diff --git a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-from-ra.sh b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-from-ra.sh
index a9bfd74..0625c10 100644
--- a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-from-ra.sh
+++ b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-from-ra.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 # Copyright 2021 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -12,8 +13,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-[ -z "${gbmc_br_from_ra_lib-}" ] || return
+[[ -n ${gbmc_br_from_ra_lib-} ]] && return
 
+# shellcheck source=meta-google/recipes-google/networking/network-sh/lib.sh
 source /usr/share/network/lib.sh || exit
 
 gbmc_br_from_ra_init=
@@ -22,7 +24,7 @@
 declare -A gbmc_br_from_ra_prev_addrs=()
 
 gbmc_br_from_ra_update() {
-  [ -n "$gbmc_br_from_ra_init" -a -n "$gbmc_br_from_ra_mac" ] || return
+  [[ -n $gbmc_br_from_ra_init && -n $gbmc_br_from_ra_mac ]] || return
 
   local pfx
   for pfx in "${!gbmc_br_from_ra_pfxs[@]}"; do
@@ -48,13 +50,13 @@
     fi
     local valid="${gbmc_br_from_ra_pfxs["$pfx"]}"
     if (( valid > 0 )); then
-      if [ -z "${gbmc_br_from_ra_prev_addrs["$addr"]-}" ]; then
+      if [[ -z ${gbmc_br_from_ra_prev_addrs["$addr"]-} ]]; then
         echo "gBMC Bridge RA Addr Add: $addr" >&2
         gbmc_br_from_ra_prev_addrs["$addr"]=1
       fi
       ip addr replace "$addr" dev gbmcbr noprefixroute
     else
-      if [ -n "${gbmc_br_from_ra_prev_addrs["$addr"]-}" ]; then
+      if [[ -n ${gbmc_br_from_ra_prev_addrs["$addr"]-} ]]; then
         echo "gBMC Bridge RA Addr Del: $addr" >&2
         unset 'gbmc_br_from_ra_prev_addrs[$addr]'
       fi
@@ -65,28 +67,30 @@
 }
 
 gbmc_br_from_ra_hook() {
-  if [ "$change" = 'init' ]; then
+  # shellcheck disable=SC2154
+  if [[ $change == init ]]; then
     gbmc_br_from_ra_init=1
     gbmc_ip_monitor_defer
-  elif [ "$change" = 'defer' ]; then
+  elif [[ $change == defer ]]; then
     gbmc_br_from_ra_update
-  elif [[ "$change" == 'route' && "$route" != *' via '* ]] &&
-       [[ "$route" =~ ^(.* dev gbmcbr proto ra .*)( +expires +([^ ]+)sec).*$ ]]; then
+  elif [[ $change == route && $route != *' via '* ]] &&
+       [[ $route =~ ^(.* dev gbmcbr proto ra .*)( +expires +([^ ]+)sec).*$ ]]; then
     pfx="${route%% *}"
-    if [ "$action" = 'add' ]; then
+    # shellcheck disable=SC2154
+    if [[ $action == add ]]; then
       gbmc_br_from_ra_pfxs["$pfx"]="${BASH_REMATCH[3]}"
       gbmc_ip_monitor_defer
-    elif [ "$action" = 'del' ]; then
+    elif [[ $action == del ]]; then
       gbmc_br_from_ra_pfxs["$pfx"]=0
       gbmc_ip_monitor_defer
     fi
-  elif [ "$change" = 'link' -a "$intf" = 'gbmcbr' ]; then
+  elif [[ $change == link && $intf == gbmcbr ]]; then
     rdisc6 -m gbmcbr -r 1 -w 100 >/dev/null 2>&1
-    if [ "$action" = 'add' -a "$mac" != "$gbmc_br_from_ra_mac" ]; then
+    if [[ $action == add && $mac != "$gbmc_br_from_ra_mac" ]]; then
       gbmc_br_from_ra_mac="$mac"
       gbmc_ip_monitor_defer
     fi
-    if [ "$action" = 'del' -a "$mac" = "$gbmc_br_from_ra_mac" ]; then
+    if [[ $action == del && $mac == "$gbmc_br_from_ra_mac" ]]; then
       gbmc_br_from_ra_mac=
       gbmc_ip_monitor_defer
     fi
diff --git a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh
index 6085240..dd153ab 100644
--- a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh
+++ b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 # Copyright 2021 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -12,8 +13,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-[ -n "${gbmc_br_gw_src_lib-}" ] && return
+[[ -n ${gbmc_br_gw_src_lib-} ]] && return
 
