_or_raise("HOMEBREW_PREFIX"))
+HOMEBREW_PREFIX = Pathname.new(get_env_or_raise("HOMEBREW_PREFIX")).freeze
 
 # Where `.git` is found
 HOMEBREW_REPOSITORY = Pathname.new(get_env_or_raise("HOMEBREW_REPOSITORY"))
+                              .extend(GitRepositoryExtension)
+                              .freeze
 
 # Where we store most of Homebrew, taps, and various metadata
-HOMEBREW_LIBRARY = Pathname.new(get_env_or_raise("HOMEBREW_LIBRARY"))
+HOMEBREW_LIBRARY = Pathname.new(get_env_or_raise("HOMEBREW_LIBRARY")).freeze
 
 # Where shim scripts for various build and SCM tools are stored
-HOMEBREW_SHIMS_PATH = HOMEBREW_LIBRARY/"Homebrew/shims"
+HOMEBREW_SHIMS_PATH = (HOMEBREW_LIBRARY/"Homebrew/shims").freeze
 
 # Where we store symlinks to currently linked kegs
-HOMEBREW_LINKED_KEGS = HOMEBREW_PREFIX/"var/homebrew/linked"
+HOMEBREW_LINKED_KEGS = (HOMEBREW_PREFIX/"var/homebrew/linked").freeze
 
 # Where we store symlinks to currently version-pinned kegs
-HOMEBREW_PINNED_KEGS = HOMEBREW_PREFIX/"var/homebrew/pinned"
+HOMEBREW_PINNED_KEGS = (HOMEBREW_PREFIX/"var/homebrew/pinned").freeze
 
 # Where we store lock files
-HOMEBREW_LOCKS = HOMEBREW_PREFIX/"var/homebrew/locks"
+HOMEBREW_LOCKS = (HOMEBREW_PREFIX/"var/homebrew/locks").freeze
 
 # Where we store built products
-HOMEBREW_CELLAR = Pathname.new(get_env_or_raise("HOMEBREW_CELLAR"))
+HOMEBREW_CELLAR = Pathname.new(get_env_or_raise("HOMEBREW_CELLAR")).freeze
 
 # Where downloads (bottles, source tarballs, etc.) are cached
-HOMEBREW_CACHE = Pathname.new(get_env_or_raise("HOMEBREW_CACHE"))
+HOMEBREW_CACHE = Pathname.new(get_env_or_raise("HOMEBREW_CACHE")).freeze
 
 # Where brews installed via URL are cached
-HOMEBREW_CACHE_FORMULA = HOMEBREW_CACHE/"Formula"
+HOMEBREW_CACHE_FORMULA = (HOMEBREW_CACHE/"Formula").freeze
 
 # Where build, postinstall, and test logs of formulae are written to
-HOMEBREW_LOGS = Pathname.new(get_env_or_raise("HOMEBREW_LOGS")).expand_path
+HOMEBREW_LOGS = Pathname.new(get_env_or_raise("HOMEBREW_LOGS")).expand_path.freeze
 
 # Must use `/tmp` instead of `TMPDIR` because long paths break Unix domain sockets
 HOMEBREW_TEMP = begin
   tmp = Pathname.new(get_env_or_raise("HOMEBREW_TEMP"))
   tmp.mkpath unless tmp.exist?
   tmp.realpath
-end
+end.freeze
diff --git a/Library/Homebrew/debrew.rb b/Library/Homebrew/debrew.rb
index d41b1918b2..de5c4686ac 100644
--- a/Library/Homebrew/debrew.rb
+++ b/Library/Homebrew/debrew.rb
@@ -4,7 +4,7 @@ require "debrew/irb"
 module Debrew
   extend Mutex_m
 
