diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 7ed1d46c0c..6d9cfd4530 100755
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -11,13 +11,15 @@ rust/              @rapidsai/cuvs-rust-codeowners
 docs/              @rapidsai/cuvs-docs-codeowners
 
 #cmake code owners
-CMakeLists.txt     @rapidsai/cuvs-cmake-codeowners
-**/cmake/          @rapidsai/cuvs-cmake-codeowners
-*.cmake            @rapidsai/cuvs-cmake-codeowners
+CMakeLists.txt                  @rapidsai/cuvs-cmake-codeowners
+**/cmake/                       @rapidsai/cuvs-cmake-codeowners
+*.cmake                         @rapidsai/cuvs-cmake-codeowners
+cpp/scripts/run-cmake-format.sh @rapidsai/cuvs-cmake-codeowners
 
 #CI code owners
 /.github/                @rapidsai/ci-codeowners
 /ci/                     @rapidsai/ci-codeowners
+/.shellcheckrc           @rapidsai/ci-codeowners
 
 #packaging code owners
 /.pre-commit-config.yaml @rapidsai/packaging-codeowners
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index f2a9f578b8..a45573a791 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -128,7 +128,6 @@ repos:
         rev: v0.10.0.1
         hooks:
           - id: shellcheck
-            args: ["--severity=warning"]
 
 default_language_version:
       python: python3
diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 0000000000..b57b9d1962
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,2 @@
+# Disable file checks (otherwise every use of `gha-tools` will get flagged)
+disable=SC1091
diff --git a/build.sh b/build.sh
index 6af2907a4e..2caec74ca7 100755
--- a/build.sh
+++ b/build.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright (c) 2020-2024, NVIDIA CORPORATION.
+# Copyright (c) 2020-2025, NVIDIA CORPORATION.
 
 # cuvs build scripts
 
@@ -88,75 +88,78 @@ BUILD_SHARED_LIBS=ON
 TEST_TARGETS=""
 ANN_BENCH_TARGETS=""
 
-CACHE_ARGS=""
+CACHE_ARGS=()
 NVTX=ON
 LOG_COMPILE_TIME=OFF
 CLEAN=0
 DISABLE_DEPRECATION_WARNINGS=ON
-CMAKE_TARGET=""
+CMAKE_TARGET=()
 EXTRA_CMAKE_ARGS=""
 
 # Set defaults for vars that may not have been defined externally
 INSTALL_PREFIX=${INSTALL_PREFIX:=${PREFIX:=${CONDA_PREFIX:=$LIBCUVS_BUILD_DIR/install}}}
-PARALLEL_LEVEL=${PARALLEL_LEVEL:=`nproc`}
+PARALLEL_LEVEL=${PARALLEL_LEVEL:=$(nproc)}
 BUILD_ABI=${BUILD_ABI:=ON}
 
 # Default to Ninja if generator is not specified
 export CMAKE_GENERATOR="${CMAKE_GENERATOR:=Ninja}"
 
 function hasArg {
-    (( ${NUMARGS} != 0 )) && (echo " ${ARGS} " | grep -q " $1 ")
+    (( NUMARGS != 0 )) && (echo " ${ARGS} " | grep -q " $1 ")
 }
 
 function cmakeArgs {
     # Check for multiple cmake args options
-    if [[ $(echo $ARGS | { grep -Eo "\-\-cmake\-args" || true; } | wc -l ) -gt 1 ]]; then
+    if [[ $(echo "$ARGS" | { grep -Eo "\-\-cmake\-args" || true; } | wc -l ) -gt 1 ]]; then
         echo "Multiple --cmake-args options were provided, please provide only one: ${ARGS}"
         exit 1
     fi
 
     # Check for cmake args option
-    if [[ -n $(echo $ARGS | { grep -E "\-\-cmake\-args" || true; } ) ]]; then
+    if [[ -n $(echo "$ARGS" | { grep -E "\-\-cmake\-args" || true; } ) ]]; then
         # There are possible weird edge cases that may cause this regex filter to output nothing and fail silently
         # the true pipe will catch any weird edge cases that may happen and will cause the program to fall back
         # on the invalid option error
-        EXTRA_CMAKE_ARGS=$(echo $ARGS | { grep -Eo "\-\-cmake\-args=\".+\"" || true; })
+        EXTRA_CMAKE_ARGS=$(echo "$ARGS" | { grep -Eo "\-\-cmake\-args=\".+\"" || true; })
         if [[ -n ${EXTRA_CMAKE_ARGS} ]]; then
             # Remove the full  EXTRA_CMAKE_ARGS argument from list of args so that it passes validArgs function
             ARGS=${ARGS//$EXTRA_CMAKE_ARGS/}
             # Filter the full argument down to just the extra string that will be added to cmake call
-            EXTRA_CMAKE_ARGS=$(echo $EXTRA_CMAKE_ARGS | grep -Eo "\".+\"" | sed -e 's/^"//' -e 's/"$//')
+            EXTRA_CMAKE_ARGS=$(echo "$EXTRA_CMAKE_ARGS" | grep -Eo "\".+\"" | sed -e 's/^"//' -e 's/"$//')
         fi
     fi
+    read -ra EXTRA_CMAKE_ARGS <<< "$EXTRA_CMAKE_ARGS"
 }
 
