diff --git a/mysql-init/init.sh b/mysql-init/init.sh
index b812b88ea..8bfff53d3 100755
--- a/mysql-init/init.sh
+++ b/mysql-init/init.sh
@@ -16,10 +16,10 @@ UPGRADE_SCRIPTS="/mysql-upgrade.d"
 wait_mysql() {
   echo "Waiting for MySQL to become available..."
   success="false"
-  for i in $(seq $MYSQL_INIT_WAIT_RETRIES); do
+  for i in $(seq "$MYSQL_INIT_WAIT_RETRIES"); do
     mysqladmin status \
         --host="$MYSQL_INIT_HOST" \
-        --port=$MYSQL_INIT_PORT \
+        --port="$MYSQL_INIT_PORT" \
         --user="$MYSQL_INIT_USERNAME" \
         --password="$MYSQL_INIT_PASSWORD" \
         --connect_timeout=10
@@ -58,7 +58,7 @@ clean_install() {
       echo "Running script: $f"
       mysql --host="$MYSQL_INIT_HOST" \
           --user="$MYSQL_INIT_USERNAME" \
-          --port=$MYSQL_INIT_PORT \
+          --port="$MYSQL_INIT_PORT" \
           --password="$MYSQL_INIT_PASSWORD" < "$f"
     fi
   done
@@ -69,7 +69,7 @@ clean_install() {
     set +x
     mysqladmin password \
         --host="$MYSQL_INIT_HOST" \
-        --port=$MYSQL_INIT_PORT \
+        --port="$MYSQL_INIT_PORT" \
         --user="$MYSQL_INIT_USERNAME" \
         --password="$MYSQL_INIT_PASSWORD" \
         "$MYSQL_INIT_SET_PASSWORD"
@@ -80,7 +80,7 @@ clean_install() {
     pw=$(pwgen -1 32)
     mysqladmin password \
         --host="$MYSQL_INIT_HOST" \
-        --port=$MYSQL_INIT_PORT \
+        --port="$MYSQL_INIT_PORT" \
         --user="$MYSQL_INIT_USERNAME" \
         --password="$MYSQL_INIT_PASSWORD" \
         "$pw"
@@ -92,7 +92,7 @@ clean_install() {
     echo "Disabling remote root login..."
     mysql --host="$MYSQL_INIT_HOST" \
         --user="$MYSQL_INIT_USERNAME" \
-        --port=$MYSQL_INIT_PORT \
+        --port="$MYSQL_INIT_PORT" \
         --password="$MYSQL_INIT_PASSWORD" < /disable-remote-root.sql
   fi
 }
@@ -102,7 +102,7 @@ schema_upgrade() {
 
   # ash doesn't support arrays, this seems to be the most concise way to get
   # fields by index
-  set $version
+  set "$version"
   if [ "$#" -ne "3" ]; then
     echo "Invalid version: '$version'"
     sleep 1
@@ -125,7 +125,7 @@ schema_upgrade() {
 
     # we explicitly want to word-split here...
     # shellcheck disable=SC2046
-    set $(echo $diff_version | tr '.' ' ')
+    set $(echo "$diff_version" | tr '.' ' ')
     if [ "$#" -ne "3" ]; then
       echo "Invalid version number in upgrade directory, quitting! $diff_version"
       sleep 1
@@ -164,7 +164,7 @@ schema_upgrade() {
         set +x
         mysql --host="$MYSQL_INIT_HOST" \
             --user="$MYSQL_INIT_USERNAME" \
-            --port=$MYSQL_INIT_PORT \
+            --port="$MYSQL_INIT_PORT" \
             --password="$MYSQL_INIT_PASSWORD" < "$f"
         set -x
         any_applied="true"
@@ -181,10 +181,10 @@ schema_upgrade() {
     echo "Recording version in $database: $last_major.$last_minor.$last_patch"
     query="insert into schema_version (major, minor, patch) values ($last_major, $last_minor, $last_patch);"
     set +x
-    echo $query | mysql \
+    echo "$query" | mysql \
         --host="$MYSQL_INIT_HOST" \
         --user="$MYSQL_INIT_USERNAME" \
-        --port=$MYSQL_INIT_PORT \
+        --port="$MYSQL_INIT_PORT" \
         --password="$MYSQL_INIT_PASSWORD" \
         "$database"
     set -x
@@ -201,10 +201,10 @@ query="select major, minor, patch from schema_version order by id desc limit 1;"
 version=$(echo "$query" | mysql \
     --host="$MYSQL_INIT_HOST" \
     --user="$MYSQL_INIT_USERNAME" \
-    --port=$MYSQL_INIT_PORT \
+    --port="$MYSQL_INIT_PORT" \
     --password="$MYSQL_INIT_PASSWORD" \
     --silent \
-    $MYSQL_INIT_SCHEMA_DATABASE)
+    "$MYSQL_INIT_SCHEMA_DATABASE")
 if [ $? -eq 0 ]; then
   schema_upgrade "$version"
 else
diff --git a/mysql-init/template.py b/mysql-init/template.py
index 67a2fde62..b4991cee0 100755
--- a/mysql-init/template.py
+++ b/mysql-init/template.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python
+# coding=utf-8
 
