diff --git a/bin/tests/system/builtin/tests.sh b/bin/tests/system/builtin/tests.sh
index 7685177471..49e1c45750 100644
--- a/bin/tests/system/builtin/tests.sh
+++ b/bin/tests/system/builtin/tests.sh
@@ -132,7 +132,7 @@ do
 		echo_i "failed (empty zone $zone missing)"
 		ret=1
 	}
-	count=`expr $count + 1`
+	count=$((count + 1))
 done
 lines=`grep "automatic empty zone: " ns1/named.run | wc -l`
 test $count -eq $lines -a $count -eq 99 || {
diff --git a/bin/tests/system/dupsigs/ns1/reset_keys.sh b/bin/tests/system/dupsigs/ns1/reset_keys.sh
index cc9bef78f5..9f23d10c70 100644
--- a/bin/tests/system/dupsigs/ns1/reset_keys.sh
+++ b/bin/tests/system/dupsigs/ns1/reset_keys.sh
@@ -52,14 +52,14 @@ $SETTIME -P $BASET -A $BASET $KEYDIR/$KSK
 $SETTIME -P $BASET -A $BASET $KEYDIR/$ZSK0
 
 # schedule the first roll
-R1=`expr $BASE + 50`
+R1=$((BASE + 50))
 R1T=`timetodnssec $R1`
 
 $SETTIME -I $R1T $KEYDIR/$ZSK0
 $SETTIME -P $BASET -A $R1T $KEYDIR/$ZSK1
 
 # schedule the second roll (which includes the delete of the first key)
-R2=`expr $R1 + 50`
+R2=$((R1 + 50))
 R2T=`timetodnssec $R2`
 DT=$R2
 DTT=`timetodnssec $DT`
@@ -69,7 +69,7 @@ $SETTIME -I $R2T $KEYDIR/$ZSK1
 $SETTIME -P $R1T -A $R2T $KEYDIR/$ZSK2
 
 # schedule the third roll
-R3=`expr $R2 + 25`
+R3=$((R2 + 25))
 R3T=`timetodnssec $R3`
 
 $SETTIME -D $R3T $KEYDIR/$ZSK1
@@ -91,7 +91,7 @@ exit
 # this isn't long enough for the signing to complete and would result in
 # duplicate signatures, see
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/231#note_9597
-R4=`expr $R3 + 10`
+R4=$((R3 + 10))
 R4T=`timetodnssec $R4`
 
 $SETTIME -D $R4T $KEYDIR/$ZSK2
diff --git a/bin/tests/system/names/tests.sh b/bin/tests/system/names/tests.sh
index 1d1b26ac99..1d6f630847 100644
--- a/bin/tests/system/names/tests.sh
+++ b/bin/tests/system/names/tests.sh
@@ -39,7 +39,7 @@ status=$((status + ret))
 
 echo_i "Checking if message with compression disabled is significantly larger"
 echo_i "Disabled $COMPDIS vs enabled $COMPEN"
-val=`expr \( $COMPDIS \* 3 / 2 \) / $COMPEN`
+val=$(( (COMPDIS * 3 / 2) / COMPEN))
 if [ $val -le 1 ]; then
 	echo_i "failed"
 	status=$((status + 1))
diff --git a/bin/tests/system/nsupdate/krb/setup.sh b/bin/tests/system/nsupdate/krb/setup.sh
index 5ac116c41d..a1b3ee6771 100644
--- a/bin/tests/system/nsupdate/krb/setup.sh
+++ b/bin/tests/system/nsupdate/krb/setup.sh
@@ -22,8 +22,8 @@ KRB5_KDC_PROFILE=${PWD}/krb5kdc
 export KRB5_KDC_PROFILE
 
 now=`date +%s`
-lifetime=`expr 2147483647 - $now`
-lifetime=`expr $lifetime / 3600 / 24 - 30`
+lifetime=$((2147483647 - now))
+lifetime=$((lifetime / 3600 / 24 - 30))
 
