diff --git a/docker-bake.hcl b/docker-bake.hcl
index e320636d..9488715b 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -7,7 +7,7 @@ variable "TEST_BASE_TYPE" {
 }
 
 variable "TEST_BASE_IMAGE" {
-    default = TEST_BASE_TYPE == "alpine" ? "alpine:3.19" : TEST_BASE_TYPE == "debian" ? "debian:bookworm" : null
+    default = TEST_BASE_TYPE == "alpine" ? "alpine:3.20" : TEST_BASE_TYPE == "debian" ? "debian:bookworm" : null
 }
 
 variable "DEV_SDK_PLATFORM" {
diff --git a/hack/dockerfiles/shellcheck.Dockerfile b/hack/dockerfiles/shellcheck.Dockerfile
index eee5a35d..d91db163 100644
--- a/hack/dockerfiles/shellcheck.Dockerfile
+++ b/hack/dockerfiles/shellcheck.Dockerfile
@@ -1,5 +1,6 @@
-# syntax = docker/dockerfile:1.5
-FROM koalaman/shellcheck-alpine:v0.7.2
+# syntax=docker/dockerfile:1.8
+# check=error=true
+
+FROM koalaman/shellcheck-alpine:v0.10.0
 WORKDIR /src
-COPY src .
-RUN shellcheck xx-*
\ No newline at end of file
+RUN --mount=type=bind,src=src shellcheck xx-*
\ No newline at end of file
diff --git a/hack/dockerfiles/shfmt.Dockerfile b/hack/dockerfiles/shfmt.Dockerfile
index cc6556d3..d54c8f63 100644
--- a/hack/dockerfiles/shfmt.Dockerfile
+++ b/hack/dockerfiles/shfmt.Dockerfile
@@ -1,19 +1,33 @@
-# syntax = docker/dockerfile:1.5
-FROM mvdan/shfmt:v3.2.1-alpine AS shfmt
+# syntax=docker/dockerfile:1.8
+# check=error=true
+
+FROM mvdan/shfmt:v3.8.0-alpine AS shfmt
 WORKDIR /src
 ARG SHFMT_FLAGS="-i 2 -ci"
 
 FROM shfmt AS generate
 WORKDIR /out
-RUN --mount=target=/src \
-  cp -a /src/* ./ && \
-  shfmt -l -w -ln posix $SHFMT_FLAGS . && \
-  for f in */test-*.bats; do shfmt -l -w -ln bats $SHFMT_FLAGS "$f"; done
+RUN --mount=target=/src <<EOF
+  set -ex
+  cp -a /src/* ./
+  for f in */xx-*; do 
+    shfmt -l -w -ln posix $SHFMT_FLAGS "$f";
+  done
+  for f in */test-*.bats; do
+    shfmt -l -w -ln bats $SHFMT_FLAGS "$f";
+  done
+EOF
 
 FROM scratch AS update
 COPY --from=generate /out /
 
 FROM shfmt AS validate
-RUN --mount=target=. \
-  shfmt -ln posix $SHFMT_FLAGS -d . && \
-  for f in */test-*.bats; do shfmt -ln bats $SHFMT_FLAGS -d "$f" || return; done;
+RUN --mount=type=bind <<EOF
+  set -ex
+  for f in */xx-*; do
+    shfmt -ln posix $SHFMT_FLAGS -d "$f"
+  done
+  for f in */test-*.bats; do
+    shfmt -ln bats $SHFMT_FLAGS -d "$f"
+  done
+EOF
diff --git a/src/Dockerfile b/src/Dockerfile
index 5fb5d763..e2e51cc3 100644
--- a/src/Dockerfile
+++ b/src/Dockerfile
@@ -1,4 +1,5 @@
-# syntax=docker/dockerfile:1.5
+# syntax=docker/dockerfile:1.8
+# check=error=true
 
 ARG TEST_BASE_TYPE=alpine
 ARG TEST_BASE_IMAGE=${TEST_BASE_TYPE}
@@ -113,4 +114,4 @@ COPY fixtures fixtures
 COPY *.bats test_helper.bash ./
 
 # default is alias to build xx image
-FROM xx as default
+FROM xx AS default
diff --git a/src/ld/Dockerfile b/src/ld/Dockerfile
index 16162f2b..d486e1e3 100644
--- a/src/ld/Dockerfile
+++ b/src/ld/Dockerfile
@@ -1,4 +1,5 @@
-#syntax=docker/dockerfile:1.5
+#syntax=docker/dockerfile:1.8
+#check=error=true
 