 function cacheTool {
     # Check for multiple cache options
-    if [[ $(echo $ARGS | { grep -Eo "\-\-cache\-tool" || true; } | wc -l ) -gt 1 ]]; then
+    if [[ $(echo "$ARGS" | { grep -Eo "\-\-cache\-tool" || true; } | wc -l ) -gt 1 ]]; then
         echo "Multiple --cache-tool options were provided, please provide only one: ${ARGS}"
         exit 1
     fi
     # Check for cache tool option
-    if [[ -n $(echo $ARGS | { grep -E "\-\-cache\-tool" || true; } ) ]]; then
+    if [[ -n $(echo "$ARGS" | { grep -E "\-\-cache\-tool" || true; } ) ]]; then
         # There are possible weird edge cases that may cause this regex filter to output nothing and fail silently
         # the true pipe will catch any weird edge cases that may happen and will cause the program to fall back
         # on the invalid option error
-        CACHE_TOOL=$(echo $ARGS | sed -e 's/.*--cache-tool=//' -e 's/ .*//')
+        CACHE_TOOL=$(echo "$ARGS" | sed -e 's/.*--cache-tool=//' -e 's/ .*//')
         if [[ -n ${CACHE_TOOL} ]]; then
             # Remove the full CACHE_TOOL argument from list of args so that it passes validArgs function
             ARGS=${ARGS//--cache-tool=$CACHE_TOOL/}
-            CACHE_ARGS="-DCMAKE_CUDA_COMPILER_LAUNCHER=${CACHE_TOOL} -DCMAKE_C_COMPILER_LAUNCHER=${CACHE_TOOL} -DCMAKE_CXX_COMPILER_LAUNCHER=${CACHE_TOOL}"
+            CACHE_ARGS=("-DCMAKE_CUDA_COMPILER_LAUNCHER=${CACHE_TOOL}"
+                        "-DCMAKE_C_COMPILER_LAUNCHER=${CACHE_TOOL}"
+                        "-DCMAKE_CXX_COMPILER_LAUNCHER=${CACHE_TOOL}")
         fi
     fi
 }
 
 function limitTests {
     # Check for option to limit the set of test binaries to build
-    if [[ -n $(echo $ARGS | { grep -E "\-\-limit\-tests" || true; } ) ]]; then
+    if [[ -n $(echo "$ARGS" | { grep -E "\-\-limit\-tests" || true; } ) ]]; then
         # There are possible weird edge cases that may cause this regex filter to output nothing and fail silently
         # the true pipe will catch any weird edge cases that may happen and will cause the program to fall back
         # on the invalid option error
-        LIMIT_TEST_TARGETS=$(echo $ARGS | sed -e 's/.*--limit-tests=//' -e 's/ .*//')
+        LIMIT_TEST_TARGETS=$(echo "$ARGS" | sed -e 's/.*--limit-tests=//' -e 's/ .*//')
         if [[ -n ${LIMIT_TEST_TARGETS} ]]; then
             # Remove the full LIMIT_TEST_TARGETS argument from list of args so that it passes validArgs function
             ARGS=${ARGS//--limit-tests=$LIMIT_TEST_TARGETS/}
@@ -168,11 +171,11 @@ function limitTests {
 
 function limitAnnBench {
     # Check for option to limit the set of test binaries to build
-    if [[ -n $(echo $ARGS | { grep -E "\-\-limit\-bench-ann" || true; } ) ]]; then
+    if [[ -n $(echo "$ARGS" | { grep -E "\-\-limit\-bench-ann" || true; } ) ]]; then
         # There are possible weird edge cases that may cause this regex filter to output nothing and fail silently
         # the true pipe will catch any weird edge cases that may happen and will cause the program to fall back
         # on the invalid option error
-        LIMIT_ANN_BENCH_TARGETS=$(echo $ARGS | sed -e 's/.*--limit-bench-ann=//' -e 's/ .*//')
+        LIMIT_ANN_BENCH_TARGETS=$(echo "$ARGS" | sed -e 's/.*--limit-bench-ann=//' -e 's/ .*//')
         if [[ -n ${LIMIT_ANN_BENCH_TARGETS} ]]; then
             # Remove the full LIMIT_TEST_TARGETS argument from list of args so that it passes validArgs function
             ARGS=${ARGS//--limit-bench-ann=$LIMIT_ANN_BENCH_TARGETS/}
@@ -183,16 +186,16 @@ function limitAnnBench {
 
 function buildMetrics {
     # Check for multiple build-metrics options
-    if [[ $(echo $ARGS | { grep -Eo "\-\-build\-metrics" || true; } | wc -l ) -gt 1 ]]; then
+    if [[ $(echo "$ARGS" | { grep -Eo "\-\-build\-metrics" || true; } | wc -l ) -gt 1 ]]; then
         echo "Multiple --build-metrics options were provided, please provide only one: ${ARGS}"
         exit 1
     fi
     # Check for build-metrics option
-    if [[ -n $(echo $ARGS | { grep -E "\-\-build\-metrics" || true; } ) ]]; then
+    if [[ -n $(echo "$ARGS" | { grep -E "\-\-build\-metrics" || true; } ) ]]; then
         # There are possible weird edge cases that may cause this regex filter to output nothing and fail silently
         # the true pipe will catch any weird edge cases that may happen and will cause the program to fall back
         # on the invalid option error
-        BUILD_REPORT_METRICS=$(echo $ARGS | sed -e 's/.*--build-metrics=//' -e 's/ .*//')
+        BUILD_REPORT_METRICS=$(echo "$ARGS" | sed -e 's/.*--build-metrics=//' -e 's/ .*//')
         if [[ -n ${BUILD_REPORT_METRICS} ]]; then
             # Remove the full BUILD_REPORT_METRICS argument from list of args so that it passes validArgs function
             ARGS=${ARGS//--build-metrics=$BUILD_REPORT_METRICS/}
@@ -202,7 +205,7 @@ function buildMetrics {
 
