diff --git a/.github/scripts/apply-code-quality-ruleset.sh b/.github/scripts/apply-code-quality-ruleset.sh
index 91f014cf..2882db51 100755
--- a/.github/scripts/apply-code-quality-ruleset.sh
+++ b/.github/scripts/apply-code-quality-ruleset.sh
@@ -31,7 +31,7 @@ set -euo pipefail
 REPO="combsmith/markets"
 RULESET_NAME="code-quality"
 
-if [ -z "${GH_TOKEN:-}" ]; then
+if [[ -z "${GH_TOKEN:-}" ]]; then
   echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
   exit 1
 fi
@@ -52,7 +52,7 @@ REQUIRED_BYPASS_ACTORS=$(jq -n \
 
 # When updating an existing ruleset, fetch its current bypass actors and merge them
 # with the required actors so that other legitimate bypass actors are not silently removed.
-if [ -n "$EXISTING_ID" ]; then
+if [[ -n "$EXISTING_ID" ]]; then
   EXISTING_BYPASS=$(gh api "repos/$REPO/rulesets/$EXISTING_ID" \
     --jq '.bypass_actors // []' 2>/dev/null || echo "[]")
   BYPASS_ACTORS=$(echo "$EXISTING_BYPASS" | \
@@ -92,7 +92,7 @@ PAYLOAD=$(jq -n --argjson bypass_actors "$BYPASS_ACTORS" '{
   bypass_actors: $bypass_actors
 }')
 
-if [ -n "$EXISTING_ID" ]; then
+if [[ -n "$EXISTING_ID" ]]; then
   echo "Updating existing $RULESET_NAME ruleset (id=$EXISTING_ID) ..."
   echo "$PAYLOAD" | gh api -X PUT "repos/$REPO/rulesets/$EXISTING_ID" --input - > /dev/null
   echo "Done — ruleset updated: https://github.com/$REPO/rules/$EXISTING_ID"
diff --git a/.github/scripts/apply-pr-quality-ruleset.sh b/.github/scripts/apply-pr-quality-ruleset.sh
index ea0a41f9..e50c9cd8 100755
--- a/.github/scripts/apply-pr-quality-ruleset.sh
+++ b/.github/scripts/apply-pr-quality-ruleset.sh
@@ -36,7 +36,7 @@ set -euo pipefail
 REPO="combsmith/markets"
 RULESET_NAME="pr-quality"
 
-if [ -z "${GH_TOKEN:-}" ]; then
+if [[ -z "${GH_TOKEN:-}" ]]; then
   echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
   exit 1
 fi
@@ -83,7 +83,7 @@ PAYLOAD=$(jq -n '{
   ]
 }')
 
-if [ -n "$EXISTING_ID" ]; then
+if [[ -n "$EXISTING_ID" ]]; then
   echo "Updating existing $RULESET_NAME ruleset (id=$EXISTING_ID) ..."
   echo "$PAYLOAD" | gh api -X PUT "repos/$REPO/rulesets/$EXISTING_ID" --input - > /dev/null
   echo "Done — ruleset updated: https://github.com/$REPO/rules/$EXISTING_ID"
diff --git a/.github/scripts/apply-repo-settings.sh b/.github/scripts/apply-repo-settings.sh
index 93686409..06786c3b 100755
--- a/.github/scripts/apply-repo-settings.sh
+++ b/.github/scripts/apply-repo-settings.sh
@@ -15,7 +15,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO="combsmith/markets"
 
-if [ -z "${GH_TOKEN:-}" ]; then
+if [[ -z "${GH_TOKEN:-}" ]]; then
   echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
   exit 1
 fi
diff --git a/.github/scripts/apply-secret-scanning-ai-detection.sh b/.github/scripts/apply-secret-scanning-ai-detection.sh
index 61de97b5..798581d6 100755
--- a/.github/scripts/apply-secret-scanning-ai-detection.sh
+++ b/.github/scripts/apply-secret-scanning-ai-detection.sh
@@ -22,7 +22,7 @@ set -euo pipefail
 
 REPO="combsmith/markets"
 
-if [ -z "${GH_TOKEN:-}" ]; then
+if [[ -z "${GH_TOKEN:-}" ]]; then
   echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
   exit 1
 fi
diff --git a/.github/scripts/apply-secret-scanning-non-provider-patterns.sh b/.github/scripts/apply-secret-scanning-non-provider-patterns.sh
index ce75b7a7..ccb52ce2 100755
--- a/.github/scripts/apply-secret-scanning-non-provider-patterns.sh
+++ b/.github/scripts/apply-secret-scanning-non-provider-patterns.sh
@@ -22,7 +22,7 @@ set -euo pipefail
 
 REPO="combsmith/markets"
 
-if [ -z "${GH_TOKEN:-}" ]; then
+if [[ -z "${GH_TOKEN:-}" ]]; then
   echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
   exit 1
 fi