+# shellcheck source=meta-google/recipes-google/networking/network-sh/lib.sh
 source /usr/share/network/lib.sh || exit
 
 gbmc_br_gw_src_ip_stateful=
@@ -25,16 +27,16 @@
   local defgw=
   local route
   for route in "${!gbmc_br_gw_src_routes[@]}"; do
-    if [[ "$route" != *' dev gbmcbr '* ]]; then
+    if [[ $route != *' dev gbmcbr '* ]]; then
       defgw=1
       break
     fi
   done
-  [ "$defgw" = "$gbmc_br_gw_defgw" ] && return
+  [[ $defgw == "$gbmc_br_gw_defgw" ]] && return
   gbmc_br_gw_defgw="$defgw"
 
   local files=(/run/systemd/network/{00,}-bmc-gbmcbr.network.d/50-defgw.conf)
-  if [ -n "$defgw" ]; then
+  if [[ -n $defgw ]]; then
     local file
     for file in "${files[@]}"; do
       mkdir -p "$(dirname "$file")"
@@ -44,19 +46,20 @@
     rm -f "${files[@]}"
   fi
 
-  if [ "$(systemctl is-active systemd-networkd)" != 'inactive' ]; then
+  if [[ $(systemctl is-active systemd-networkd) != inactive ]]; then
     networkctl reload && networkctl reconfigure gbmcbr
   fi
 }
 
 gbmc_br_gw_src_update() {
   local gbmc_br_gw_src_ip="${gbmc_br_gw_src_ip_stateful:-$gbmc_br_gw_src_ip_stateless}"
-  [ -n "$gbmc_br_gw_src_ip" ] || return
+  [[ -n $gbmc_br_gw_src_ip ]] || return
 