-  Ignorable = Module.new
+  Ignorable = Module.new.freeze
 
   module Raise
     def raise(*)
diff --git a/Library/Homebrew/dependency.rb b/Library/Homebrew/dependency.rb
index 04979e1c08..b5afba777b 100644
--- a/Library/Homebrew/dependency.rb
+++ b/Library/Homebrew/dependency.rb
@@ -7,7 +7,7 @@ class Dependency
 
   attr_reader :name, :tags, :env_proc, :option_names
 
-  DEFAULT_ENV_PROC = proc {}
+  DEFAULT_ENV_PROC = proc {}.freeze
 
   def initialize(name, tags = [], env_proc = DEFAULT_ENV_PROC, option_names = [name])
     raise ArgumentError, "Dependency must have a name!" unless name
diff --git a/Library/Homebrew/dev-cmd/man.rb b/Library/Homebrew/dev-cmd/man.rb
index 8d7058d7c8..2efa0a0e9b 100644
--- a/Library/Homebrew/dev-cmd/man.rb
+++ b/Library/Homebrew/dev-cmd/man.rb
@@ -8,9 +8,9 @@ Dir.glob("#{HOMEBREW_LIBRARY_PATH}/{dev-,}cmd/*.rb").each { |cmd| require cmd }
 module Homebrew
   module_function
 
-  SOURCE_PATH = HOMEBREW_LIBRARY_PATH/"manpages"
-  TARGET_MAN_PATH = HOMEBREW_REPOSITORY/"manpages"
-  TARGET_DOC_PATH = HOMEBREW_REPOSITORY/"docs"
+  SOURCE_PATH = (HOMEBREW_LIBRARY_PATH/"manpages").freeze
+  TARGET_MAN_PATH = (HOMEBREW_REPOSITORY/"manpages").freeze
+  TARGET_DOC_PATH = (HOMEBREW_REPOSITORY/"docs").freeze
 
   def man_args
     Homebrew::CLI::Parser.new do
diff --git a/Library/Homebrew/extend/os/mac/keg.rb b/Library/Homebrew/extend/os/mac/keg.rb
index d7d7a6fe41..a0dc175ca8 100644
--- a/Library/Homebrew/extend/os/mac/keg.rb
+++ b/Library/Homebrew/extend/os/mac/keg.rb
@@ -1,4 +1,4 @@
 class Keg
-  GENERIC_KEG_LINK_DIRECTORIES = remove_const :KEG_LINK_DIRECTORIES
+  GENERIC_KEG_LINK_DIRECTORIES = (remove_const :KEG_LINK_DIRECTORIES).freeze
   KEG_LINK_DIRECTORIES = (GENERIC_KEG_LINK_DIRECTORIES + ["Frameworks"]).freeze
 end
diff --git a/Library/Homebrew/global.rb b/Library/Homebrew/global.rb
index 54abd12c56..9f976f604a 100644
--- a/Library/Homebrew/global.rb
+++ b/Library/Homebrew/global.rb
@@ -28,21 +28,17 @@ require "extend/ARGV"
 require "messages"
 require "system_command"
 
-ARGV_WITHOUT_MONKEY_PATCHING = ARGV.dup
+ARGV_WITHOUT_MONKEY_PATCHING = ARGV.dup.freeze
 ARGV.extend(HomebrewArgvExtension)
 
 HOMEBREW_PRODUCT = ENV["HOMEBREW_PRODUCT"]
 HOMEBREW_VERSION = ENV["HOMEBREW_VERSION"]
 HOMEBREW_WWW = "https://brew.sh".freeze
 
-require "extend/git_repository"
-
-HOMEBREW_REPOSITORY.extend(GitRepositoryExtension)
-
 require "rbconfig"
 
-RUBY_PATH = Pathname.new(RbConfig.ruby)
-RUBY_BIN = RUBY_PATH.dirname
+RUBY_PATH = Pathname.new(RbConfig.ruby).freeze
+RUBY_BIN = RUBY_PATH.dirname.freeze
 
 HOMEBREW_USER_AGENT_CURL = ENV["HOMEBREW_USER_AGENT_CURL"]
 HOMEBREW_USER_AGENT_RUBY =
diff --git a/Library/Homebrew/keg.rb b/Library/Homebrew/keg.rb
index 4c12e22bfa..39125daa0b 100644
--- a/Library/Homebrew/keg.rb
+++ b/Library/Homebrew/keg.rb
@@ -77,9 +77,9 @@ class Keg
 