 ARG ALPINE_VERSION=3.20
 ARG LIBTAPI_VERSION=1300.6.5
@@ -14,8 +15,9 @@ FROM --platform=${BUILDPLATFORM} alpine:${ALPINE_VERSION} AS libtapi-base
 RUN apk add --no-cache git clang lld cmake make python3 bash
 COPY --link --from=xx / /
 ARG LIBTAPI_VERSION
+WORKDIR /work
 RUN git clone https://github.com/tpoechtrager/apple-libtapi --depth 1 -b ${LIBTAPI_VERSION}
-WORKDIR ./apple-libtapi
+WORKDIR apple-libtapi
 RUN --mount=target=/tmp/libtapi-cmake-args.patch,source=libtapi-cmake-args.patch \
     git apply /tmp/libtapi-cmake-args.patch
 RUN apk add --no-cache gcc g++
@@ -61,11 +63,12 @@ FROM --platform=${BUILDPLATFORM} alpine:${ALPINE_VERSION} AS libdispatch-base
 RUN apk add git clang lld cmake samurai patch
 ARG LIBDISPATCH_VERSION
 COPY --link --from=xx / /
+WORKDIR /work
 RUN --mount=target=/patches,from=patches-libdispatch \
     git clone -b ${LIBDISPATCH_VERSION} --depth 1 https://github.com/apple/swift-corelibs-libdispatch.git && \
     cd swift-corelibs-libdispatch && \
     for f in /patches/*; do patch -p1 < $f; done
-WORKDIR ./swift-corelibs-libdispatch
+WORKDIR swift-corelibs-libdispatch
 ARG TARGETPLATFORM
 RUN xx-apk add --no-cache gcc g++ musl-dev linux-headers bsd-compat-headers
 RUN cmake $(xx-clang --print-cmake-defines) -G Ninja -B build -DCMAKE_INSTALL_PREFIX=/out/libdispatch -DCMAKE_INSTALL_LIBDIR=lib -DBUILD_SHARED_LIBS=False -DCMAKE_BUILD_TYPE=MinSizeRel && \
@@ -85,7 +88,7 @@ WORKDIR /work
 ARG CCTOOLS_REPO=https://github.com/tpoechtrager/cctools-port
 ARG CCTOOLS_VERSION
 RUN git clone $CCTOOLS_REPO -b ${CCTOOLS_VERSION}
-WORKDIR ./cctools-port/cctools
+WORKDIR cctools-port/cctools
 ARG TARGETPLATFORM
 RUN --mount=target=/libdispatch,from=libdispatch \
     xx-apk add --no-cache musl-dev gcc g++ libdispatch-dev && \
@@ -129,7 +132,7 @@ ARG SIGTOOL_VERSION
 RUN git clone https://github.com/thefloweringash/sigtool && \
     cd sigtool && \
     git checkout ${SIGTOOL_VERSION}
-WORKDIR ./sigtool
+WORKDIR sigtool
 RUN --mount=target=/tmp/sigtool-static.patch,source=sigtool-static.patch \
     git apply /tmp/sigtool-static.patch
 ARG TARGETPLATFORM
diff --git a/src/llvm/Dockerfile b/src/llvm/Dockerfile
index 588dc600..36980958 100644
--- a/src/llvm/Dockerfile
+++ b/src/llvm/Dockerfile
@@ -1,4 +1,5 @@
-#syntax=docker/dockerfile:1.5
+#syntax=docker/dockerfile:1.8
+#check=error=true
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx AS xx
 
diff --git a/src/xx-cc b/src/xx-cc
index d80db3cb..1a9fcb33 100755
--- a/src/xx-cc
+++ b/src/xx-cc
@@ -402,7 +402,7 @@ setup() {
     if [ "$exp" = "riscv64" ]; then
       exp="riscv"
     fi
-    if ld -V 2>/dev/null | grep $exp >/dev/null; then
+    if ld -V 2>/dev/null | grep "$exp" >/dev/null; then
       ln -s "$(command -v ld)" "/usr/bin/${target}-ld"
       linker="/usr/bin/${target}-ld"
       XX_CC_PREFER_LINKER=
@@ -538,7 +538,7 @@ EOT
 }
 
 check_compiler() {
-  if [ ! -f /usr/bin/$name ]; then
+  if [ ! -f "/usr/bin/$name" ]; then
     echo >&2 "/usr/bin/$name not found. Make sure package is installed. xx doesn't currently support binaries in custom location"
     exit
   fi
@@ -560,7 +560,7 @@ downloadLD=
 for p in "$@"; do
   # ignore if custom --config already set
   if [ "${p}" = "--config" ]; then
-    exec /usr/bin/$name "$@"
+    exec "/usr/bin/$name" "$@"
   fi
   if [ "${p}" = "--print-target-triple" ] || [ "${p}" = "-print-target-triple" ]; then
     printTarget=1
@@ -667,15 +667,15 @@ if [ -z "${target}" ] && [ ! -f /etc/llvm/xx-default.cfg ] && [ -n "$wrapped" ];
   setup
 fi
 