 # (C) Copyright 2017 Hewlett Packard Enterprise Development LP
 #
@@ -30,11 +31,12 @@ def main():
     out_path = sys.argv[2]
 
     with open(in_path, 'r') as in_file, open(out_path, 'w') as out_file:
-        t = Template(in_file.read(),
-                     keep_trailing_newline=True,
-                     lstrip_blocks=True,
-                     trim_blocks=True)
-        out_file.write(t.render(os.environ))
+        tmle = Template(in_file.read(),
+                        keep_trailing_newline=True,
+                        lstrip_blocks=True,
+                        trim_blocks=True)
+        out_file.write(tmle.render(os.environ))
+
 
 if __name__ == '__main__':
     main()
diff --git a/storm/clean_externals.py b/storm/clean_externals.py
index b1113b3d1..f859045d0 100644
--- a/storm/clean_externals.py
+++ b/storm/clean_externals.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python
+# coding=utf-8
 
 # (C) Copyright 2017 Hewlett Packard Enterprise Development LP
 #
@@ -34,17 +35,18 @@ def main():
 
     invalid = keep.difference(externals)
     if not keep.issubset(externals):
-        print('Invalid values for KEEP_EXTERNALS: %r' % invalid,
-              file=sys.stderr)
+        print('Invalid values for KEEP_EXTERNALS: {!r}'
+              .format(invalid), file=sys.stderr)
         sys.exit(1)
 
     externals.difference_update()
 
     remove = externals.difference(keep)
     for ext in remove:
-        p = os.path.join(EXTERNAL_PATH, ext)
-        print('Removing: %s' % p)
-        shutil.rmtree(p, ignore_errors=True)
+        ext_path = os.path.join(EXTERNAL_PATH, ext)
+        print('Removing: {}'.format(ext_path))
+        shutil.rmtree(ext_path, ignore_errors=True)
+
 
 if __name__ == '__main__':
     main()
diff --git a/storm/entrypoint.sh b/storm/entrypoint.sh
index 837745a21..fd2fe1aa3 100755
--- a/storm/entrypoint.sh
+++ b/storm/entrypoint.sh
@@ -34,19 +34,19 @@ if [ -n "$ZOOKEEPER_PORT" ]; then
   fi
 fi
 
-first_zk=$(echo $STORM_ZOOKEEPER_SERVERS | cut -d, -f1)
+first_zk=$(echo "$STORM_ZOOKEEPER_SERVERS" | cut -d, -f1)
 
 # wait for zookeeper to become available
 if [ "$ZOOKEEPER_WAIT" = "true" ]; then
   success="false"
-  for i in $(seq $ZOOKEEPER_WAIT_RETRIES); do
-    ok=$(echo ruok | nc $first_zk $STORM_ZOOKEEPER_PORT -w $ZOOKEEPER_WAIT_TIMEOUT)
+  for i in $(seq "$ZOOKEEPER_WAIT_RETRIES"); do
+    ok=$(echo ruok | nc "$first_zk" "$STORM_ZOOKEEPER_PORT" -w "$ZOOKEEPER_WAIT_TIMEOUT")
     if [ $? -eq 0 -a "$ok" = "imok" ]; then
       success="true"
       break
     else
       echo "Connect attempt $i of $ZOOKEEPER_WAIT_RETRIES failed, retrying..."
-      sleep $ZOOKEEPER_WAIT_DELAY
+      sleep "$ZOOKEEPER_WAIT_DELAY"
     fi
   done
 
@@ -65,12 +65,12 @@ if [ -z "$STORM_LOCAL_HOSTNAME" ]; then
 fi
 
 if [ -z "$SUPERVISOR_CHILDOPTS" ]; then
-  SUPERVISOR_CHILDOPTS="-Xmx$(python /heap.py $SUPERVISOR_MAX_HEAP_MB)"
+  SUPERVISOR_CHILDOPTS="-Xmx$(python /heap.py "$SUPERVISOR_MAX_HEAP_MB")"
   export SUPERVISOR_CHILDOPTS
 fi
 