 function gpuArch {
     # Check if both --gpu-arch and --allgpuarch are specified
-    if hasArg --allgpuarch && [[ -n $(echo $ARGS | { grep -E "\-\-gpu\-arch" || true; } ) ]]; then
+    if hasArg --allgpuarch && [[ -n $(echo "$ARGS" | { grep -E "\-\-gpu\-arch" || true; } ) ]]; then
         echo "Error: Cannot specify both --gpu-arch and --allgpuarch"
         echo "Use either:"
         echo "  --gpu-arch=\"80-real;90-real\"    (for specific architectures)"
@@ -211,7 +214,7 @@ function gpuArch {
     fi
 
     # Check for multiple gpu-arch options
-    if [[ $(echo $ARGS | { grep -Eo "\-\-gpu\-arch" || true; } | wc -l ) -gt 1 ]]; then
+    if [[ $(echo "$ARGS" | { grep -Eo "\-\-gpu\-arch" || true; } | wc -l ) -gt 1 ]]; then
         echo "Error: Multiple --gpu-arch options were provided. Please combine architectures into a single option."
         echo "Instead of: --gpu-arch=80-real --gpu-arch=90-real"
         echo "Use:       --gpu-arch=\"80-real;90-real\""
@@ -219,13 +222,13 @@ function gpuArch {
     fi
 
     # Check for gpu-arch option
-    if [[ -n $(echo $ARGS | { grep -E "\-\-gpu\-arch" || true; } ) ]]; then
-        GPU_ARCH_ARG=$(echo $ARGS | { grep -Eo "\-\-gpu\-arch=.+( |$)" || true; })
+    if [[ -n $(echo "$ARGS" | { grep -E "\-\-gpu\-arch" || true; } ) ]]; then
+        GPU_ARCH_ARG=$(echo "$ARGS" | { grep -Eo "\-\-gpu\-arch=.+( |$)" || true; })
         if [[ -n ${GPU_ARCH_ARG} ]]; then
             # Remove the full argument from ARGS
             ARGS=${ARGS//$GPU_ARCH_ARG/}
             # Extract just the architecture value
-            CUVS_CMAKE_CUDA_ARCHITECTURES=$(echo $GPU_ARCH_ARG | sed -e 's/--gpu-arch=//' -e 's/ .*//')
+            CUVS_CMAKE_CUDA_ARCHITECTURES=$(echo "$GPU_ARCH_ARG" | sed -e 's/--gpu-arch=//' -e 's/ .*//')
             echo "Building for specified GPU architectures: ${CUVS_CMAKE_CUDA_ARCHITECTURES}"
         fi
     fi
@@ -237,7 +240,7 @@ if hasArg -h || hasArg --help; then
 fi
 
 # Check for valid usage
-if (( ${NUMARGS} != 0 )); then
+if (( NUMARGS != 0 )); then
     cmakeArgs
     cacheTool
     limitTests
@@ -255,18 +258,20 @@ fi
 # This should run before build/install
 if hasArg --uninstall; then
 
-    if hasArg cuvs || hasArg libcuvs || (( ${NUMARGS} == 1 )); then
+    if hasArg cuvs || hasArg libcuvs || (( NUMARGS == 1 )); then
 
       echo "Removing libcuvs files..."
-      if [ -e ${LIBCUVS_BUILD_DIR}/install_manifest.txt ]; then
-          xargs rm -fv < ${LIBCUVS_BUILD_DIR}/install_manifest.txt > /dev/null 2>&1
+      if [ -e "${LIBCUVS_BUILD_DIR}"/install_manifest.txt ]; then
+          xargs rm -fv < "${LIBCUVS_BUILD_DIR}"/install_manifest.txt > /dev/null 2>&1
       fi
     fi
 
-    if hasArg cuvs || (( ${NUMARGS} == 1 )); then
+    if hasArg cuvs || (( NUMARGS == 1 )); then
       echo "Uninstalling cuvs package..."
-      if [ -e ${PYLIBCUVS_BUILD_DIR}/install_manifest.txt ]; then
-          xargs rm -fv < ${PYLIBCUVS_BUILD_DIR}/install_manifest.txt > /dev/null 2>&1
+      # PYLIBCUVS_BUILD_DIR isn't defined in `build.sh` but maybe defined by user
+      # shellcheck disable=SC2153
+      if [ -e "${PYLIBCUVS_BUILD_DIR}"/install_manifest.txt ]; then
+          xargs rm -fv < "${PYLIBCUVS_BUILD_DIR}"/install_manifest.txt > /dev/null 2>&1
       fi
 
