diff --git a/debian/postinst b/debian/postinst
index 4218e602aba..05a679bfa7c 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -24,7 +24,7 @@ case "$1" in
     touch /var/lib/dokku/core-plugins/config.toml /var/lib/dokku/plugins/config.toml
 
     # migrate old plugins
-    find /var/lib/dokku/plugins/ -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | while read plugin; do
+    find /var/lib/dokku/plugins/ -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | while read -r plugin; do
       if [ "$plugin" = "available" ] || [ "$plugin" = "enabled" ]; then
         continue
       elif [ -f /var/lib/dokku/plugins/$plugin/.core ]; then
@@ -35,7 +35,7 @@ case "$1" in
     done
 
     # enable all core plugins
-    find /var/lib/dokku/core-plugins/available -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | while read plugin; do
+    find /var/lib/dokku/core-plugins/available -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | while read -r plugin; do
       if [ ! -d /var/lib/dokku/plugins/available/$plugin ]; then
         ln -s /var/lib/dokku/core-plugins/available/$plugin /var/lib/dokku/plugins/available/$plugin;
         PLUGIN_PATH=/var/lib/dokku/core-plugins plugn enable $plugin
diff --git a/dokku b/dokku
index 72084afbf75..d1b889f9636 100755
--- a/dokku
+++ b/dokku
@@ -95,7 +95,7 @@ case "$1" in
 
     DOKKU_DEFAULT_DOCKER_ARGS=$(: | plugn trigger docker-args-deploy $APP $IMAGE_TAG)
 
-    while read line || [[ -n "$line" ]]; do
+    while read -r line || [[ -n "$line" ]]; do
       TRIM=${line%#*}
       PROC_TYPE=${TRIM%%=*}
       PROC_COUNT=${TRIM#*=}
diff --git a/plugins/apps/commands b/plugins/apps/commands
index a73e97975ec..d83b144214d 100755
--- a/plugins/apps/commands
+++ b/plugins/apps/commands
@@ -31,7 +31,7 @@ case "$1" in
       dokku_log_warn "To proceed, type \"$APP\""
       echo ""
 
-      read -p "> " app_name
+      read -rp "> " app_name
       if [[ "$app_name" != "$APP" ]]; then
         dokku_log_fail "Confirmation did not match $APP. Aborted."
       fi
diff --git a/plugins/backup/commands b/plugins/backup/commands
index 90f28a4adad..3997bc68e27 100755
--- a/plugins/backup/commands
+++ b/plugins/backup/commands
@@ -72,7 +72,7 @@ case "$1" in
     fi
 
     # create all the app directories
-    while read app; do mkdir "$TARGET_DIR/$app"; echo "Imported $app"; done < $BACKUP_TMP_DIR/.dokku_backup_apps
+    while read -r app; do mkdir "$TARGET_DIR/$app"; echo "Imported $app"; done < $BACKUP_TMP_DIR/.dokku_backup_apps
 
     # have the plugins import their stuff
     plugn trigger backup-import $VERSION "$BACKUP_ROOT" $TARGET_DIR "$BACKUP_TMP_DIR/.dokku_backup_apps"
diff --git a/plugins/checks/check-deploy b/plugins/checks/check-deploy
index 6b371385249..682ff96c9c8 100755
--- a/plugins/checks/check-deploy
+++ b/plugins/checks/check-deploy
@@ -108,7 +108,7 @@ fi
 
 # Reads name/value pairs, sets the WAIT and TIMEOUT variables
 exec < "$FILENAME"
-while read LINE; do
+while read -r LINE; do
   # Name/value pair
   if [[ "$LINE" =~ ^.+= ]]; then
     TRIM=${LINE%#*}
@@ -143,7 +143,7 @@ do
   fi
 
   exec < "$FILENAME"
-  while read CHECK_URL EXPECTED; do
+  while read -r CHECK_URL EXPECTED; do
     # Ignore empty lines and lines starting with #
     # shellcheck disable=SC1001
     [[ -z "$CHECK_URL" || "$CHECK_URL" =~ ^\# ]] && continue
diff --git a/plugins/docker-options/docker-args-deploy b/plugins/docker-options/docker-args-deploy
index 019f66f81f9..e9620db68c9 100755
--- a/plugins/docker-options/docker-args-deploy
+++ b/plugins/docker-options/docker-args-deploy
@@ -24,7 +24,7 @@ output=""
 if [[ -f "$PHASE_FILE_PATH" ]]; then
   DONE=false
   until $DONE; do
-    read line || DONE=true
+    read -r line || DONE=true
 