-if [ ! -f /usr/bin/$name ]; then
+if [ ! -f "/usr/bin/$name" ]; then
   echo >&2 "/usr/bin/$name not found. Make sure package is installed. xx doesn't currently support binaries in custom location"
   exit
 fi
 
 if [ -z "$target" ] && [ -f /etc/llvm/xx-default.cfg ]; then
-  exec /usr/bin/$name --config /etc/llvm/xx-default.cfg "$@"
+  exec "/usr/bin/$name" --config /etc/llvm/xx-default.cfg "$@"
 elif [ -f "/usr/bin/${target}.cfg" ]; then
-  exec /usr/bin/$name --config "/usr/bin/${target}.cfg" "$@"
+  exec "/usr/bin/$name" --config "/usr/bin/${target}.cfg" "$@"
 else
-  exec /usr/bin/$name "$@"
+  exec "/usr/bin/$name" "$@"
 fi
diff --git a/src/xx-go b/src/xx-go
index e193528a..6e777e71 100755
--- a/src/xx-go
+++ b/src/xx-go
@@ -6,8 +6,8 @@ for l in $(xx-info env); do
   export "${l?}"
 done
 
-export GOOS=${TARGETOS}
-export GOARCH=${TARGETARCH}
+export GOOS="${TARGETOS}"
+export GOARCH="${TARGETARCH}"
 
 case "$TARGETARCH" in
   "amd64")
@@ -67,37 +67,37 @@ ar_set=
 pkgconfig_set=
 
 if command -v "$XX_TRIPLE-gcc" >/dev/null 2>/dev/null; then
-  export CC=$XX_TRIPLE-gcc
+  export CC="$XX_TRIPLE-gcc"
   c_set=1
 fi
 
 if command -v "$XX_TRIPLE-g++" >/dev/null 2>/dev/null; then
-  export CXX=$XX_TRIPLE-g++
+  export CXX="$XX_TRIPLE-g++"
   cxx_set=1
 fi
 
 if command -v clang >/dev/null 2>/dev/null; then
   triple=$(xx-clang --print-target-triple || true)
   if [ -n "$triple" ]; then
-    export CC=$triple-clang
-    export CXX=$triple-clang++
+    export CC="$triple-clang"
+    export CXX="$triple-clang++"
     c_set=1
     cxx_set=1
   fi
 fi
 
 if command -v "$XX_TRIPLE-ar" >/dev/null 2>/dev/null; then
-  export AR=$XX_TRIPLE-ar
+  export AR="$XX_TRIPLE-ar"
   ar_set=1
 fi
 
 if command -v "$XX_TRIPLE-pkg-config" >/dev/null 2>/dev/null; then
-  export PKG_CONFIG=$XX_TRIPLE-pkg-config
+  export PKG_CONFIG="$XX_TRIPLE-pkg-config"
   pkgconfig_set=1
 fi
 
 if [ -z "$GOBIN" ] && [ -n "$GOPATH" ] && [ -n "$GOARCH" ] && [ -n "$GOOS" ]; then
-  export PATH=${GOPATH}/bin/${GOOS}_${GOARCH}:${PATH}
+  export PATH="${GOPATH}/bin/${GOOS}_${GOARCH}:${PATH}"
 fi
 
 wrap() {
diff --git a/src/xx-info b/src/xx-info
index 494d03c7..dfe574ff 100755
--- a/src/xx-info
+++ b/src/xx-info
@@ -76,14 +76,14 @@ fi
 