   # Keep relatively in sync with
   # https://github.com/Homebrew/install/blob/master/install
-  MUST_EXIST_DIRECTORIES = MUST_EXIST_SUBDIRECTORIES + [
+  MUST_EXIST_DIRECTORIES = (MUST_EXIST_SUBDIRECTORIES + [
     HOMEBREW_CELLAR,
-  ].uniq.sort.freeze
+  ].sort.uniq).freeze
   MUST_BE_WRITABLE_DIRECTORIES = (
     %w[
       etc/bash_completion.d lib/pkgconfig
diff --git a/Library/Homebrew/load_path.rb b/Library/Homebrew/load_path.rb
index b25aefa83d..d465c8db8a 100644
--- a/Library/Homebrew/load_path.rb
+++ b/Library/Homebrew/load_path.rb
@@ -1,6 +1,6 @@
 require "pathname"
 
-HOMEBREW_LIBRARY_PATH = Pathname(__dir__).realpath
+HOMEBREW_LIBRARY_PATH = Pathname(__dir__).realpath.freeze
 
 $LOAD_PATH.push(HOMEBREW_LIBRARY_PATH.to_s) unless $LOAD_PATH.include?(HOMEBREW_LIBRARY_PATH.to_s)
 
diff --git a/Library/Homebrew/metafiles.rb b/Library/Homebrew/metafiles.rb
index 4a790850bf..963f5c45b2 100644
--- a/Library/Homebrew/metafiles.rb
+++ b/Library/Homebrew/metafiles.rb
@@ -1,13 +1,13 @@
 module Metafiles
   # https://github.com/github/markup#markups
-  EXTENSIONS = Set.new %w[
-    .adoc .asc .asciidoc .creole .html .markdown .md .mdown .mediawiki .mkdn
-    .org .pod .rdoc .rst .rtf .textile .txt .wiki
-  ].freeze
-  BASENAMES = Set.new %w[
-    about authors changelog changes copying copyright history license licence
-    news notes notice readme todo
-  ].freeze
+  EXTENSIONS = Set.new(%w[
+                         .adoc .asc .asciidoc .creole .html .markdown .md .mdown .mediawiki .mkdn
+                         .org .pod .rdoc .rst .rtf .textile .txt .wiki
+                       ]).freeze
+  BASENAMES = Set.new(%w[
+                        about authors changelog changes copying copyright history license licence
+                        news notes notice readme todo
+                      ]).freeze
 
   module_function
 
diff --git a/Library/Homebrew/os/linux.rb b/Library/Homebrew/os/linux.rb
index 94c510c821..af0c598b26 100644
--- a/Library/Homebrew/os/linux.rb
+++ b/Library/Homebrew/os/linux.rb
@@ -3,7 +3,11 @@ module OS
   module Mac
     module_function
 
-    ::MacOS = self # rubocop:disable Naming/ConstantName
+    # rubocop:disable Naming/ConstantName
+    # rubocop:disable Style/MutableConstant
+    ::MacOS = self
+    # rubocop:enable Naming/ConstantName
+    # rubocop:enable Style/MutableConstant
 
     raise "Loaded OS::Linux on generic OS!" if ENV["HOMEBREW_TEST_GENERIC_OS"]
 
diff --git a/Library/Homebrew/os/linux/global.rb b/Library/Homebrew/os/linux/global.rb
index 39114fab57..893cec29e7 100644
--- a/Library/Homebrew/os/linux/global.rb
+++ b/Library/Homebrew/os/linux/global.rb
@@ -3,5 +3,5 @@ module Homebrew
     "/usr/local".freeze
   else
     "/home/linuxbrew/.linuxbrew".freeze
-  end
+  end.freeze
 end
diff --git a/Library/Homebrew/os/mac.rb b/Library/Homebrew/os/mac.rb
index c53fffcbe0..3f800e7023 100644
--- a/Library/Homebrew/os/mac.rb
+++ b/Library/Homebrew/os/mac.rb
@@ -8,7 +8,11 @@ module OS
   module Mac
     module_function
 