 cat << EOF > "${KRB5_CONFIG}"
 [libdefaults]
diff --git a/bin/tests/system/reclimit/tests.sh b/bin/tests/system/reclimit/tests.sh
index a707063a56..8fdb637503 100644
--- a/bin/tests/system/reclimit/tests.sh
+++ b/bin/tests/system/reclimit/tests.sh
@@ -42,7 +42,7 @@ ns3_sends_aaaa_queries() {
 check_query_count() {
 	count1=`sed 's/[^0-9]//g;' $1`
 	count2=`sed 's/[^0-9]//g;' $2`
-	count=`expr $count1 + $count2`
+	count=$((count1 + count2))
 	#echo_i "count1=$count1 count2=$count2 count=$count"
 	expected_count_with_aaaa=$3
 	expected_count_without_aaaa=$4
diff --git a/bin/tests/system/redirect/tests.sh b/bin/tests/system/redirect/tests.sh
index 9bfb110842..82d413fd0f 100644
--- a/bin/tests/system/redirect/tests.sh
+++ b/bin/tests/system/redirect/tests.sh
@@ -61,7 +61,7 @@ $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.2 a > dig.out.ns2.test$n || ret=1
 rm ns2/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.2 stats || ret=1
 POST=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns2/named.stats`
-if [ `expr $POST - $PRE` != 1 ]; then ret=1; fi
+if [ $((POST - PRE)) != 1 ]; then ret=1; fi
 n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -401,8 +401,8 @@ rm ns4/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.4 stats || ret=1
 POST_RED=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns4/named.stats`
 POST_SUC=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p" ns4/named.stats`
-if [ `expr $POST_RED - $PRE_RED` != 1 ]; then ret=1; fi
-if [ `expr $POST_SUC - $PRE_SUC` != 1 ]; then ret=1; fi
+if [ $((POST_RED - PRE_RED)) != 1 ]; then ret=1; fi
+if [ $((POST_SUC - PRE_SUC)) != 1 ]; then ret=1; fi
 n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
diff --git a/bin/tests/system/rpz/clean.sh b/bin/tests/system/rpz/clean.sh
index 218df9336d..d16b6e9664 100644
--- a/bin/tests/system/rpz/clean.sh
+++ b/bin/tests/system/rpz/clean.sh
@@ -22,7 +22,7 @@ while getopts "Px" c; do
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
 if test "$#" -ne 0; then
     echo "$USAGE" 1>&2
     exit 1
diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index fa8a120b63..8ff880b40f 100644
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -50,7 +50,7 @@ while getopts "xS:" c; do
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
 if test "$#" -ne 0; then
     echo "$USAGE" 1>&2
     exit 1
@@ -265,7 +265,7 @@ ckstats () {
     NEW_CNT=0`sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
 		    $NSDIR/named.stats | tail -1`
     eval "OLD_CNT=0\$${NSDIR}_CNT"
-    GOT=`expr $NEW_CNT - $OLD_CNT`
+    GOT=$((NEW_CNT - OLD_CNT))
     if test "$GOT" -ne "$EXPECTED"; then
 	setret "wrong $LABEL $NSDIR statistics of $GOT instead of $EXPECTED"
     fi
@@ -282,7 +282,7 @@ ckstatsrange () {
     NEW_CNT=0`sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
 		    $NSDIR/named.stats | tail -1`
     eval "OLD_CNT=0\$${NSDIR}_CNT"
-    GOT=`expr $NEW_CNT - $OLD_CNT`
+    GOT=$((NEW_CNT - OLD_CNT))
     if test "$GOT" -lt "$MIN" -o "$GOT" -gt "$MAX"; then
 	setret "wrong $LABEL $NSDIR statistics of $GOT instead of ${MIN}..${MAX}"
     fi
@@ -785,7 +785,7 @@ EOF
     perf 'without RPZ' norpz 'NOERROR:3000 '
     NORPZ=`trim norpz`
 
-    PERCENT=`expr \( "$RPZ" \* 100 + \( $NORPZ / 2 \) \) / $NORPZ`
+    PERCENT=$(( (RPZ * 100 + (NORPZ / 2)) / NORPZ))
     echo_i "$RPZ qps with RPZ is $PERCENT% of $NORPZ qps without RPZ"
 
     MIN_PERCENT=30
diff --git a/bin/tests/system/rpzrecurse/setup.sh b/bin/tests/system/rpzrecurse/setup.sh
index 6ffe1d6cc4..ef9caa3100 100644
--- a/bin/tests/system/rpzrecurse/setup.sh
+++ b/bin/tests/system/rpzrecurse/setup.sh
@@ -27,7 +27,7 @@ while getopts "DNx" c; do
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
 if test "$#" -ne 0; then
     echo "$USAGE" 1>&2
     exit 1
@@ -64,7 +64,7 @@ do
     while test $j -le $i
     do
 	echo "name$j A 10.53.0.$i" >> ns2/db.max$i.local
-	j=`expr $j + 1`
+	j=$((j + 1))
     done
-    i=`expr $i + 1`
+    i=$((i + 1))
 done
diff --git a/bin/tests/system/rpzrecurse/tests.sh b/bin/tests/system/rpzrecurse/tests.sh
index 5e06135df6..62a5f1ee8f 100644
--- a/bin/tests/system/rpzrecurse/tests.sh
+++ b/bin/tests/system/rpzrecurse/tests.sh
@@ -34,7 +34,7 @@ while getopts "xS:" c; do
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
 if test "$#" -ne 0; then
     echo "$USAGE" 1>&2
     exit 1
diff --git a/bin/tests/system/rrl/tests.sh b/bin/tests/system/rrl/tests.sh
index 4263f298f5..af01cecef7 100644
--- a/bin/tests/system/rrl/tests.sh
+++ b/bin/tests/system/rrl/tests.sh
@@ -34,7 +34,7 @@ while getopts "x" c; do
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
 if test "$#" -ne 0; then
     echo "$USAGE" 1>&2
     exit 1
@@ -98,7 +98,7 @@ burst () {
 		-e 's/;; .* status: SERVFAIL.*/SERVFAIL/p'		\
 		-e 's/response failed with timed out.*/drop/p'		\
 		-e 's/;; communications error to.*/drop/p' >> $FILENAME &
-    QNUM=`expr $QNUM + $BURST_LIMIT`
+    QNUM=$((QNUM + BURST_LIMIT))
 }
 