       # Try to uninstall via pip if it is installed
@@ -305,18 +310,18 @@ if hasArg --no-mg; then
     BUILD_MG_ALGOS=OFF
 fi
 
-if hasArg tests || (( ${NUMARGS} == 0 )); then
+if hasArg tests || (( NUMARGS == 0 )); then
     BUILD_TESTS=ON
-    CMAKE_TARGET="${CMAKE_TARGET};${TEST_TARGETS}"
+    CMAKE_TARGET+=("${TEST_TARGETS}")
 fi
 
-if hasArg bench-ann || (( ${NUMARGS} == 0 )); then
+if hasArg bench-ann || (( NUMARGS == 0 )); then
     BUILD_CUVS_BENCH=ON
     if ! hasArg tests; then
         BUILD_TESTS=OFF
     fi
     COMPILE_LIBRARY=OFF
-    CMAKE_TARGET="${CMAKE_TARGET};${ANN_BENCH_TARGETS}"
+    CMAKE_TARGET+=("${ANN_BENCH_TARGETS}")
     if hasArg --cpu-only; then
         BUILD_CPU_ONLY=ON
         BUILD_SHARED_LIBS=OFF
@@ -345,20 +350,20 @@ if hasArg --incl-cache-stats; then
     BUILD_REPORT_INCL_CACHE_STATS=ON
 fi
 
-if [[ ${CMAKE_TARGET} == "" ]]; then
-    CMAKE_TARGET="all"
+if [[ ${#CMAKE_TARGET} -eq 0 ]]; then
+    CMAKE_TARGET=("all")
 fi
 
 # If clean given, run it prior to any other steps
-if (( ${CLEAN} == 1 )); then
+if (( CLEAN == 1 )); then
     # If the dirs to clean are mounted dirs in a container, the
     # contents should be removed but the mounted dirs will remain.
     # The find removes all contents but leaves the dirs, the rmdir
     # attempts to remove the dirs but can fail safely.
     for bd in ${BUILD_DIRS}; do
-      if [ -d ${bd} ]; then
-          find ${bd} -mindepth 1 -delete
-          rmdir ${bd} || true
+      if [ -d "${bd}" ]; then
+          find "${bd}" -mindepth 1 -delete
+          rmdir "${bd}" || true
       fi
     done
 fi
@@ -367,15 +372,13 @@ fi
 # Configure for building all C++ targets
 if (( NUMARGS == 0 )) || hasArg libcuvs || hasArg docs || hasArg tests || hasArg bench-prims || hasArg bench-ann; then
     COMPILE_LIBRARY=ON
-    if (( ${BUILD_SHARED_LIBS} == "OFF" )); then
-        CMAKE_TARGET="${CMAKE_TARGET};"
-    else
-        CMAKE_TARGET="${CMAKE_TARGET};cuvs"
+    if [[ "${BUILD_SHARED_LIBS}" != "OFF" ]]; then
+        CMAKE_TARGET+=("cuvs")
     fi
 
     # get the current count before the compile starts
     CACHE_TOOL=${CACHE_TOOL:-sccache}
-    if [[ "$BUILD_REPORT_INCL_CACHE_STATS" == "ON" && -x "$(command -v ${CACHE_TOOL})" ]]; then
+    if [[ "$BUILD_REPORT_INCL_CACHE_STATS" == "ON" && -x "$(command -v "${CACHE_TOOL}")" ]]; then
         "${CACHE_TOOL}" --zero-stats
     fi
 
@@ -390,11 +393,11 @@ if (( NUMARGS == 0 )) || hasArg libcuvs || hasArg docs || hasArg tests || hasArg
         fi
     fi
 
-    mkdir -p ${LIBCUVS_BUILD_DIR}
-    cd ${LIBCUVS_BUILD_DIR}
-    cmake -S ${REPODIR}/cpp -B ${LIBCUVS_BUILD_DIR} \
-          -DCMAKE_INSTALL_PREFIX=${INSTALL_PREFIX} \
-          -DCMAKE_CUDA_ARCHITECTURES=${CUVS_CMAKE_CUDA_ARCHITECTURES} \
+    mkdir -p "${LIBCUVS_BUILD_DIR}"
+    cd "${LIBCUVS_BUILD_DIR}"
+    cmake -S "${REPODIR}"/cpp -B "${LIBCUVS_BUILD_DIR}" \
+          -DCMAKE_INSTALL_PREFIX="${INSTALL_PREFIX}" \
+          -DCMAKE_CUDA_ARCHITECTURES="${CUVS_CMAKE_CUDA_ARCHITECTURES}" \
           -DCMAKE_BUILD_TYPE=${BUILD_TYPE} \
           -DBUILD_C_LIBRARY=${COMPILE_LIBRARY} \
           -DCUVS_NVTX=${NVTX} \
@@ -402,21 +405,21 @@ if (( NUMARGS == 0 )) || hasArg libcuvs || hasArg docs || hasArg tests || hasArg
           -DDISABLE_DEPRECATION_WARNINGS=${DISABLE_DEPRECATION_WARNINGS} \
           -DBUILD_TESTS=${BUILD_TESTS} \
           -DBUILD_C_TESTS=${BUILD_TESTS} \
-          -DBUILD_CUVS_BENCH=${BUILD_CUVS_BENCH} \
-          -DBUILD_CPU_ONLY=${BUILD_CPU_ONLY} \
+          -DBUILD_CUVS_BENCH="${BUILD_CUVS_BENCH}" \
+          -DBUILD_CPU_ONLY="${BUILD_CPU_ONLY}" \
           -DBUILD_MG_ALGOS=${BUILD_MG_ALGOS} \
           -DCMAKE_MESSAGE_LOG_LEVEL=${CMAKE_LOG_LEVEL} \
           -DBUILD_SHARED_LIBS=${BUILD_SHARED_LIBS} \
-          ${CACHE_ARGS} \
-          ${EXTRA_CMAKE_ARGS}
+          "${CACHE_ARGS[@]}" \
+          "${EXTRA_CMAKE_ARGS[@]}"
 