   local route
   for route in "${!gbmc_br_gw_src_routes[@]}"; do
-    [[ "$route" != *" src $gbmc_br_gw_src_ip "* ]] || continue
+    [[ $route != *" src $gbmc_br_gw_src_ip "* ]] || continue
     echo "gBMC Bridge Updating GW source [$gbmc_br_gw_src_ip]: $route" >&2
+    # shellcheck disable=SC2086
     ip route change $route src "$gbmc_br_gw_src_ip" && \
       unset 'gbmc_br_gw_src_routes[$route]'
   done
@@ -66,15 +69,16 @@
   # We only want to match default gateway routes that are dynamic
   # (have an expiration time). These will be updated with our preferred
   # source.
-  if [[ "$change" == 'route' && "$route" == 'default '*':'* ]]; then
-    if [[ "$route" =~ ^(.*)( +expires +[^ ]+)(.*)$ ]]; then
+  # shellcheck disable=SC2154
+  if [[ $change == route && $route == 'default '*':'* ]]; then
+    if [[ $route =~ ^(.*)( +expires +[^ ]+)(.*)$ ]]; then
       route="${BASH_REMATCH[1]}${BASH_REMATCH[3]}"
     fi
-    if [ "$action" = 'add' -a -z "${gbmc_br_gw_src_routes["$route"]}" ]; then
+    if [[ $action == add && -z ${gbmc_br_gw_src_routes["$route"]} ]]; then
       gbmc_br_gw_src_routes["$route"]=1
       gbmc_br_gw_src_update
       gbmc_br_set_router
-    elif [ "$action" = 'del' -a -n "${gbmc_br_gw_src_routes["$route"]}" ]; then
+    elif [[ $action == del && -n "${gbmc_br_gw_src_routes["$route"]}" ]]; then
       unset 'gbmc_br_gw_src_routes[$route]'
       gbmc_br_gw_src_update
       gbmc_br_set_router
@@ -82,8 +86,8 @@
   # Match only global IP addresses on the bridge that match the BMC stateless
   # prefix (<mpfx>:fd00:). So 2002:af4:3480:2248:fd00:6345:3069:9186 would be
   # matched as the preferred source IP for outoging traffic.
-  elif [ "$change" = 'addr' -a "$intf" = 'gbmcbr' -a "$scope" = 'global' ] &&
-       [[ "$fam" == 'inet6' && "$flags" != *tentative* ]]; then
+  elif [[ $change == addr && $intf == gbmcbr && $scope == global ]] &&
+       [[ $fam == inet6 && $flags != *tentative* ]]; then
     local ip_bytes=()
     if ! ip_to_bytes ip_bytes "$ip"; then
       echo "gBMC Bridge Ensure RA Invalid IP: $ip" >&2
@@ -98,11 +102,11 @@
     else
       local -n gbmc_br_gw_src_ip=gbmc_br_gw_src_ip_stateless
     fi
-    if [ "$action" = 'add' -a "$ip" != "$gbmc_br_gw_src_ip" ]; then
+    if [[ $action == add && $ip != "$gbmc_br_gw_src_ip" ]]; then
       gbmc_br_gw_src_ip="$ip"
       gbmc_br_gw_src_update
     fi
-    if [ "$action" = 'del' -a "$ip" = "$gbmc_br_gw_src_ip" ]; then
+    if [[ $action == del && $ip == "$gbmc_br_gw_src_ip" ]]; then
       gbmc_br_gw_src_ip=
     fi
   fi
diff --git a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-nft.sh b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-nft.sh
index ca4e15a..7aa2158 100644
--- a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-nft.sh
+++ b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-nft.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 # Copyright 2021 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -12,11 +13,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-[ -z "${gbmc_br_nft_lib-}" ] || return
+[[ -n ${gbmc_br_nft_lib-} ]] && return
 
+# shellcheck source=meta-google/recipes-google/networking/network-sh/lib.sh
 source /usr/share/network/lib.sh || exit
 
-gbmc_br_nft_init=
 gbmc_br_nft_pfx=
 
 gbmc_br_nft_update() {
@@ -26,7 +27,7 @@
   local contents=
   contents+='table inet filter {'$'\n'
   contents+='    chain gbmc_br_int_input {'$'\n'
-  if [ -n "${gbmc_br_nft_pfx-}" ]; then
+  if [[ -n ${gbmc_br_nft_pfx-} ]]; then
     contents+="        ip6 saddr $gbmc_br_nft_pfx"
     contents+=" ip6 daddr $gbmc_br_nft_pfx accept"$'\n'
   fi
@@ -34,21 +35,20 @@
   contents+='}'$'\n'
 
   local rfile=/run/nftables/40-gbmc-br-int.rules
-  mkdir -p -m 755 "$(dirname "$rfile")"
+  mkdir -p "$(dirname "$rfile")"
   printf '%s' "$contents" >"$rfile"
 
+  # shellcheck disable=SC2015
   systemctl reset-failed nftables && systemctl --no-block reload-or-restart nftables || true
 }
 
