diff --git a/test/cgroups.bats b/test/cgroups.bats
index 99ae3469043..6d45506041f 100644
--- a/test/cgroups.bats
+++ b/test/cgroups.bats
@@ -3,8 +3,8 @@
 load helpers
 
 function setup() {
-	newconfig="$TESTDIR/config.json"
 	setup_test
+	newconfig="$TESTDIR/config.json"
 }
 
 function teardown() {
diff --git a/test/config_migrate.bats b/test/config_migrate.bats
index 4b2507d452e..992c94b4ce6 100644
--- a/test/config_migrate.bats
+++ b/test/config_migrate.bats
@@ -4,13 +4,13 @@
 load helpers
 
 @test "config migrate should succeed with default config" {
-	output=$(crio -c "" -d "" config -m 1.17 2>&1)
+	output=$("$CRIO_BINARY_PATH" -c "" -d "" config -m 1.17 2>&1)
 	[[ "$output" != *"Changing"* ]]
 }
 
 @test "config migrate should succeed with 1.17 config" {
 	# when
-	output=$(crio -c "$TESTDATA/config/config-v1.17.0.toml" -d "" config -m 1.17 2>&1)
+	output=$("$CRIO_BINARY_PATH" -c "$TESTDATA/config/config-v1.17.0.toml" -d "" config -m 1.17 2>&1)
 
 	# then
 	[[ "$output" == *'Changing \"apparmor_profile\" to \"crio-default\"'* ]]
@@ -25,7 +25,7 @@ load helpers
 
 @test "config migrate should fail on invalid version" {
 	# when
-	run crio -c "" -d "" config -m 1.16
+	run "$CRIO_BINARY_PATH" -c "" -d "" config -m 1.16
 
 	# then
 	[[ "$output" == *"unsupported migration version"* ]]
diff --git a/test/crio-wipe.bats b/test/crio-wipe.bats
index aeff05996c5..1ecfac7fb8d 100644
--- a/test/crio-wipe.bats
+++ b/test/crio-wipe.bats
@@ -22,9 +22,9 @@ function run_podman_with_args() {
 }
 
 function teardown() {
-	cleanup_test
 	run_podman_with_args stop -a
 	run_podman_with_args rm -fa
+	cleanup_test
 	cleanup_namespaces_dir
 }
 
diff --git a/test/critest.bats b/test/critest.bats
index 661911534e6..8e7a523cff1 100644
--- a/test/critest.bats
+++ b/test/critest.bats
@@ -3,7 +3,7 @@
 load helpers
 
 function setup() {
-	if [[ -z $RUN_CRITEST ]]; then
+	if [ ! -v RUN_CRITEST ]; then
 		skip "critest because RUN_CRITEST is not set"
 	fi
 
@@ -19,7 +19,7 @@ function teardown() {
 	critest --parallel 8 \
 		--runtime-endpoint "unix://${CRIO_SOCKET}" \
 		--image-endpoint "unix://${CRIO_SOCKET}" \
-		--ginkgo.focus="${CRI_FOCUS}" \
-		--ginkgo.skip="${CRI_SKIP}" \
+		--ginkgo.focus="${CRI_FOCUS:-}" \
+		--ginkgo.skip="${CRI_SKIP:-}" \
 		--ginkgo.flakeAttempts=3 >&3
 }
diff --git a/test/helpers.bash b/test/helpers.bash
index 0661b77d9b7..7bc23743df0 100644
--- a/test/helpers.bash
+++ b/test/helpers.bash
@@ -1,5 +1,18 @@
 #!/usr/bin/env bash
 