 if [ -z "$WORKER_CHILDOPTS" ]; then
-  WORKER_CHILDOPTS="-Xmx$(python /heap.py $WORKER_MAX_HEAP_MB)"
+  WORKER_CHILDOPTS="-Xmx$(python /heap.py "$WORKER_MAX_HEAP_MB")"
   WORKER_CHILDOPTS="$WORKER_CHILDOPTS -XX:+UseConcMarkSweepGC"
   if [ "$WORKER_REMOTE_JMX" = "true" ]; then
     WORKER_CHILDOPTS="$WORKER_CHILDOPTS -Dcom.sun.management.jmxremote"
@@ -80,12 +80,12 @@ if [ -z "$WORKER_CHILDOPTS" ]; then
 fi
 
 if [ -z "$NIMBUS_CHILDOPTS" ]; then
-  NIMBUS_CHILDOPTS="-Xmx$(python /heap.py $NIMBUS_MAX_HEAP_MB)"
+  NIMBUS_CHILDOPTS="-Xmx$(python /heap.py "$NIMBUS_MAX_HEAP_MB")"
   export NIMBUS_CHILDOPTS
 fi
 
 if [ -z "$UI_CHILDOPTS" ]; then
-  UI_CHILDOPTS="-Xmx$(python /heap.py $UI_MAX_HEAP_MB)"
+  UI_CHILDOPTS="-Xmx$(python /heap.py "$UI_MAX_HEAP_MB")"
   export UI_CHILDOPTS
 fi
 
@@ -115,7 +115,7 @@ template_dir "$CONFIG_TEMPLATES" "$CONFIG_DEST"
 template_dir "$LOG_TEMPLATES" "$LOG_DEST"
 
 if [ "$WORKER_LOGS_TO_STDOUT" = "true" ]; then
-  for PORT in `echo $SUPERVISOR_SLOTS_PORTS | sed -e "s/,/ /" `; do
+  for PORT in `echo "$SUPERVISOR_SLOTS_PORTS" | sed -e "s/,/ /" `; do
     LOGDIR="/storm/logs/workers-artifacts/thresh/$PORT"
     mkdir -p "$LOGDIR"
     WORKER_LOG="$LOGDIR/worker.log"
diff --git a/storm/heap.py b/storm/heap.py
index 05c22e001..00f20a06c 100644
--- a/storm/heap.py
+++ b/storm/heap.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python
+# coding=utf-8
 
 # (C) Copyright 2017 Hewlett Packard Enterprise Development LP
 #
@@ -50,7 +51,7 @@ def get_effective_memory_limit_mb():
 
 def main():
     if HEAP_OVERRIDE_MB:
-        print('%sm' % HEAP_OVERRIDE_MB)
+        print('{}m'.format(HEAP_OVERRIDE_MB))
         return
 
     system_max = get_system_memory_mb()
@@ -68,11 +69,11 @@ def main():
     else:
         arg_max = effective_max
 
-    print('%dm' % min([
+    print('{:d}m'.format(min([
         effective_max,
         env_max,
         arg_max
-    ]))
+    ])))
 
 
 if __name__ == '__main__':
diff --git a/storm/storm_mirror.py b/storm/storm_mirror.py
index 99c833ae0..3673f452c 100644
--- a/storm/storm_mirror.py
+++ b/storm/storm_mirror.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python
+# coding=utf-8
 
 # (C) Copyright 2017 Hewlett Packard Enterprise Development LP
 #
@@ -35,14 +36,15 @@ def main():
     mirror = MIRROR
 
     if not DIRECT:
-        r = requests.get(MIRROR, params={
+        req = requests.get(MIRROR, params={
             'path': 'apache-storm-{0}.tar.gz'.format(version),
             'as_json': '1'
         })
-        r.raise_for_status()
-        mirror = r.json()['preferred']
+        req.raise_for_status()
+        mirror = req.json()['preferred']
 
     print(PATH.format(mirror=mirror, version=version))
 
+
 if __name__ == '__main__':
     main()
diff --git a/storm/template.py b/storm/template.py
index 67a2fde62..b4991cee0 100755
--- a/storm/template.py
+++ b/storm/template.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python
+# coding=utf-8
 
 # (C) Copyright 2017 Hewlett Packard Enterprise Development LP
 #
@@ -30,11 +31,12 @@ def main():
     out_path = sys.argv[2]
 
     with open(in_path, 'r') as in_file, open(out_path, 'w') as out_file:
-        t = Template(in_file.read(),
-                     keep_trailing_newline=True,
-                     lstrip_blocks=True,
-                     trim_blocks=True)
-        out_file.write(t.render(os.environ))
+        tmle = Template(in_file.read(),
+                        keep_trailing_newline=True,
+                        lstrip_blocks=True,
+                        trim_blocks=True)
+        out_file.write(tmle.render(os.environ))
+
 
 if __name__ == '__main__':
     main()