 gbmc_br_nft_hook() {
-  if [ "$change" = 'init' ]; then
-    gbmc_br_nft_init=1
-    gbmc_br_nft_update
   # Match only global IP addresses on the bridge that match the BMC prefix
   # (<mpfx>:fdxx:). So 2002:af4:3480:2248:fd02:6345:3069:9186 would become
   # a 2002:af4:3480:2248:fd00/76 rule.
-  elif [ "$change" = 'addr' -a "$intf" = 'gbmcbr' -a "$scope" = 'global' ] &&
-       [[ "$fam" == 'inet6' && "$flags" != *tentative* ]]; then
+  # shellcheck disable=SC2154
+  if [[ $change == addr && $intf == gbmcbr && $scope == global ]] &&
+       [[ $fam == inet6 && $flags != *tentative* ]]; then
     local ip_bytes=()
     if ! ip_to_bytes ip_bytes "$ip"; then
       echo "gBMC Bridge NFT Invalid IP: $ip" >&2
@@ -59,10 +59,10 @@
     fi
     local i
     for (( i=9; i<16; i++ )); do
-      ip_bytes[$i]=0
+      ip_bytes["$i"]=0
     done
     pfx="$(ip_bytes_to_str ip_bytes)/76"
-    if [ "$action" = "add" -a "$pfx" != "$gbmc_br_nft_pfx" ]; then
+    if [[ $action == add && $pfx != "$gbmc_br_nft_pfx" ]]; then
       gbmc_br_nft_pfx="$pfx"
       gbmc_br_nft_update
     fi
diff --git a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-ula.sh b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-ula.sh
index 8e28d39..42bb566 100644
--- a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-ula.sh
+++ b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-ula.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 # Copyright 2021 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -12,21 +13,22 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-[ -z "${gbmc_br_ula_lib-}" ] || return
+[[ -n ${gbmc_br_ula_lib-} ]] && return
 
+# shellcheck source=meta-google/recipes-google/networking/network-sh/lib.sh
 source /usr/share/network/lib.sh || exit
 
 gbmc_br_ula_init=
 gbmc_br_ula_mac=
 
 gbmc_br_ula_update() {
-  [ -n "$gbmc_br_ula_init" ] || return
+  [[ -n $gbmc_br_ula_init ]] || return
 
   echo "gBMC Bridge ULA MAC: ${gbmc_br_ula_mac:-(deleted)}" >&2
 
   local addr=
   contents='[Network]'$'\n'
-  if [ -n "$gbmc_br_ula_mac" ]; then
+  if [[ -n $gbmc_br_ula_mac ]]; then
     local sfx
     if sfx="$(mac_to_eui64 "$gbmc_br_ula_mac")" &&
        addr="$(ip_pfx_concat "fdb5:0481:10ce::/64" "$sfx")"; then
@@ -36,7 +38,7 @@
 
   local netfile
   for netfile in /run/systemd/network/{00,}-bmc-gbmcbr.network.d/60-ula.conf; do
-    mkdir -p -m 755 "$(dirname "$netfile")"
+    mkdir -p "$(dirname "$netfile")"
     printf '%s' "$contents" >"$netfile"
   done
 
@@ -44,22 +46,23 @@
   # currently check the mtime of drop-in files.
   touch -c /lib/systemd/network/*-bmc-gbmcbr.network
 
-  if [ "$(systemctl is-active systemd-networkd)" != 'inactive' ]; then
+  if [[ $(systemctl is-active systemd-networkd) != inactive ]]; then
     networkctl reload
     networkctl reconfigure gbmcbr
   fi
 }
 
 gbmc_br_ula_hook() {
-  if [ "$change" = 'init' ]; then
+  # shellcheck disable=SC2154
+  if [[ $change == init ]]; then
     gbmc_br_ula_init=1
     gbmc_br_ula_update
-  elif [ "$change" = 'link' -a "$intf" = 'gbmcbr' ]; then
-    if [ "$action" = 'add' -a "$mac" != "$gbmc_br_ula_mac" ]; then
+  elif [[ $change == link && $intf == gbmcbr ]]; then
+    if [[ $action == add && $mac != "$gbmc_br_ula_mac" ]]; then
       gbmc_br_ula_mac="$mac"
       gbmc_br_ula_update
     fi
-    if [ "$action" = 'del' -a "$mac" = "$gbmc_br_ula_mac" ]; then
+    if [[ $action == del && $mac == "$gbmc_br_ula_mac" ]]; then
       gbmc_br_ula_mac=
       gbmc_br_ula_update
     fi