diff --git a/.github/workflows/reusable-misc-tests-1.yml b/.github/workflows/reusable-misc-tests-1.yml
index e31db2bdf5..d3767cdeb6 100644
--- a/.github/workflows/reusable-misc-tests-1.yml
+++ b/.github/workflows/reusable-misc-tests-1.yml
@@ -66,11 +66,11 @@ jobs:
         run: |-
           ${{inputs.SUDO}} ${{inputs.BINARY}} stop earthly-buildkitd || true && \
           for i in 1 2 3 4; do
-              ${{inputs.SUDO}} ${{inputs.BUILT_EARTHLY_PATH}} github.com/EarthBuild/hello-world+hello & \
-              pids[${i}]=$!
+              ${{inputs.SUDO}} ${{inputs.BUILT_EARTHLY_PATH}} --no-output github.com/EarthBuild/hello-world+hello & \
+              pids[i]=$!
           done && \
-          for pid in ${pids[*]}; do
-              wait $pid
+          for pid in "${pids[@]}"; do
+              wait "$pid"
           done
       - name: Execute interactive debugger test
         run: ./scripts/tests/interactive-debugger/test-interactive.py --earthly ${{inputs.BUILT_EARTHLY_PATH}} --timeout 180
diff --git a/not-a-unit-test.sh b/not-a-unit-test.sh
index 64f37cfa0d..9a04ddfdc6 100755
--- a/not-a-unit-test.sh
+++ b/not-a-unit-test.sh
@@ -43,6 +43,9 @@ touch /var/lib/shared/vfs-images/images.lock
 mkdir -p /var/lib/shared/vfs-layers
 touch /var/lib/shared/vfs-layers/layers.lock
 
+# The single-quoted sed replacement is an intentional literal env-var token,
+# not a value to expand at this point.
+# shellcheck disable=SC2016
 sed -i 's/\/var\/lib\/containers\/storage/$EARTHLY_DOCKERD_DATA_ROOT/g' /etc/containers/storage.conf
 
 if [ -n "$DOCKERHUB_MIRROR" ]; then
@@ -71,8 +74,11 @@ then
 fi
 
 # then run the test
-if [ -n "$testname" ]
-then
-    testarg="-run $testname"
-fi
-go test -timeout 20m -json $testarg $pkgname | ./testparser
+# pkgname/testname come from the Earthfile env (ARG pkgname / ARG testname),
+# which the linter can't see. Build the arg list with set -- so -run "$testname"
+# is quoted; pkgname is left unquoted on purpose as it may expand to several
+# space-separated package patterns.
+set -- -timeout 20m -json
+[ -n "$testname" ] && set -- "$@" -run "$testname"
+# shellcheck disable=SC2086,SC2154
+go test "$@" $pkgname | ./testparser