+# BATS is broken wrt. 'set -u' with bash < 4.4.
+# Until/unless https://github.com/bats-core/bats-core/pull/550 is
+# merged, make sure we don't run with 'set -u' on offending bash.
+bash_version=$((1000 * $(echo "${BASH_VERSION%.[^.]*}" | tr '.' '+')))
+if [ "$bash_version" -ge 4004 ]; then
+    set -u
+fi
+
+# Work around skip() in old BATS versions not handling substitutions properly
+# wrt. 'set -u'. (fixed in commit 9b2b659e5ba769752c0d00dadb3ad9b58f59cbaa).
+# This can be removed once all CI nodes have been setup with new enough BATS.
+BATS_TEARDOWN_STARTED=${BATS_TEARDOWN_STARTED:-}
+
 # Root directory of integration tests.
 INTEGRATION_ROOT=${INTEGRATION_ROOT:-$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")}
 
@@ -246,11 +259,7 @@ function setup_img() {
 }
 
 function setup_crio() {
-    apparmor=""
-    if [[ -n "$1" ]]; then
-        apparmor="$1"
-    fi
-
+    apparmor="${1:-}"
     for img in "${IMAGES[@]}"; do
         setup_img "$img"
     done
@@ -373,8 +382,8 @@ function cleanup_pods() {
 }
 
 function stop_crio_no_clean() {
-    local signal="$1"
-    if [ -n "${CRIO_PID+x}" ]; then
+    local signal="${1:-}"
+    if [ -v CRIO_PID ]; then
         kill "$signal" "$CRIO_PID" >/dev/null 2>&1 || true
         wait "$CRIO_PID"
         unset CRIO_PID
@@ -399,7 +408,7 @@ function restart_crio() {
 }
 
 function cleanup_lvm() {
-    if [ -n "${LVM_DEVICE+x}" ]; then
+    if [ -v LVM_DEVICE ]; then
         lvm lvremove -y storage/thinpool
         lvm vgremove -y storage
         lvm pvremove -y "$LVM_DEVICE"
@@ -416,7 +425,7 @@ function cleanup_testdir() {
 }
 
 function cleanup_test() {
-    [ -z "$TESTDIR" ] && return
+    [ ! -v TESTDIR ] && return
     # show crio log (only shown by bats in case of test failure)
     if [ -f "$CRIO_LOG" ]; then
         echo "# --- crio.log :: ---"
@@ -561,19 +570,17 @@ function create_runtime_with_allowed_annotation() {
 default_runtime = "$NAME"
 [crio.runtime.runtimes.$NAME]
 runtime_path = "$RUNTIME_BINARY_PATH"
-runtime_root = "$RUNTIME_ROOT"
+runtime_root = "${RUNTIME_ROOT:-}"
 runtime_type = "$RUNTIME_TYPE"
 allowed_annotations = ["$ANNOTATION"]
 EOF
 }
 
 function create_workload_with_allowed_annotation() {
-    local act="$2"
+    local act="${2:-}"
     # Fallback on the specified allowed annotation if
     # a specific activation annotation wasn't specified.
-    if [[ -z "$act" ]]; then
-        act="$1"
-    fi
+    act="${act:-$1}"
     cat <<EOF >"$CRIO_CONFIG_DIR/01-workload.conf"
 [crio.runtime.workloads.management]
 activation_annotation = "$act"
@@ -593,7 +600,7 @@ function set_swap_fields_given_cgroup_version() {
 
 function check_conmon_cpuset() {
     local ctr_id="$1"
-    local cpuset="$2"
+    local cpuset="${2:-}"
     systemd_supports_cpuset=$(systemctl show --property=AllowedCPUs systemd || true)
 
     if [[ "$CONTAINER_CGROUP_MANAGER" == "cgroupfs" ]]; then
diff --git a/test/namespaces.bats b/test/namespaces.bats
index ed40a0b9d3d..147d0817dda 100644
--- a/test/namespaces.bats
+++ b/test/namespaces.bats
@@ -35,7 +35,7 @@ function teardown() {
 }
 
 @test "pid namespace mode target test" {
-	if [[ -n "$TEST_USERNS" ]]; then
+	if [[ -v TEST_USERNS ]]; then
 		skip "test fails in a user namespace"
 	fi
 	start_crio