diff --git a/ci_build.sh b/ci_build.sh
index 6a81f2f1..c176cbc9 100755
--- a/ci_build.sh
+++ b/ci_build.sh
@@ -3,7 +3,7 @@
 set -x
 set -e
 
-if [ $BUILD_TYPE == "default" ]; then
+if [ $BUILD_TYPE = "default" ]; then
     mkdir tmp
     BUILD_PREFIX=$PWD/tmp
 
@@ -16,19 +16,19 @@ if [ $BUILD_TYPE == "default" ]; then
     CONFIG_OPTS+=("--prefix=${BUILD_PREFIX}")
     CHECK="distcheck"
 
-    if [ -n "$ADDRESS_SANITIZER" ] && [ "$ADDRESS_SANITIZER" == "enabled" ]; then
+    if [ -n "$ADDRESS_SANITIZER" ] && [ "$ADDRESS_SANITIZER" = "enabled" ]; then
         CONFIG_OPTS+=("--enable-address-sanitizer=yes")
         # distcheck does an out-of-tree build, and the fuzzer tests use a hard-coded relative path for simplicity
         CHECK="check"
     fi
 
-    if [ $USE_NSS == "yes" ]; then
+    if [ "$USE_NSS" = "yes" ]; then
         CONFIG_OPTS+=("--with-nss")
     fi
 
-    if [ -z $CURVE ]; then
+    if [ -z "$CURVE" ]; then
         CONFIG_OPTS+=("--disable-curve")
-    elif [ $CURVE == "libsodium" ]; then
+    elif [ "$CURVE" = "libsodium" ]; then
         CONFIG_OPTS+=("--with-libsodium=yes")
 
         if ! ((command -v dpkg-query >/dev/null 2>&1 && dpkg-query --list libsodium-dev >/dev/null 2>&1) || \
@@ -38,19 +38,19 @@ if [ $BUILD_TYPE == "default" ]; then
         fi
     fi
 
-    if [ -n "$GSSAPI" ] && [ "$GSSAPI" == "enabled" ]; then
+    if [ -n "$GSSAPI" ] && [ "$GSSAPI" = "enabled" ]; then
         CONFIG_OPTS+=("--with-libgssapi_krb5=yes")
     fi
 
-    if [ -n "$PGM" ] && [ "$PGM" == "enabled" ]; then
+    if [ -n "$PGM" ] && [ "$PGM" = "enabled" ]; then
         CONFIG_OPTS+=("--with-pgm=yes")
     fi
 
-    if [ -n "$NORM" ] && [ "$NORM" == "enabled" ]; then
+    if [ -n "$NORM" ] && [ "$NORM" = "enabled" ]; then
         CONFIG_OPTS+=("--with-norm=yes")
     fi
 
-    if [ -n "$TIPC" ] && [ "$TIPC" == "enabled" ]; then
+    if [ -n "$TIPC" ] && [ "$TIPC" = "enabled" ]; then
         sudo modprobe tipc
     fi
 
@@ -58,17 +58,17 @@ if [ $BUILD_TYPE == "default" ]; then
         CONFIG_OPTS+=("--with-poller=${POLLER}")
     fi
 
-    if [ -n "$TLS" ] && [ "$TLS" == "enabled" ]; then
+    if [ -n "$TLS" ] && [ "$TLS" = "enabled" ]; then
         CONFIG_OPTS+=("--with-tls=yes")
     fi
 
-    if [ -z $DRAFT ] || [ $DRAFT == "disabled" ]; then
+    if [ -z "$DRAFT" ] || [ "$DRAFT" = "disabled" ]; then
         CONFIG_OPTS+=("--enable-drafts=no")
-    elif [ $DRAFT == "enabled" ]; then
+    elif [ "$DRAFT" = "enabled" ]; then
         CONFIG_OPTS+=("--enable-drafts=yes")
     fi
 
-    if [ -n "$FORCE_98" ] && [ "$FORCE_98" == "enabled" ]; then
+    if [ -n "$FORCE_98" ] && [ "$FORCE_98" = "enabled" ]; then
         CONFIG_OPTS+=("--enable-force-CXX98-compat=yes")
     fi