diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 5d271fa1cc2a52a36ee5fe246f2dc7fb7725eaa7..a827ddda03fb7ad0219ddbd261b4dbdc0dbd2715 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -36,8 +36,8 @@ test-single:
     - sudo apt-get update
     - sudo apt-get install -y --no-install-recommends git
     - rm -fv clouds.yaml testsuite.auto.tfvars gitlab.tf
-    - ln -sfv $CLOUDS_YAML clouds.yaml
-    - ln -sfv $TERRAFORM_CONFIG testsuite.auto.tfvars
+    - ln -sfv "$CLOUDS_YAML" clouds.yaml
+    - ln -sfv "$TERRAFORM_CONFIG" testsuite.auto.tfvars
     # GitLab remote terraform state
     - printf 'terraform {\n  backend "http" {\n  }\n}\n' > gitlab.tf
     # https://github.com/terraform-provider-openstack/terraform-provider-openstack/issues/1160
@@ -53,13 +53,13 @@ test-single:
       - ".terraform/"
       - "ip.txt"
   script:
-    - args="-auto-approve -var type=hadoop-single -var flavor=standard.large -var n=0 -var domain=terra1 -var image_name=$IMAGE_NAME -var image_visibility=$IMAGE_VISIBILITY -var floating_ip=$ip"
-    - terraform apply $args
+    - args=(-auto-approve -var type=hadoop-single -var flavor=standard.large -var n=0 -var domain=terra1 -var "image_name=$IMAGE_NAME" -var "image_visibility=$IMAGE_VISIBILITY" -var "floating_ip=$ip")
+    - terraform apply "${args[@]}"
     - eval $(ssh-agent -s)
     - ssh-add ./ssh-key.terra1.txt
-    - ssh -o PreferredAuthentications=publickey deployadm@$ip "sudo -u debian sh -c 'cd; ~deployadm/terraform/image/tests/run-tests.sh'"
-    - terraform destroy $args
-    - openstack floating ip delete $ip
+    - ssh -o PreferredAuthentications=publickey "deployadm@$ip" "sudo -u debian sh -c 'cd; ~deployadm/terraform/image/tests/run-tests.sh'"
+    - terraform destroy "${args[@]}"
+    - openstack floating ip delete "$ip"
     - rm -fv ip.txt
   rules:
     - if: '$JOB =~ /all|test-single/'
@@ -78,13 +78,13 @@ test-cluster:
       - ".terraform/"
       - "ip.txt"
   script:
-    - args="-auto-approve -var type=hadoop -var domain=terra2 -var image_name=$IMAGE_NAME -var image_visibility=$IMAGE_VISIBILITY -var floating_ip=$ip"
-    - terraform apply $args
+    - args=(-auto-approve -var type=hadoop -var domain=terra2 -var "image_name=$IMAGE_NAME" -var "image_visibility=$IMAGE_VISIBILITY" -var "floating_ip=$ip")
+    - terraform apply "${args[@]}"
     - eval $(ssh-agent -s)
     - ssh-add ./ssh-key.terra2.txt
-    - ssh -o PreferredAuthentications=publickey deployadm@$ip "sudo -u debian sh -c 'cd; ~deployadm/terraform/image/tests/run-tests.sh'"
-    - terraform destroy $args
-    - openstack floating ip delete $ip
+    - ssh -o PreferredAuthentications=publickey "deployadm@$ip" "sudo -u debian sh -c 'cd; ~deployadm/terraform/image/tests/run-tests.sh'"
+    - terraform destroy "${args[@]}"
+    - openstack floating ip delete "$ip"
     - rm -fv ip.txt
   rules:
     - if: '$JOB =~ /all|test-cluster/'