     [[ ! -n "$line" ]] && continue
 
diff --git a/plugins/git/backup-import b/plugins/git/backup-import
index 8d40fd316c2..41aaa115909 100755
--- a/plugins/git/backup-import
+++ b/plugins/git/backup-import
@@ -6,7 +6,7 @@ IMPORT_DIR="$2"
 TARGET_DIR="$3"
 APPS="$4"
 
-while read APP; do
+while read -r APP; do
   APP_PATH="$TARGET_DIR/$APP";
   git init --bare $APP_PATH > /dev/null
   PRERECEIVE_HOOK="$APP_PATH/hooks/pre-receive"
diff --git a/plugins/git/commands b/plugins/git/commands
index 783813f12f4..cdfcc3ea2c3 100755
--- a/plugins/git/commands
+++ b/plugins/git/commands
@@ -33,7 +33,7 @@ case "$1" in
   git-hook)
     APP=$2
 
-    while read oldrev newrev refname; do
+    while read -r oldrev newrev refname; do
       # Only run this script for the master branch. You can remove this
       # if block if you wish to run it for others as well.
       if [[ $refname = "refs/heads/master" ]]; then
diff --git a/plugins/nginx-vhosts/functions b/plugins/nginx-vhosts/functions
index 49270ae9e55..b1935b7cf5e 100755
--- a/plugins/nginx-vhosts/functions
+++ b/plugins/nginx-vhosts/functions
@@ -233,7 +233,7 @@ EOF
         local NGINX_SSL_PORT=$DOKKU_NGINX_SSL_PORT
       fi
 
-      while read line; do
+      while read -r line; do
         [[ -z "$line" ]] && continue
         dokku_log_info1 "Configuring SSL for $line..."
         SSL_SERVER_NAME=$line
diff --git a/plugins/ps/commands b/plugins/ps/commands
index 51cd35b1417..d63e92968ed 100755
--- a/plugins/ps/commands
+++ b/plugins/ps/commands
@@ -111,7 +111,7 @@ case "$1" in
       dokku_log_info1_quiet "Scaling for $APP"
       dokku_col_log_info1_quiet "proctype" "qty"
       dokku_col_log_info1_quiet "--------" "---"
-      while read line || [[ -n "$line" ]]; do
+      while read -r line || [[ -n "$line" ]]; do
         [[ -z "$line" ]] && continue
         PROC_NAME=${line%%=*}
         PROC_COUNT=${line#*=}
diff --git a/plugins/ps/functions b/plugins/ps/functions
index eafc1991690..d1c66549c80 100755
--- a/plugins/ps/functions
+++ b/plugins/ps/functions
@@ -4,7 +4,7 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
 print_dokku_scale_file() {
   local APP="$1"; local DOKKU_SCALE_FILE="$DOKKU_ROOT/$APP/DOKKU_SCALE"
-  while read line || [[ -n "$line" ]]; do
+  while read -r line || [[ -n "$line" ]]; do
     dokku_log_info2_quiet "$line"
   done < "$DOKKU_SCALE_FILE"
 }
@@ -25,7 +25,7 @@ generate_scale_file() {
     if [[ ! -e "$PROCFILE" ]]; then
       echo "web=1" >> $DOKKU_SCALE_FILE
     else
-      while read line || [[ -n "$line" ]]; do
+      while read -r line || [[ -n "$line" ]]; do
         [[ -z "$line" ]] && continue
         NAME=${line%%:*}
         NUM_PROCS=0
diff --git a/plugins/shell/commands b/plugins/shell/commands
index 16fec26f4c2..134a4ac5aee 100755
--- a/plugins/shell/commands
+++ b/plugins/shell/commands
@@ -18,7 +18,7 @@ case "$1" in
 
     while true; do
       trap '' SIGINT
-      read -ep "dokku> " line || {
+      read -rep "dokku> " line || {
         echo; true; break
       }
       trap - SIGINT