diff --git a/devtools/deploy.sh b/devtools/deploy.sh
index 8b95673..dd6f397 100755
--- a/devtools/deploy.sh
+++ b/devtools/deploy.sh
@@ -40,7 +40,7 @@
 
   if which grants > /dev/null; then
     local allowed=false
-    while read g _ ok _; do
+    while read _ _ ok _; do
       if [[ $ok = OK ]]; then
         allowed=true
       fi
@@ -50,11 +50,11 @@
     fi
   fi
 
-  local project=$(tfvar ${env}_project)
+  local -r project=$(tfvar ${env}_project)
   if [[ $project = '' ]]; then
     die "no ${env}_project in terraform.tfvars"
   fi
-  local commit=$(git rev-parse --short HEAD)
+  local -r commit=$(git rev-parse --short HEAD)
   local unclean
   if ! clean_workspace; then
     unclean="-unclean"
@@ -66,4 +66,4 @@
     --substitutions SHORT_SHA=${commit}${unclean},_ENV=$env,_BQ_DATASET=$dataset
 }
 
-main $@
+main "$@"
diff --git a/devtools/lib.sh b/devtools/lib.sh
index ff2f3ac..56e2114 100644
--- a/devtools/lib.sh
+++ b/devtools/lib.sh
@@ -8,21 +8,21 @@
 MAXWIDTH=0
 
 if tput setaf 1 >& /dev/null; then
-  RED=`tput setaf 1`
-  GREEN=`tput setaf 2`
-  YELLOW=`tput setaf 3`
-  NORMAL=`tput sgr0`
+  RED=$(tput setaf 1)
+  GREEN=$(tput setaf 2)
+  YELLOW=$(tput setaf 3)
+  NORMAL=$(tput sgr0)
   MAXWIDTH=$(( $(tput cols) - 2 ))
 fi
 
 EXIT_CODE=0
 
-info() { echo -e "${GREEN}$@${NORMAL}" 1>&2; }
-warn() { echo -e "${YELLOW}$@${NORMAL}" 1>&2; }
-err() { echo -e "${RED}$@${NORMAL}" 1>&2; EXIT_CODE=1; }
+info() { echo -e "${GREEN}$*${NORMAL}" 1>&2; }
+warn() { echo -e "${YELLOW}$*${NORMAL}" 1>&2; }
+err() { echo -e "${RED}$*${NORMAL}" 1>&2; EXIT_CODE=1; }
 
 die() {
-  err $@
+  err "$@"
   exit 1
 }
 
@@ -32,7 +32,7 @@
 # then runs it. It sets EXIT_CODE to non-zero if the command fails, but does not exit
 # the script.
 runcmd() {
-  msg="$@"
+  msg="$*"
   if $dryrun; then
     echo -e "${YELLOW}dryrun${GREEN}\$ $msg${NORMAL}"
     return 0
@@ -43,32 +43,33 @@
     msg="${msg::$(( MAXWIDTH - 3 ))}..."
   fi
 
-  echo -e "$@\n" 1>&2;
-  $@ || err "command failed"
+  echo -e "$*\n" 1>&2;
+  "$@" || err "command failed"
 }
 
 # tfvar NAME returns the value of the terraform variable NAME.
 tfvar() {
   local v=TF_VAR_$1
-  echo ${!v}
+  echo "${!v}"
 }
 
 worker_url() {
-  local env=$1
+  local -r env=$1
   echo https://${env}-${GO_ECOSYSTEM_WORKER_URL_SUFFIX}
 }
 
 impersonation_service_account() {
-  local env=$1
+  local -r env=$1
+  local -r project=$(tfvar ${env}_project)
   case $env in
-    prod|dev) echo impersonate@$(tfvar ${env}_project).iam.gserviceaccount.com;;
-    *) die "usage: $0 (dev | prod)";;
+    prod|dev) echo impersonate@${project}.iam.gserviceaccount.com;;
+    *) die "usage: $0 (dev | prod) ...";;
   esac
 }
 
 impersonation_token() {
-  local env=$1
-  gcloud --impersonate-service-account $(impersonation_service_account $env) \
+  local -r env=$1
+  gcloud --impersonate-service-account "$(impersonation_service_account "$env")" \
     auth print-identity-token \
     --include-email
 }