   compile_start=$(date +%s)
-  if [[ ${CMAKE_TARGET} != "" ]]; then
-      echo "-- Compiling targets: ${CMAKE_TARGET}, verbose=${VERBOSE_FLAG}"
+  if [[ ${#CMAKE_TARGET} -ne 0 ]]; then
+      echo "-- Compiling targets: " "${CMAKE_TARGET[@]}" ", verbose=${VERBOSE_FLAG}"
       if [[ ${INSTALL_TARGET} != "" ]]; then
-        cmake --build  "${LIBCUVS_BUILD_DIR}" ${VERBOSE_FLAG} -j${PARALLEL_LEVEL} --target ${CMAKE_TARGET} ${INSTALL_TARGET}
+        cmake --build  "${LIBCUVS_BUILD_DIR}" ${VERBOSE_FLAG} -j"${PARALLEL_LEVEL}" --target "${CMAKE_TARGET[@]// /;}" ${INSTALL_TARGET}
       else
-        cmake --build  "${LIBCUVS_BUILD_DIR}" ${VERBOSE_FLAG} -j${PARALLEL_LEVEL} --target ${CMAKE_TARGET}
+        cmake --build  "${LIBCUVS_BUILD_DIR}" ${VERBOSE_FLAG} -j"${PARALLEL_LEVEL}" --target "${CMAKE_TARGET[@]// /;}"
       fi
   fi
   compile_end=$(date +%s)
@@ -439,7 +442,7 @@ if (( NUMARGS == 0 )) || hasArg libcuvs || hasArg docs || hasArg tests || hasArg
               MSG="${MSG}<br/>cache hit rate ${HIT_RATE} %"
           elif [[ ${CACHE_TOOL} == "ccache" && -x "$(command -v ccache)" ]]; then
               CACHE_STATS_LINE=$(ccache -s | grep "Hits: \+ [0-9]\+ / [0-9]\+" | tail -n1)
-              if [[ ! -z "$CACHE_STATS_LINE" ]]; then
+              if [[ -n "$CACHE_STATS_LINE" ]]; then
                   CACHE_HITS=$(echo "$CACHE_STATS_LINE" - | awk '{ print $2 }')
                   COMPILE_REQUESTS=$(echo "$CACHE_STATS_LINE" - | awk '{ print $4 }')
                   HIT_RATE=$(COMPILE_REQUESTS="${COMPILE_REQUESTS}" CACHE_HITS="${CACHE_HITS}" python3 -c "import os; print(f'{int(os.getenv(\"CACHE_HITS\")) / int(os.getenv(\"COMPILE_REQUESTS\")):.2f}' if int(os.getenv(\"COMPILE_REQUESTS\")) else 'nan')")
@@ -450,53 +453,53 @@ if (( NUMARGS == 0 )) || hasArg libcuvs || hasArg docs || hasArg tests || hasArg
       MSG="${MSG}<br/>parallel setting: $PARALLEL_LEVEL"
       MSG="${MSG}<br/>parallel build time: $compile_total seconds"
       if [[ -f "${LIBCUVS_BUILD_DIR}/libcuvs.so" ]]; then
-          LIBCUVS_FS=$(stat -c %s ${LIBCUVS_BUILD_DIR}/libcuvs.so | awk '{printf "%.2f MB", $1/1024/1024}')
+          LIBCUVS_FS=$(find "${LIBCUVS_BUILD_DIR}" -name libcuvs.so -printf '%s'| awk '{printf "%.2f MB", $1/1024/1024}')
           MSG="${MSG}<br/>libcuvs.so size: $LIBCUVS_FS"
       fi
       BMR_DIR=${RAPIDS_ARTIFACTS_DIR:-"${LIBCUVS_BUILD_DIR}"}
       echo "The HTML report can be found at [${BMR_DIR}/${BUILD_REPORT_METRICS}.html]. In CI, this report"
       echo "will also be uploaded to the appropriate subdirectory of https://downloads.rapids.ai/ci/cuvs/, and"
       echo "the entire URL can be found in \"conda-cpp-build\" runs under the task \"Upload additional artifacts\""
-      mkdir -p ${BMR_DIR}
+      mkdir -p "${BMR_DIR}"
       MSG_OUTFILE="$(mktemp)"
       echo "$MSG" > "${MSG_OUTFILE}"
-      PATH=".:$PATH" python rapids-build-metrics-reporter.py ${LIBCUVS_BUILD_DIR}/.ninja_log --fmt html --msg "${MSG_OUTFILE}" > ${BMR_DIR}/${BUILD_REPORT_METRICS}.html
-      cp ${LIBCUVS_BUILD_DIR}/.ninja_log ${BMR_DIR}/ninja.log
+      PATH=".:$PATH" python rapids-build-metrics-reporter.py "${LIBCUVS_BUILD_DIR}"/.ninja_log --fmt html --msg "${MSG_OUTFILE}" > "${BMR_DIR}"/"${BUILD_REPORT_METRICS}".html
+      cp "${LIBCUVS_BUILD_DIR}"/.ninja_log "${BMR_DIR}"/ninja.log
   fi
 fi
 
