diff --git a/cmd/executor/docker-mirror/_ami.push.sh b/cmd/executor/docker-mirror/_ami.push.sh
index 9834f8ac470..e93fd632766 100755
--- a/cmd/executor/docker-mirror/_ami.push.sh
+++ b/cmd/executor/docker-mirror/_ami.push.sh
@@ -17,7 +17,8 @@ GOOGLE_IMAGE_NAME="${NAME}"
 "$gcloud" compute images update --project=sourcegraph-ci "${GOOGLE_IMAGE_NAME}" --family="${IMAGE_FAMILY}"
 
 if [ "${EXECUTOR_IS_TAGGED_RELEASE}" = "true" ]; then
-  for region in $(jq -r '.[]' <aws_regions.json); do
+  REGIONS=$(jq -r '.[]' <aws_regions.json)
+  for region in $REGIONS; do
     AWS_AMI_ID=$(aws ec2 --region="${region}" describe-images --filter "Name=name,Values=${NAME}" --query 'Images[*].[ImageId]' --output text)
     # Make AMI usable outside of Sourcegraph.
     aws ec2 --region="${region}" modify-image-attribute --image-id "${AWS_AMI_ID}" --launch-permission "Add=[{Group=all}]"
diff --git a/dev/db/drop-test-databases.sh b/dev/db/drop-test-databases.sh
index 2fdf942e7a2..04b66196e90 100755
--- a/dev/db/drop-test-databases.sh
+++ b/dev/db/drop-test-databases.sh
@@ -2,7 +2,8 @@
 
 set -eo pipefail
 
-for dbname in $(psql -Xc "copy (select datname from pg_database where datname like 'sourcegraph-test-%') to stdout"); do
+DB_NAMES=$(psql -Xc "copy (select datname from pg_database where datname like 'sourcegraph-test-%') to stdout")
+for dbname in $DB_NAMES; do
   dropdb "$dbname"
   echo "dropped $dbname"
 done
diff --git a/docker-images/alpine-3.14/update-all-dockerfiles.sh b/docker-images/alpine-3.14/update-all-dockerfiles.sh
index ccd7ee28702..a98bd474460 100755
--- a/docker-images/alpine-3.14/update-all-dockerfiles.sh
+++ b/docker-images/alpine-3.14/update-all-dockerfiles.sh
@@ -63,7 +63,8 @@ TAG="${TAG:-${NEW_TAG:?"$MISSING_MESSAGE"}}"
 
 NEW_TAG_AND_DIGEST="$(get_new_tag_and_digest "$NEW_IMAGE" "$TAG")"
 
-for file in $(fd --glob Dockerfile\* .); do
+DOCKERFILES=$(fd --glob Dockerfile\* .)
+for file in $DOCKERFILES; do
   update_image_reference "$OLD_IMAGE" "$NEW_IMAGE" "$NEW_TAG_AND_DIGEST" "$file"
   echo "$file"
 done