-    ::MacOS = self # rubocop:disable Naming/ConstantName
+    # rubocop:disable Naming/ConstantName
+    # rubocop:disable Style/MutableConstant
+    ::MacOS = self
+    # rubocop:enable Naming/ConstantName
+    # rubocop:enable Style/MutableConstant
 
     raise "Loaded OS::Mac on generic OS!" if ENV["HOMEBREW_TEST_GENERIC_OS"]
 
diff --git a/Library/Homebrew/os/mac/xquartz.rb b/Library/Homebrew/os/mac/xquartz.rb
index dc03fcb11f..566adb9129 100644
--- a/Library/Homebrew/os/mac/xquartz.rb
+++ b/Library/Homebrew/os/mac/xquartz.rb
@@ -1,6 +1,6 @@
 module OS
   module Mac
-    X11 = XQuartz = Module.new
+    X11 = XQuartz = Module.new # rubocop:disable Style/MutableConstant
 
     module XQuartz
       module_function
diff --git a/Library/Homebrew/rubocops/cask/homepage_matches_url.rb b/Library/Homebrew/rubocops/cask/homepage_matches_url.rb
index 4c1315f912..ddd020f56f 100644
--- a/Library/Homebrew/rubocops/cask/homepage_matches_url.rb
+++ b/Library/Homebrew/rubocops/cask/homepage_matches_url.rb
@@ -19,11 +19,11 @@ module RuboCop
 
         MSG_NO_MATCH = "`%{url}` does not match `%{full_url}`".freeze
 
-        MSG_MISSING = "`%{domain}` does not match `%{homepage}`, a comment has to be added " \
-                      "above the `url` stanza. For details, see " + REFERENCE_URL
+        MSG_MISSING = ("`%{domain}` does not match `%{homepage}`, a comment has to be added " \
+                      "above the `url` stanza. For details, see " + REFERENCE_URL).freeze
 
-        MSG_WRONG_FORMAT = "`%{comment}` does not match the expected comment format. " \
-                           "For details, see " + REFERENCE_URL
+        MSG_WRONG_FORMAT = ("`%{comment}` does not match the expected comment format. " \
+                           "For details, see " + REFERENCE_URL).freeze
 
         MSG_UNNECESSARY = "The URL's domain `%{domain}` matches the homepage `%{homepage}`, " \
                           "the comment above the `url` stanza is unnecessary".freeze
diff --git a/Library/Homebrew/tap.rb b/Library/Homebrew/tap.rb
index dae0b0af4d..c395f94db5 100644
--- a/Library/Homebrew/tap.rb
+++ b/Library/Homebrew/tap.rb
@@ -11,7 +11,7 @@ require "description_cache_store"
 class Tap
   extend Cachable
 