 # Build and (optionally) install the cuvs Python package
-if (( ${NUMARGS} == 0 )) || hasArg python; then
-    SKBUILD_CMAKE_ARGS="${EXTRA_CMAKE_ARGS}" \
+if (( NUMARGS == 0 )) || hasArg python; then
+    SKBUILD_CMAKE_ARGS="${EXTRA_CMAKE_ARGS[*]}" \
         SKBUILD_BUILD_OPTIONS="-j${PARALLEL_LEVEL}" \
-        python -m pip install --no-build-isolation --no-deps --config-settings rapidsai.disable-cuda=true ${REPODIR}/python/cuvs
+        python -m pip install --no-build-isolation --no-deps --config-settings rapidsai.disable-cuda=true "${REPODIR}"/python/cuvs
 fi
 
 # Build and (optionally) install the cuvs-bench Python package
 if (( NUMARGS == 0 )) || (hasArg bench-ann && ! hasArg -n); then
-    python -m pip install --no-build-isolation --no-deps --config-settings rapidsai.disable-cuda=true ${REPODIR}/python/cuvs_bench
+    python -m pip install --no-build-isolation --no-deps --config-settings rapidsai.disable-cuda=true "${REPODIR}"/python/cuvs_bench
 fi
 
 # Build the cuvs Rust bindings
-if (( ${NUMARGS} == 0 )) || hasArg rust; then
-    cd ${REPODIR}/rust
+if (( NUMARGS == 0 )) || hasArg rust; then
+    cd "${REPODIR}"/rust
     cargo build --examples --lib
     cargo test
 fi
 
 # Build the cuvs Go bindings
-if (( ${NUMARGS} == 0 )) || hasArg go; then
-    cd ${REPODIR}/go
+if (( NUMARGS == 0 )) || hasArg go; then
+    cd "${REPODIR}"/go
     go build ./...
     go test ./...
 fi
 
 # Build the cuvs Java bindings
-if (( ${NUMARGS} == 0 )) || hasArg java; then
+if (( NUMARGS == 0 )) || hasArg java; then
     if ! hasArg libcuvs; then
         echo "Please add 'libcuvs' to this script's arguments (ex. './build.sh libcuvs java') if libcuvs libraries are not already built"
     fi
-    cd ${REPODIR}/java
+    cd "${REPODIR}"/java
     if hasArg --run-java-tests; then
         ./build.sh --run-java-tests
     else
@@ -511,20 +514,20 @@ export RAPIDS_VERSION_MAJOR_MINOR
 
 if hasArg docs; then
     set -x
-    cd ${DOXYGEN_BUILD_DIR}
+    cd "${DOXYGEN_BUILD_DIR}"
     doxygen Doxyfile
-    cd ${SPHINX_BUILD_DIR}
+    cd "${SPHINX_BUILD_DIR}"
     sphinx-build -b html source _html
-    cd ${REPODIR}/rust
+    cd "${REPODIR}"/rust
     cargo doc -p cuvs --no-deps
-    rsync -av ${RUST_BUILD_DIR}/doc/ ${SPHINX_BUILD_DIR}/_html/_static/rust
+    rsync -av "${RUST_BUILD_DIR}"/doc/ "${SPHINX_BUILD_DIR}"/_html/_static/rust
 fi
 
 ################################################################################
 # Initiate build for c++ examples (if needed)
 
 if hasArg examples; then
-    pushd ${REPODIR}/examples
+    pushd "${REPODIR}"/examples
     ./build.sh
     popd
 fi
diff --git a/ci/checks/black_lists.sh b/ci/checks/black_lists.sh
index ed9f3745b2..e255ca7479 100755
--- a/ci/checks/black_lists.sh
+++ b/ci/checks/black_lists.sh
@@ -1,12 +1,12 @@
 #!/bin/bash
-# Copyright (c) 2020-2023, NVIDIA CORPORATION.
+# Copyright (c) 2020-2025, NVIDIA CORPORATION.
 ##########################################
 # RAFT black listed function call Tester #
 ##########################################
 
 # PR_TARGET_BRANCH is set by the CI environment
 
-git checkout --quiet $PR_TARGET_BRANCH
+git checkout --quiet "$PR_TARGET_BRANCH"
 
 # Switch back to tip of PR branch
 git checkout --quiet current-pr-branch
diff --git a/cpp/scripts/run-cmake-format.sh b/cpp/scripts/run-cmake-format.sh
index 5438a6a932..8d4d806199 100755
--- a/cpp/scripts/run-cmake-format.sh
+++ b/cpp/scripts/run-cmake-format.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright (c) 2022-2023, NVIDIA CORPORATION.
+# Copyright (c) 2022-2025, NVIDIA CORPORATION.
 