 # compare integers $1 and $2; ensure the difference is no more than $3
@@ -158,7 +158,7 @@ ckstats () {
     C=`cat ns2/named.stats |
         sed -n -e "s/[	 ]*\([0-9]*\).responses $TYPE for rate limits.*/\1/p" |
         tail -1`
-    C=`expr 0$C + 0`
+    C=$((C))
 
     range "$C" $EXPECTED 1 ||
     setret "wrong $LABEL $TYPE statistics of $C instead of $EXPECTED"
diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
index 5a70bee1ef..b076ba1bdc 100755
--- a/bin/tests/system/serve-stale/tests.sh
+++ b/bin/tests/system/serve-stale/tests.sh
@@ -2404,7 +2404,7 @@ burst() {
 	num=${1}
 	rm -f burst.input.$$
 	while [ $num -gt 0 ]; do
-		num=`expr $num - 1`
+		num=$((num - 1))
 		echo "fetch${num}.example A" >> burst.input.$$
 	done
 	$PERL ../ditch.pl -p ${PORT} -s 10.53.0.3 burst.input.$$
diff --git a/bin/tests/system/statistics/tests.sh b/bin/tests/system/statistics/tests.sh
index cbc84a479e..28277a1224 100644
--- a/bin/tests/system/statistics/tests.sh
+++ b/bin/tests/system/statistics/tests.sh
@@ -23,6 +23,8 @@ status=0
 ret=0
 n=1
 stats=0
+nsock0nstat=0
+nsock1nstat=0
 rndc_stats() {
 	_ns=$1
 	_ip=$2
@@ -81,7 +83,7 @@ ret=0
 echo_i "dumping initial stats for ns3 ($n)"
 rndc_stats ns3 10.53.0.3 || ret=1
 nsock0nstat=`grep "UDP/IPv4 sockets active" $last_stats | awk '{print $1}'`
-[ 0 -ne ${nsock0nstat:-0} ] || ret=1
+[ 0 -ne ${nsock0nstat} ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 n=$((n + 1))
@@ -117,7 +119,7 @@ n=$((n + 1))
 ret=0
 echo_i "verifying active sockets output in named.stats ($n)"
 nsock1nstat=`grep "UDP/IPv4 sockets active" $last_stats | awk '{print $1}'`
-[ `expr ${nsock1nstat:-0} - ${nsock0nstat:-0}` -eq 1 ] || ret=1
+[ $((nsock1nstat - nsock0nstat)) -eq 1 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 n=$((n + 1))
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
index 143036c89f..81343758b6 100644
--- a/bin/tests/system/upforwd/tests.sh
+++ b/bin/tests/system/upforwd/tests.sh
@@ -416,7 +416,7 @@ EOF
 ) > /dev/null 2>&1 &
 	$DIG -p ${PORT} +noadd +notcp +noauth noprimary. @10.53.0.3 soa > dig.out.ns3.test$n.$count || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n.$count > /dev/null || ret=1
-	count=`expr $count + 1`
+	count=$((count + 1))
 done
 if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 n=$((n + 1))
diff --git a/bin/tests/system/wildcard/tests.sh b/bin/tests/system/wildcard/tests.sh
index 9a8590d7fd..42421acbe5 100644
--- a/bin/tests/system/wildcard/tests.sh
+++ b/bin/tests/system/wildcard/tests.sh
@@ -273,7 +273,7 @@ do
 	else
 		grep '^\\' dig.out.ns1.$x.test$n && { echo_i "code point $x failed" ; ret=1; }
 	fi
-	i=`expr $i + 1`
+	i=$((i + 1))
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
diff --git a/bin/tests/system/xferquota/tests.sh b/bin/tests/system/xferquota/tests.sh
index 85b6aeb9c5..f74402e9c1 100755
--- a/bin/tests/system/xferquota/tests.sh
+++ b/bin/tests/system/xferquota/tests.sh
@@ -31,8 +31,8 @@ while [ $count != 300 ]; do
                 kill -HUP `cat ns1/named.pid`
 	fi
 	sleep 1
-	ticks=`expr $ticks + 1`
-	seconds=`expr $ticks \* 1`
+	ticks=$((ticks + 1))
+	seconds=$((ticks * 1))
 	if [ $ticks = 360 ]; then
 		echo_i "Took too long to load zones"
 		exit 1