 # break up TARGETPLATFORM if provided
 if [ -n "$TARGETPLATFORM" ]; then
-  os="$(echo $TARGETPLATFORM | cut -d"/" -f1)"
-  arch="$(echo $TARGETPLATFORM | cut -d"/" -f2)"
+  os="$(echo "$TARGETPLATFORM" | cut -d"/" -f1)"
+  arch="$(echo "$TARGETPLATFORM" | cut -d"/" -f2)"
   if [ -n "$os" ] && [ -n "$arch" ]; then
     TARGETOS="$os"
     TARGETARCH="$arch"
     case "$arch" in
       "amd64")
-        case "$(echo $TARGETPLATFORM | cut -d"/" -f3)" in
+        case "$(echo "$TARGETPLATFORM" | cut -d"/" -f3)" in
           "v2")
             TARGETVARIANT="v2"
             ;;
@@ -96,7 +96,7 @@ if [ -n "$TARGETPLATFORM" ]; then
         esac
         ;;
       "arm")
-        case "$(echo $TARGETPLATFORM | cut -d"/" -f3)" in
+        case "$(echo "$TARGETPLATFORM" | cut -d"/" -f3)" in
           "v5")
             TARGETVARIANT="v5"
             ;;
@@ -112,7 +112,7 @@ if [ -n "$TARGETPLATFORM" ]; then
         esac
         ;;
       "mips"*)
-        TARGETVARIANT="$(echo $TARGETPLATFORM | cut -d"/" -f3)"
+        TARGETVARIANT="$(echo "$TARGETPLATFORM" | cut -d"/" -f3)"
         ;;
     esac
   fi
@@ -375,31 +375,31 @@ case "$1" in
     fi
     ;;
   "arch")
-    echo $TARGETARCH
+    echo "$TARGETARCH"
     ;;
   "variant")
-    echo $TARGETVARIANT
+    echo "$TARGETVARIANT"
     ;;
   "os")
-    echo $TARGETOS # TODO:
+    echo "$TARGETOS" # TODO:
     ;;
   "os-version")
     echo "$XX_OS_VERSION"
     ;;
   "march")
-    echo $XX_MARCH
+    echo "$XX_MARCH"
     ;;
   "debian-arch")
-    echo $XX_DEBIAN_ARCH
+    echo "$XX_DEBIAN_ARCH"
     ;;
   "alpine-arch")
-    echo $XX_ALPINE_ARCH
+    echo "$XX_ALPINE_ARCH"
     ;;
   "rhel-arch")
-    echo $XX_RHEL_ARCH
+    echo "$XX_RHEL_ARCH"
     ;;
   "pkg-arch")
-    echo $XX_PKG_ARCH
+    echo "$XX_PKG_ARCH"
     ;;
   "triple")
     echo "$XX_TRIPLE"
@@ -408,7 +408,7 @@ case "$1" in
     echo "$XX_VENDOR"
     ;;
   "libc") # this is not abi, just the prefix
-    echo $XX_LIBC
+    echo "$XX_LIBC"
     ;;
   "env")
     echo "XX_OS=${TARGETOS}"
diff --git a/src/xx-windres b/src/xx-windres
index 36b99c85..c3ad3f6b 100755
--- a/src/xx-windres
+++ b/src/xx-windres
@@ -360,14 +360,14 @@ else
 fi
 
 if [ "$outputf" = "res" ]; then
-  run cp $resfile $output
+  run cp "$resfile" "$output"
 else
   if ! command -v llvm-cvtres 2>/dev/null >/dev/null; then
     echo >&2 "llvm-cvtres not installed"
     exit 1
   fi
 
-  run llvm-cvtres -machine:$machine -out:$output $resfile
+  run llvm-cvtres -machine:$machine "-out:$output" "$resfile"
 fi
 
 if [ -f "$tmpfile" ]; then
diff --git a/util/bats-assert/Dockerfile b/util/bats-assert/Dockerfile
index 01f3c5fe..f7f0551a 100644
--- a/util/bats-assert/Dockerfile
+++ b/util/bats-assert/Dockerfile
@@ -1,4 +1,9 @@
-FROM --platform=$BUILDPLATFORM alpine AS build
+#syntax=docker/dockerfile:1.8
+#check=error=true
+
+ARG ALPINE_VERSION=3.20
+
+FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS build
 RUN apk add --no-cache git
 WORKDIR /work
 RUN git clone --bare https://github.com/ztombol/bats-support && \
@@ -16,7 +21,7 @@ RUN echo 'source "$(dirname "${BASH_SOURCE[0]}")/bats-support/load.bash"' > /out
 FROM scratch AS release
 COPY --from=build /out /
 
-FROM alpine:3.19 AS test-gen
+FROM alpine:${ALPINE_VERSION} AS test-gen
 RUN apk add --no-cache bats
 WORKDIR /work
 COPY --from=release . .
diff --git a/util/bats-assert/test.bats.golden b/util/bats-assert/test.bats.golden
index 13e8830e..f7f3aa99 100644
--- a/util/bats-assert/test.bats.golden
+++ b/util/bats-assert/test.bats.golden
@@ -27,5 +27,5 @@ not ok 5 run-fail
 
 The following warnings were encountered during tests:
 BW01: `run`'s command `./foobar` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
-      (from function `run' in file /usr/lib/bats-core/test_functions.bash, line 421,
+      (from function `run' in file /usr/lib/bats-core/test_functions.bash, line 426,
        in test file test.bats, line 15)