-  TAP_DIRECTORY = HOMEBREW_LIBRARY/"Taps"
+  TAP_DIRECTORY = (HOMEBREW_LIBRARY/"Taps").freeze
 
   def self.fetch(*args)
     case args.length
diff --git a/Library/Homebrew/tap_constants.rb b/Library/Homebrew/tap_constants.rb
index 764c547705..0c6bd3adcd 100644
--- a/Library/Homebrew/tap_constants.rb
+++ b/Library/Homebrew/tap_constants.rb
@@ -5,7 +5,7 @@ HOMEBREW_TAP_CASK_REGEX = %r{^([\w-]+)/([\w-]+)/([a-z0-9\-]+)$}.freeze
 # match taps' directory paths, e.g. HOMEBREW_LIBRARY/Taps/someuser/sometap
 HOMEBREW_TAP_DIR_REGEX = %r{#{Regexp.escape(HOMEBREW_LIBRARY)}/Taps/(?<user>[\w-]+)/(?<repo>[\w-]+)}.freeze
 # match taps' formula paths, e.g. HOMEBREW_LIBRARY/Taps/someuser/sometap/someformula
-HOMEBREW_TAP_PATH_REGEX = Regexp.new(HOMEBREW_TAP_DIR_REGEX.source + %r{(?:/.*)?$}.source)
+HOMEBREW_TAP_PATH_REGEX = Regexp.new(HOMEBREW_TAP_DIR_REGEX.source + %r{(?:/.*)?$}.source).freeze
 # match official taps' casks, e.g. homebrew/cask/somecask or homebrew/cask-versions/somecask
 HOMEBREW_CASK_TAP_CASK_REGEX = %r{^(?:([Cc]askroom)/(cask|versions)|(homebrew)/(cask|cask-[\w-]+))/([\w+-.]+)$}.freeze
 HOMEBREW_OFFICIAL_REPO_PREFIXES_REGEX = /^(home|linux)brew-/.freeze
diff --git a/Library/Homebrew/test/patching_spec.rb b/Library/Homebrew/test/patching_spec.rb
index 05aea1c706..a03bae8ed3 100644
--- a/Library/Homebrew/test/patching_spec.rb
+++ b/Library/Homebrew/test/patching_spec.rb
@@ -5,8 +5,8 @@ describe "patching" do
   TESTBALL_PATCHES_URL = "file://#{TEST_FIXTURE_DIR}/tarballs/testball-0.1-patches.tgz".freeze
   PATCH_URL_A = "file://#{TEST_FIXTURE_DIR}/patches/noop-a.diff".freeze
   PATCH_URL_B = "file://#{TEST_FIXTURE_DIR}/patches/noop-b.diff".freeze
-  PATCH_A_CONTENTS = File.read "#{TEST_FIXTURE_DIR}/patches/noop-a.diff"
-  PATCH_B_CONTENTS = File.read "#{TEST_FIXTURE_DIR}/patches/noop-b.diff"
+  PATCH_A_CONTENTS = File.read("#{TEST_FIXTURE_DIR}/patches/noop-a.diff").freeze
+  PATCH_B_CONTENTS = File.read("#{TEST_FIXTURE_DIR}/patches/noop-b.diff").freeze
   APPLY_A = "noop-a.diff".freeze
   APPLY_B = "noop-b.diff".freeze
   APPLY_C = "noop-c.diff".freeze
diff --git a/Library/Homebrew/test/support/lib/config.rb b/Library/Homebrew/test/support/lib/config.rb
index 28387c2694..126c66b6cc 100644
--- a/Library/Homebrew/test/support/lib/config.rb
+++ b/Library/Homebrew/test/support/lib/config.rb
@@ -2,7 +2,7 @@ raise "HOMEBREW_BREW_FILE was not exported! Please call bin/brew directly!" unle
 
 require "pathname"
 
-HOMEBREW_BREW_FILE = Pathname.new(ENV["HOMEBREW_BREW_FILE"])
+HOMEBREW_BREW_FILE = Pathname.new(ENV["HOMEBREW_BREW_FILE"]).freeze
 
 TEST_TMPDIR = ENV.fetch("HOMEBREW_TEST_TMPDIR") do |k|
   dir = Dir.mktmpdir("homebrew-tests-", ENV["HOMEBREW_TEMP"] || "/tmp")
@@ -12,25 +12,27 @@ TEST_TMPDIR = ENV.fetch("HOMEBREW_TEST_TMPDIR") do |k|
     FileUtils.remove_entry(dir) unless ENV["HOMEBREW_TEST_NO_EXIT_CLEANUP"]
   end
   ENV[k] = dir
-end
+end.freeze
 
 # Paths pointing into the Homebrew code base that persist across test runs
-HOMEBREW_SHIMS_PATH    = HOMEBREW_LIBRARY_PATH.parent/"Homebrew/shims"
+HOMEBREW_SHIMS_PATH = (HOMEBREW_LIBRARY_PATH.parent/"Homebrew/shims").freeze
+
+require "extend/git_repository"
 
 # Paths redirected to a temporary directory and wiped at the end of the test run
-HOMEBREW_PREFIX        = Pathname(TEST_TMPDIR)/"prefix"
-HOMEBREW_REPOSITORY    = HOMEBREW_PREFIX
-HOMEBREW_LIBRARY       = HOMEBREW_REPOSITORY/"Library"
-HOMEBREW_CACHE         = HOMEBREW_PREFIX.parent/"cache"
-HOMEBREW_CACHE_FORMULA = HOMEBREW_PREFIX.parent/"formula_cache"
-HOMEBREW_LINKED_KEGS   = HOMEBREW_PREFIX.parent/"linked"
-HOMEBREW_PINNED_KEGS   = HOMEBREW_PREFIX.parent/"pinned"
-HOMEBREW_LOCKS         = HOMEBREW_PREFIX.parent/"locks"
-HOMEBREW_CELLAR        = HOMEBREW_PREFIX.parent/"cellar"
-HOMEBREW_LOGS          = HOMEBREW_PREFIX.parent/"logs"
-HOMEBREW_TEMP          = HOMEBREW_PREFIX.parent/"temp"
+HOMEBREW_PREFIX        = (Pathname(TEST_TMPDIR)/"prefix").freeze
+HOMEBREW_REPOSITORY    = HOMEBREW_PREFIX.dup.extend(GitRepositoryExtension).freeze
+HOMEBREW_LIBRARY       = (HOMEBREW_REPOSITORY/"Library").freeze
+HOMEBREW_CACHE         = (HOMEBREW_PREFIX.parent/"cache").freeze
+HOMEBREW_CACHE_FORMULA = (HOMEBREW_PREFIX.parent/"formula_cache").freeze
+HOMEBREW_LINKED_KEGS   = (HOMEBREW_PREFIX.parent/"linked").freeze
+HOMEBREW_PINNED_KEGS   = (HOMEBREW_PREFIX.parent/"pinned").freeze
+HOMEBREW_LOCKS         = (HOMEBREW_PREFIX.parent/"locks").freeze
+HOMEBREW_CELLAR        = (HOMEBREW_PREFIX.parent/"cellar").freeze
+HOMEBREW_LOGS          = (HOMEBREW_PREFIX.parent/"logs").freeze
+HOMEBREW_TEMP          = (HOMEBREW_PREFIX.parent/"temp").freeze
 
