diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-deprecated-ips.sh.in b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-deprecated-ips.sh.in
index 5d6411d..b392176 100644
--- a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-deprecated-ips.sh.in
+++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-deprecated-ips.sh.in
@@ -116,11 +116,11 @@
     local pfx_bytes=()
     ip_to_bytes pfx_bytes "$ip" || return
     # No ULA Addresses
-    if (( pfx_bytes[0] & 0xfe == 0xfc )); then
+    if (( (pfx_bytes[0] & 0xfe) == 0xfc )); then
       return
     fi
     # We only want to allow a <pfx>::fd0x address, where x>0
-    if (( pfx_bytes[8] != 0xfd || pfx_bytes[9] & 0xf == 0 )); then
+    if (( pfx_bytes[8] != 0xfd || (pfx_bytes[9] & 0xf) == 0 )); then
       return
     fi
     for (( i = 10; i < 16; ++i )); do
diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-ip-from-ra.sh.in b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-ip-from-ra.sh.in
index a08935a..d0445d3 100755
--- a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-ip-from-ra.sh.in
+++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-ip-from-ra.sh.in
@@ -69,7 +69,7 @@
       t_pfx="${BASH_REMATCH[1]}"
       t_pfx_len="${BASH_REMATCH[2]}"
       ip_to_bytes t_pfx_b "$t_pfx" || continue
-      (( t_pfx_len == 76 && t_pfx_b[8] & 0xfd == 0xfd )) || continue
+      (( t_pfx_len == 76 && (t_pfx_b[8] & 0xfd) == 0xfd )) || continue
       (( t_pfx_b[9] |= 1 ))
       hextet="fd$(printf '%02x' "${t_pfx_b[9]}")"
       pfx="$(ip_bytes_to_str t_pfx_b)"
diff --git a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-dhcp.sh b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-dhcp.sh
index 6557125..4360e11 100644
--- a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-dhcp.sh
+++ b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-dhcp.sh
@@ -45,7 +45,7 @@
   pfx_bytes=()
   ip_to_bytes pfx_bytes "$ipv6"
   # Ensure we are a BMC and have a suffix nibble, the 0th index is reserved
-  if (( pfx_bytes[8] != 0xfd || pfx_bytes[9] & 0xf == 0 )); then
+  if (( pfx_bytes[8] != 0xfd || (pfx_bytes[9] & 0xf) == 0 )); then
     echo "Invalid address" >&2
     exit 1
   fi
diff --git a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh
index dbf2157..3c57b66 100644
--- a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh
+++ b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh
@@ -97,7 +97,7 @@
     if (( (ip_bytes[0] & 0xfe) == 0xfc || ip_bytes[8] != 0xfd )); then
       return 0
     fi
-    if (( (ip_bytes[9] & 0x0f) != 0 )); then
+    if (( (ip_bytes[9] & 0xf) != 0 )); then
       local -n gbmc_br_gw_src_ip=gbmc_br_gw_src_ip_stateful
     else
       local -n gbmc_br_gw_src_ip=gbmc_br_gw_src_ip_stateless