diff --git a/letsencrypt_auto/letsencrypt-auto.template b/letsencrypt_auto/letsencrypt-auto.template
index f2b5267c1..07adef413 100755
--- a/letsencrypt_auto/letsencrypt-auto.template
+++ b/letsencrypt_auto/letsencrypt-auto.template
@@ -43,7 +43,7 @@ DeterminePythonVersion() {
     echo "Cannot find any Pythons... please install one!"
   fi
 
-  PYVER=`$LE_PYTHON --version 2>&1 | cut -d" " -f 2 | cut -d. -f1,2 | sed 's/\.//'`
+  PYVER=`"$LE_PYTHON" --version 2>&1 | cut -d" " -f 2 | cut -d. -f1,2 | sed 's/\.//'`
   if [ $PYVER -eq 26 ]; then
     ExperimentalBootstrap "Python 2.6"
   elif [ $PYVER -lt 26 ]; then
@@ -155,7 +155,7 @@ else
   SUDO=
 fi
 
-if [ ! -f $VENV_BIN/letsencrypt ]; then
+if [ ! -f "$VENV_BIN/letsencrypt" ]; then
   # If it looks like we've never bootstrapped before, bootstrap:
   Bootstrap
 fi
@@ -165,8 +165,8 @@ elif [ "$1" = "--no-self-upgrade" ]; then
   # Phase 2: Create venv, install LE, and run.
 
   shift 1  # the --no-self-upgrade arg
-  if [ -f $VENV_BIN/letsencrypt ]; then
-    INSTALLED_VERSION=$($VENV_BIN/letsencrypt --version 2>&1 | cut -d " " -f 2)
+  if [ -f "$VENV_BIN/letsencrypt" ]; then
+    INSTALLED_VERSION=$("$VENV_BIN/letsencrypt" --version 2>&1 | cut -d " " -f 2)
   else
     INSTALLED_VERSION="none"
   fi
@@ -177,28 +177,28 @@ elif [ "$1" = "--no-self-upgrade" ]; then
     DeterminePythonVersion
     rm -rf "$VENV_PATH"
     if [ "$VERBOSE" = 1 ]; then
-      virtualenv --no-site-packages --python $LE_PYTHON $VENV_PATH
+      virtualenv --no-site-packages --python "$LE_PYTHON" "$VENV_PATH"
     else
-      virtualenv --no-site-packages --python $LE_PYTHON $VENV_PATH > /dev/null
+      virtualenv --no-site-packages --python "$LE_PYTHON" "$VENV_PATH" > /dev/null
     fi
 
     echo "Installing Python packages..."
     TEMP_DIR=$(TempDir)
     # There is no $ interpolation due to quotes on heredoc delimiters.
     # -------------------------------------------------------------------------
-    cat << "UNLIKELY_EOF" > $TEMP_DIR/letsencrypt-auto-requirements.txt
+    cat << "UNLIKELY_EOF" > "$TEMP_DIR/letsencrypt-auto-requirements.txt"
 {{ letsencrypt-auto-requirements.txt }}
 UNLIKELY_EOF
     # -------------------------------------------------------------------------
-    cat << "UNLIKELY_EOF" > $TEMP_DIR/peep.py
+    cat << "UNLIKELY_EOF" > "$TEMP_DIR/peep.py"
 {{ peep.py }}
 UNLIKELY_EOF
     # -------------------------------------------------------------------------
     set +e
-    PEEP_OUT=`$VENV_BIN/python $TEMP_DIR/peep.py install -r $TEMP_DIR/letsencrypt-auto-requirements.txt`
+    PEEP_OUT=`"$VENV_BIN/python" "$TEMP_DIR/peep.py" install -r "$TEMP_DIR/letsencrypt-auto-requirements.txt"`
     PEEP_STATUS=$?
     set -e
-    rm -rf $TEMP_DIR
+    rm -rf "$TEMP_DIR"
     if [ "$PEEP_STATUS" != 0 ]; then
       # Report error. (Otherwise, be quiet.)
       echo "Had a problem while downloading and verifying Python packages:"
@@ -207,8 +207,8 @@ UNLIKELY_EOF
     fi
   fi
   echo "Running letsencrypt..."
-  echo "  " $SUDO $VENV_BIN/letsencrypt "$@"
-  $SUDO $VENV_BIN/letsencrypt "$@"
+  echo "  " $SUDO "$VENV_BIN/letsencrypt" "$@"
+  $SUDO "$VENV_BIN/letsencrypt" "$@"
 else
   # Phase 1: Upgrade letsencrypt-auto if neceesary, then self-invoke.
   #
@@ -220,28 +220,28 @@ else
   echo "Checking for new version..."
   TEMP_DIR=$(TempDir)
   # ---------------------------------------------------------------------------
-  cat << "UNLIKELY_EOF" > $TEMP_DIR/fetch.py
+  cat << "UNLIKELY_EOF" > "$TEMP_DIR/fetch.py"
 {{ fetch.py }}
 UNLIKELY_EOF
   # ---------------------------------------------------------------------------
   DeterminePythonVersion
-  REMOTE_VERSION=`$LE_PYTHON $TEMP_DIR/fetch.py --latest-version`
+  REMOTE_VERSION=`"$LE_PYTHON" "$TEMP_DIR/fetch.py" --latest-version`
   if [ "$LE_AUTO_VERSION" != "$REMOTE_VERSION" ]; then
     echo "Upgrading letsencrypt-auto $LE_AUTO_VERSION to $REMOTE_VERSION..."
 
     # Now we drop into Python so we don't have to install even more
     # dependencies (curl, etc.), for better flow control, and for the option of
     # future Windows compatibility.
-    $LE_PYTHON "$TEMP_DIR/fetch.py" --le-auto-script "v$REMOTE_VERSION"
+    "$LE_PYTHON" "$TEMP_DIR/fetch.py" --le-auto-script "v$REMOTE_VERSION"
 
     # Install new copy of letsencrypt-auto. This preserves permissions and
     # ownership from the old copy.
     # TODO: Deal with quotes in pathnames.
-    echo "Installing new version of letsencrypt-auto..."
+    echo "Replacing letsencrypt-auto..."
     echo "  " $SUDO cp "$TEMP_DIR/letsencrypt-auto" "$0"
     $SUDO cp "$TEMP_DIR/letsencrypt-auto" "$0"
     # TODO: Clean up temp dir safely, even if it has quotes in its path.
-    rm -rf $TEMP_DIR
+    rm -rf "$TEMP_DIR"
   fi  # should upgrade
   "$0" --no-self-upgrade "$@"
 fi