 # This script is a wrapper for cmakelang that may be used with pre-commit. The
 # wrapping is necessary because RAPIDS libraries split configuration for
@@ -38,7 +38,7 @@ if ! [ ${status} -eq 0 ]; then
         echo "This script must be run inside the raft repository, or the RAFT_ROOT environment variable must be set."
     else
         echo "Script failed with unknown error attempting to determine project root:"
-        echo ${RAFT_BUILD_DIR}
+        echo "${RAFT_BUILD_DIR}"
     fi
     exit 1
 fi
@@ -49,7 +49,7 @@ DEFAULT_FORMAT_FILE_LOCATIONS=(
 
 if [ -z ${RAPIDS_CMAKE_FORMAT_FILE:+PLACEHOLDER} ]; then
     for file_path in "${DEFAULT_FORMAT_FILE_LOCATIONS[@]}"; do
-        if [ -f ${file_path} ]; then
+        if [ -f "${file_path}" ]; then
             RAPIDS_CMAKE_FORMAT_FILE=${file_path}
             break
         fi
@@ -68,12 +68,12 @@ else
 fi
 
 if [[ $1 == "cmake-format" ]]; then
-  cmake-format -i --config-files cpp/cmake/config.json ${RAPIDS_CMAKE_FORMAT_FILE} -- "${@:2}"
+  cmake-format -i --config-files cpp/cmake/config.json "${RAPIDS_CMAKE_FORMAT_FILE}" -- "${@:2}"
 elif [[ $1 == "cmake-lint" ]]; then
   # Since the pre-commit hook is verbose, we have to be careful to only
   # present cmake-lint's output (which is quite verbose) if we actually
   # observe a failure.
-  OUTPUT=$(cmake-lint --config-files cpp/cmake/config.json ${RAPIDS_CMAKE_FORMAT_FILE} -- "${@:2}")
+  OUTPUT=$(cmake-lint --config-files cpp/cmake/config.json "${RAPIDS_CMAKE_FORMAT_FILE}" -- "${@:2}")
   status=$?
 
   if ! [ ${status} -eq 0 ]; then
diff --git a/examples/build.sh b/examples/build.sh
index 434cdcd5a3..3f304cfae4 100755
--- a/examples/build.sh
+++ b/examples/build.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright (c) 2023-2024, NVIDIA CORPORATION.
+# Copyright (c) 2023-2025, NVIDIA CORPORATION.
 
 # cuvs empty project template build script
 
@@ -11,7 +11,7 @@ NUMARGS=$#
 ARGS=$*
 
 function hasArg {
-    (( ${NUMARGS} != 0 )) && (echo " ${ARGS} " | grep -q " $1 ")
+    (( NUMARGS != 0 )) && (echo " ${ARGS} " | grep -q " $1 ")
 }
 
 if hasArg clean; then
@@ -22,7 +22,7 @@ fi
 
 function gpuArch {
 
-    if hasArg --allgpuarch && [[ -n $(echo $ARGS | { grep -E "\-\-gpu\-arch" || true; } ) ]]; then
+    if hasArg --allgpuarch && [[ -n $(echo "$ARGS" | { grep -E "\-\-gpu\-arch" || true; } ) ]]; then
         echo "Error: Cannot specify both --gpu-arch and --allgpuarch"
         echo "Use either:"
         echo "  --gpu-arch=\"80-real;90-real\"    (for specific architectures)"
@@ -30,18 +30,18 @@ function gpuArch {
         exit 1
     fi
 
-    if [[ $(echo $ARGS | { grep -Eo "\-\-gpu\-arch" || true; } | wc -l ) -gt 1 ]]; then
+    if [[ $(echo "$ARGS" | { grep -Eo "\-\-gpu\-arch" || true; } | wc -l ) -gt 1 ]]; then
         echo "Error: Multiple --gpu-arch options were provided. Please combine architectures into a single option."
         echo "Instead of: --gpu-arch=80-real --gpu-arch=90-real"
         echo "Use:       --gpu-arch=\"80-real;90-real\""
         exit 1
     fi
 
-    if [[ -n $(echo $ARGS | { grep -E "\-\-gpu\-arch" || true; } ) ]]; then
-        GPU_ARCH_ARG=$(echo $ARGS | { grep -Eo "\-\-gpu\-arch=.+( |$)" || true; })
+    if [[ -n $(echo "$ARGS" | { grep -E "\-\-gpu\-arch" || true; } ) ]]; then
+        GPU_ARCH_ARG=$(echo "$ARGS" | { grep -Eo "\-\-gpu\-arch=.+( |$)" || true; })
         if [[ -n ${GPU_ARCH_ARG} ]]; then
             # Extract just the architecture value
-            echo ${GPU_ARCH_ARG} | sed -e 's/--gpu-arch=//' -e 's/ .*//'
+            echo "${GPU_ARCH_ARG}" | sed -e 's/--gpu-arch=//' -e 's/ .*//'
             return
         fi
     fi
@@ -57,10 +57,10 @@ function gpuArch {
 }
 
 # Set up build configuration
-PARALLEL_LEVEL=${PARALLEL_LEVEL:=`nproc`}
+PARALLEL_LEVEL=${PARALLEL_LEVEL:=$(nproc)}
 BUILD_TYPE=Release
 CUVS_REPO_REL=""
-EXTRA_CMAKE_ARGS=""
+EXTRA_CMAKE_ARGS=()
 
