diff --git a/test/common/git-utils.sh b/test/common/git-utils.sh
index 06dfecd63..7da0fd4f7 100644
--- a/test/common/git-utils.sh
+++ b/test/common/git-utils.sh
@@ -1,9 +1,11 @@
+# shellcheck shell=sh
 # doesn't do anything on its own.  must be sourced.
 
 # The script which sources this script must set the following variables:
 #   GITHUB_REPO = the relative repo name of the submodule on github
 #   SUBDIR = the location in the working tree where the submodule goes
-# We also expect `set -eu`.
+# We also expect `set -eu`, but set them ourselves for shellcheck.
+set -eu
 [ -n "${GITHUB_REPO}" ]
 [ -n "${SUBDIR}" ]
 
@@ -13,6 +15,7 @@ unset GIT_DIR GIT_EXEC_PATH GIT_PREFIX GIT_REFLOG_ACTION GIT_WORK_TREE
 GITHUB_BASE="${GITHUB_BASE:-cockpit-project/cockpit}"
 GITHUB_REPOSITORY="${GITHUB_BASE%/*}/${GITHUB_REPO}"
 HTTPS_REMOTE="https://github.com/${GITHUB_REPOSITORY}"
+# shellcheck disable=SC2034 # used in other scripts
 SSH_REMOTE="git@github.com:${GITHUB_REPOSITORY}"
 
 CACHE_DIR="${XDG_CACHE_HOME-${HOME}/.cache}/cockpit-dev/${GITHUB_REPOSITORY}.git"
@@ -118,6 +121,7 @@ tar_to_cache() {
     # Use a sub-shell to enable cleanup of the temporary directory
     (
         tmpdir="$(mktemp --tmpdir --directory cockpit-tar-to-git.XXXXXX)"
+        # shellcheck disable=SC2064 # we want ${tmpdir} expanded now
         trap "rm -r '${tmpdir}'" EXIT
 
         export GIT_INDEX_FILE="${tmpdir}/tmp-index"
diff --git a/test/common/make-bots b/test/common/make-bots
index 10db11bd5..5160e90f8 100755
--- a/test/common/make-bots
+++ b/test/common/make-bots
@@ -10,6 +10,7 @@ V="${V-0}" # default to friendly messages
 
 set -eu
 cd "${0%/*}/../.."
+# shellcheck source-path=SCRIPTDIR/../..
 . test/common/git-utils.sh
 
 if [ ! -e bots ]; then
diff --git a/tools/node-modules b/tools/node-modules
index 6acf8c79e..1e74c9fee 100755
--- a/tools/node-modules
+++ b/tools/node-modules
@@ -1,5 +1,8 @@
 #!/bin/sh
 
+# shellcheck disable=SC3043         # local is not POSIX, but every shell has it
+# shellcheck disable=SC3013,SC3045  # ditto for test {-nt,-t}
+
 GITHUB_REPO='node-cache'
 SUBDIR='node_modules'
 
@@ -7,6 +10,7 @@ V="${V-0}" # default to friendly messages
 
 set -eu
 cd "${0%/*}/.."
+# shellcheck source-path=SCRIPTDIR/..
 . test/common/git-utils.sh
 
 cmd_remove() {
@@ -129,7 +133,8 @@ cmd_make_package_lock_json() {
 
     # Otherwise, our main goal is to ensure that the node_modules from
     # the index is the one that we actually have.
-    local sha="$(get_index_gitlink node_modules)"
+    local sha
+    sha="$(get_index_gitlink node_modules)"
     if [ ! -e node_modules/.git ]; then
         # nothing there yet...
         cmd_checkout
@@ -172,7 +177,8 @@ main() {
         exit 1
     fi
 
-    local fname="$(printf 'cmd_%s' "$1" | tr '-' '_')"
+    local fname
+    fname="$(printf 'cmd_%s' "$1" | tr '-' '_')"
     if ! type -t "${fname}" | grep -q function; then
         echo "Unknown subcommand '$1'"
         exit 1