-TEST_FIXTURE_DIR = HOMEBREW_LIBRARY_PATH/"test/support/fixtures"
+TEST_FIXTURE_DIR = (HOMEBREW_LIBRARY_PATH/"test/support/fixtures").freeze
 
 TESTBALL_SHA256 = "91e3f7930c98d7ccfb288e115ed52d06b0e5bc16fec7dce8bdda86530027067b".freeze
 TESTBALL_PATCHES_SHA256 = "799c2d551ac5c3a5759bea7796631a7906a6a24435b52261a317133a0bfb34d9".freeze
diff --git a/Library/Homebrew/unpack_strategy/dmg.rb b/Library/Homebrew/unpack_strategy/dmg.rb
index 5b7c591ec8..6130d9b426 100644
--- a/Library/Homebrew/unpack_strategy/dmg.rb
+++ b/Library/Homebrew/unpack_strategy/dmg.rb
@@ -5,19 +5,19 @@ module UnpackStrategy
     include UnpackStrategy
 
     module Bom
-      DMG_METADATA = Set.new %w[
-        .background
-        .com.apple.timemachine.donotpresent
-        .com.apple.timemachine.supported
-        .DocumentRevisions-V100
-        .DS_Store
-        .fseventsd
-        .MobileBackups
-        .Spotlight-V100
-        .TemporaryItems
-        .Trashes
-        .VolumeIcon.icns
-      ].freeze
+      DMG_METADATA = Set.new(%w[
+                               .background
+                               .com.apple.timemachine.donotpresent
+                               .com.apple.timemachine.supported
+                               .DocumentRevisions-V100
+                               .DS_Store
+                               .fseventsd
+                               .MobileBackups
+                               .Spotlight-V100
+                               .TemporaryItems
+                               .Trashes
+                               .VolumeIcon.icns
+                             ]).freeze
       private_constant :DMG_METADATA
 
       refine Pathname do
diff --git a/Library/Homebrew/version.rb b/Library/Homebrew/version.rb
index c1eeaa1102..e2af0b3b61 100644
--- a/Library/Homebrew/version.rb
+++ b/Library/Homebrew/version.rb
@@ -52,7 +52,7 @@ class Version
     end
   end
 
-  NULL_TOKEN = NullToken.new
+  NULL_TOKEN = NullToken.new.freeze
 
   class StringToken < Token
     PATTERN = /[a-z]+[0-9]*/i.freeze
@@ -189,7 +189,7 @@ class Version
     PatchToken::PATTERN,
     NumericToken::PATTERN,
     StringToken::PATTERN,
-  )
+  ).freeze
 
   class FromURL < Version
     def detected_from_url?
diff --git a/Library/Homebrew/version/null.rb b/Library/Homebrew/version/null.rb
index 230907754a..b4e480be13 100644
--- a/Library/Homebrew/version/null.rb
+++ b/Library/Homebrew/version/null.rb
@@ -51,5 +51,5 @@ class Version
     def inspect
       "#<Version::NULL>".freeze
     end
-  end.new
+  end.new.freeze
 end