 
 CUVS_CMAKE_CUDA_ARCHITECTURES=$(gpuArch)
@@ -74,11 +74,11 @@ esac
 EXAMPLES_DIR=$(dirname "$(realpath "$0")")
 
 if [[ ${CUVS_REPO_REL} != "" ]]; then
-  CUVS_REPO_PATH="`readlink -f \"${CUVS_REPO_REL}\"`"
-  EXTRA_CMAKE_ARGS="${EXTRA_CMAKE_ARGS} -DCPM_cuvs_SOURCE=${CUVS_REPO_PATH}"
+  CUVS_REPO_PATH=$(readlink -f "${CUVS_REPO_REL}")
+  EXTRA_CMAKE_ARGS+=("-DCPM_cuvs_SOURCE=${CUVS_REPO_PATH}")
 else
   LIB_BUILD_DIR=${LIB_BUILD_DIR:-$(readlink -f "${EXAMPLES_DIR}/../cpp/build")}
-  EXTRA_CMAKE_ARGS="${EXTRA_CMAKE_ARGS} -Dcuvs_ROOT=${LIB_BUILD_DIR}"
+  EXTRA_CMAKE_ARGS+=("-Dcuvs_ROOT=${LIB_BUILD_DIR}")
 fi
 
 ################################################################################
@@ -90,14 +90,14 @@ build_example() {
   build_dir="${example_dir}/build"
 
   # Configure
-  cmake -S ${example_dir} -B ${build_dir} \
+  cmake -S "${example_dir}" -B "${build_dir}" \
   -DCMAKE_BUILD_TYPE=${BUILD_TYPE} \
   -DCUVS_NVTX=OFF \
-  -DCMAKE_CUDA_ARCHITECTURES=${CUVS_CMAKE_CUDA_ARCHITECTURES} \
+  -DCMAKE_CUDA_ARCHITECTURES="${CUVS_CMAKE_CUDA_ARCHITECTURES}" \
   -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
-  ${EXTRA_CMAKE_ARGS}
+  "${EXTRA_CMAKE_ARGS[@]}"
   # Build
-  cmake --build ${build_dir} -j${PARALLEL_LEVEL}
+  cmake --build "${build_dir}" -j"${PARALLEL_LEVEL}"
 }
 
 build_example c
diff --git a/java/build.sh b/java/build.sh
index fb5796774a..a0577d48e4 100755
--- a/java/build.sh
+++ b/java/build.sh
@@ -1,11 +1,13 @@
 #!/bin/bash
 
+# Copyright (c) 2025, NVIDIA CORPORATION.
+
 set -e -u -o pipefail
 
 ARGS="$*"
 NUMARGS=$#
 
-CURDIR=$(cd "$(dirname $0)"; pwd)
+CURDIR=$(cd "$(dirname "$0")"; pwd)
 VERSION="25.08.0" # Note: The version is updated automatically when ci/release/update-version.sh is invoked
 GROUP_ID="com.nvidia.cuvs"
 
diff --git a/java/panama-bindings/generate-bindings.sh b/java/panama-bindings/generate-bindings.sh
index adcf49ce2b..b7e8ccb067 100755
--- a/java/panama-bindings/generate-bindings.sh
+++ b/java/panama-bindings/generate-bindings.sh
@@ -1,10 +1,12 @@
 #!/bin/bash
 
+# Copyright (c) 2025, NVIDIA CORPORATION.
+
 set -e -u -o pipefail
 
 echo "Starting Panama FFM API bindings generation ..."
-REPODIR=$(cd "$(dirname $0)"; cd ../../ ; pwd)
-CURDIR=$(cd "$(dirname $0)"; pwd)
+REPODIR=$(cd "$(dirname "$0")"; cd ../../ ; pwd)
+CURDIR=$(cd "$(dirname "$0")"; pwd)
 TARGET_PACKAGE="com.nvidia.cuvs.internal.panama"
 
 TARGET_DIR="targets/x86_64-linux/include"
@@ -17,7 +19,7 @@ else
   exit 1
 fi
 
-if [[ `command -v jextract` == "" ]];
+if [[ $(command -v jextract) == "" ]];
 then
   JEXTRACT_FILENAME="openjdk-22-jextract+6-47_linux-x64_bin.tar.gz"
   JEXTRACT_DOWNLOAD_URL="https://download.java.net/java/early_access/jextract/22/6/${JEXTRACT_FILENAME}"
@@ -31,12 +33,12 @@ fi
 
 # Use Jextract utility to generate panama bindings
 jextract \
- --include-dir ${REPODIR}/java/internal/build/_deps/dlpack-src/include/ \
- --include-dir ${CUDA_INCLUDE_DIR} \
- --include-dir ${REPODIR}/cpp/include \
+ --include-dir "${REPODIR}"/java/internal/build/_deps/dlpack-src/include/ \
+ --include-dir "${CUDA_INCLUDE_DIR}" \
+ --include-dir "${REPODIR}"/cpp/include \
  --output "${REPODIR}/java/cuvs-java/src/main/java22/" \
  --target-package ${TARGET_PACKAGE} \
  --library cuvs_c \
- ${CURDIR}/headers.h
+ "${CURDIR}"/headers.h
 
 echo "Panama FFM API bindings generation done"