diff --git a/Makefile b/Makefile
index 355dc18e..ffbc0bfc 100644
--- a/Makefile
+++ b/Makefile
@@ -18,9 +18,13 @@ HELM_PIDFILE ?= $(abspath ./.helm-pid)
 CHARTS := $(patsubst charts/%/.,%,$(wildcard charts/*/.))
 
 .PHONY: all
-all: banner charts
+all: charts lint
 
-banner:
+.PHONY: tests
+tests: gate-lint
+	tox
+
+chartbanner:
 	@echo Building charts: $(CHARTS)
 
 .PHONY: charts
@@ -36,7 +40,15 @@ helm-init-%: helm-serve
 	cd charts;if [ -s $*/requirements.yaml ]; then echo "Initializing $*";$(HELM) dep up $*; fi
 
 .PHONY: lint
-lint: helm-lint
+lint: helm-lint gate-lint
+
+.PHONY: gate-lint
+gate-lint: gate-lint-deps
+	tox -e gate-lint
+
+.PHONY: gate-lint-deps
+gate-lint-deps:
+	sudo apt-get install -y --no-install-recommends shellcheck
 
 .PHONY: helm-lint
 helm-lint: $(addprefix helm-lint-,$(CHARTS))
@@ -55,7 +67,7 @@ dry-run-%: helm-lint-%
 	cd charts;$(HELM) template --set pod.resources.enabled=true $*
 
 .PHONY: $(CHARTS)
-$(CHARTS): $(addprefix dry-run-,$(CHARTS))
+$(CHARTS): $(addprefix dry-run-,$(CHARTS)) chartbanner
 	$(HELM) package -d charts charts/$@
 
 .PHONY: helm-serve
diff --git a/tools/g2/lib/promenade.sh b/tools/g2/lib/promenade.sh
index ca386492..4dc480a9 100644
--- a/tools/g2/lib/promenade.sh
+++ b/tools/g2/lib/promenade.sh
@@ -43,7 +43,7 @@ promenade_render_validate_body() {
         JSON="{\"rel\":\"design\",\"href\":\"${NGINX_URL}/promenade.yaml\",\"type\":\"application/x-yaml\"}"
     fi
 
-    echo ${JSON}
+    echo "${JSON}"
 }
 
 promenade_health_check() {
diff --git a/tools/g2/stages/build-image.sh b/tools/g2/stages/build-image.sh
index 6dd29106..cd9acaaf 100755
--- a/tools/g2/stages/build-image.sh
+++ b/tools/g2/stages/build-image.sh
@@ -18,12 +18,12 @@ else
     docker build -q \
       --network host \
       -t "${IMAGE_PROMENADE}" \
-      --build-arg HTTP_PROXY=${HTTP_PROXY} \
-      --build-arg HTTPS_PROXY=${HTTPS_PROXY} \
-      --build-arg NO_PROXY=${NO_PROXY} \
-      --build-arg http_proxy=${http_proxy} \
-      --build-arg https_proxy=${https_proxy} \
-      --build-arg no_proxy=${no_proxy} \
+      --build-arg "HTTP_PROXY=${HTTP_PROXY:-}" \
+      --build-arg "HTTPS_PROXY=${HTTPS_PROXY:-}" \
+      --build-arg "NO_PROXY=${NO_PROXY:-}" \
+      --build-arg "http_proxy=${http_proxy:-}" \
+      --build-arg "https_proxy=${https_proxy:-}" \
+      --build-arg "no_proxy=${no_proxy:-}" \
       "${WORKSPACE}"
 fi
 
diff --git a/tools/g2/stages/join-nodes.sh b/tools/g2/stages/join-nodes.sh
index e6adeaa4..55d73365 100755
--- a/tools/g2/stages/join-nodes.sh
+++ b/tools/g2/stages/join-nodes.sh
@@ -64,7 +64,7 @@ for NAME in "${NODES[@]}"; do
             log Failed to get keystone token, exiting.
             exit 1
         fi
-        TOKEN_HASH=$(echo -n ${TOKEN} | md5sum)
+        TOKEN_HASH=$(echo -n "${TOKEN}" | md5sum)
         log "Got keystone token, token md5sum: ${TOKEN_HASH}"
         CURL_ARGS+=("-H" "X-Auth-Token: ${TOKEN}")
     fi