diff --git a/scripts/benchmark-search-graph.sh b/scripts/benchmark-search-graph.sh
index 3da58492c..cc94147ec 100755
--- a/scripts/benchmark-search-graph.sh
+++ b/scripts/benchmark-search-graph.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # benchmark-search-graph.sh — Time search_graph name_pattern= queries against a
 # codebase-memory-mcp binary to measure the regex / LIKE pre-filter performance.
 #
diff --git a/scripts/build.sh b/scripts/build.sh
index bbb9bda74..8d9dad383 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # build.sh — Clean build of production binary (standard or with UI).
 #
 # Usage:
diff --git a/scripts/check-nolint-whitelist.sh b/scripts/check-nolint-whitelist.sh
index f2432bfe2..757a270fc 100755
--- a/scripts/check-nolint-whitelist.sh
+++ b/scripts/check-nolint-whitelist.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Verify NOLINT(misc-no-recursion) only appears on whitelisted functions.
 WHITELIST="src/foundation/recursion_whitelist.h"
 if [ ! -f "$WHITELIST" ]; then
diff --git a/scripts/clean.sh b/scripts/clean.sh
index 662cf3aa8..ea9e15976 100755
--- a/scripts/clean.sh
+++ b/scripts/clean.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # clean.sh — Remove ALL build artifacts, caches, and generated files.
 #
 # Usage: scripts/clean.sh
diff --git a/scripts/embed-frontend.sh b/scripts/embed-frontend.sh
index 908c39790..0b7b87309 100755
--- a/scripts/embed-frontend.sh
+++ b/scripts/embed-frontend.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # embed-frontend.sh — Convert built frontend assets into linkable object files.
 #
 # Usage: scripts/embed-frontend.sh <dist_dir> <output_dir>
diff --git a/scripts/env.sh b/scripts/env.sh
index 8cb5f9999..f7922dd96 100755
--- a/scripts/env.sh
+++ b/scripts/env.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # env.sh — Shared environment detection for all build scripts.
 #
 # Sourced by test.sh, build.sh, lint.sh. Not meant to run standalone.
diff --git a/scripts/lint.sh b/scripts/lint.sh
index 60e023b47..bb2b0ec1e 100755
--- a/scripts/lint.sh
+++ b/scripts/lint.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # lint.sh — Run all linters (clang-tidy + cppcheck + clang-format).
 #
 # Usage:
diff --git a/scripts/repro.sh b/scripts/repro.sh
index d585a9ec7..78162e779 100755
--- a/scripts/repro.sh
+++ b/scripts/repro.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # repro.sh — Build + run the cumulative BUG-REPRODUCTION suite (test-repro).
 #
 # Unlike test.sh (the gating suite, must be GREEN), this suite is RED by design:
diff --git a/scripts/soak-test.sh b/scripts/soak-test.sh
index 211cec5da..ab0dff778 100755
--- a/scripts/soak-test.sh
+++ b/scripts/soak-test.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # soak-test.sh — Endurance test for codebase-memory-mcp.
 #
 # Runs compressed workload cycles: queries, file mutations, reindexes, idle periods.
diff --git a/scripts/test.sh b/scripts/test.sh
index cd98491e2..1f5c6d9ed 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # test.sh — Clean build + run all C tests with ASan + UBSan.
 #
 # Usage:
diff --git a/scripts/vendor-grammar.sh b/scripts/vendor-grammar.sh
index 83009f2ff..696f486e4 100755
--- a/scripts/vendor-grammar.sh
+++ b/scripts/vendor-grammar.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # vendor-grammar.sh: Vendor a single tree-sitter grammar into internal/cbm/vendored/grammars/<name>/
 # Usage: ./scripts/vendor-grammar.sh <repo_url> <name> [subdir]
 #   repo_url: GitHub repository URL (e.g., https://github.com/tree-sitter/tree-sitter-json)
diff --git a/src/cli/cli.c b/src/cli/cli.c
index a3492d065..a9850c77e 100644
--- a/src/cli/cli.c
+++ b/src/cli/cli.c
@@ -2055,7 +2055,7 @@ void cbm_install_hook_gate_script(const char *home, const char *binary_path) {
         return;
     }
     (void)fprintf(f,
-                  "#!/bin/bash\n"
+                  "#!/usr/bin/env bash\n"
                   "# codebase-memory-mcp search augmenter (Claude Code PreToolUse).\n"
                   "# NOTE: the legacy filename is kept for zero-migration upgrades.\n"
                   "# Despite the name this NEVER blocks a tool call - it only adds\n"
@@ -2099,7 +2099,7 @@ static void cbm_install_session_reminder_script(const char *home) {
         return;
     }
     (void)fprintf(
-        f, "#!/bin/bash\n"
+        f, "#!/usr/bin/env bash\n"
            "# SessionStart hook: remind agent to use codebase-memory-mcp tools.\n"
            "# Installed by codebase-memory-mcp. Fires on startup/resume/clear/compact.\n"
            "cat << 'REMINDER'\n"
@@ -2187,7 +2187,7 @@ static void cbm_install_subagent_reminder_script(const char *home) {
      * backslashes, or newlines, so the JSON below is valid as written — no
      * runtime escaping (and no python3/jq dependency) is required. */
     (void)fprintf(f,
-                  "#!/bin/bash\n"
+                  "#!/usr/bin/env bash\n"
                   "# SubagentStart hook: tell subagents to use codebase-memory-mcp tools.\n"
                   "# Installed by codebase-memory-mcp. Fires when any subagent is spawned.\n"
                   "# SubagentStart injects context via JSON additionalContext, not plain stdout.\n"
diff --git a/test-infrastructure/run.sh b/test-infrastructure/run.sh
index 32b1826db..2786f2559 100755
--- a/test-infrastructure/run.sh
+++ b/test-infrastructure/run.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Local CI — test all platforms before pushing.
 #
 # Coverage:
diff --git a/tests/test_pipeline.c b/tests/test_pipeline.c
index 3e7edf23c..7cba2a031 100644
--- a/tests/test_pipeline.c
+++ b/tests/test_pipeline.c
@@ -4669,7 +4669,7 @@ TEST(envscan_secret_value_exclusion) {
     write_temp_file(
         tmpdir, "deploy.sh",
         "#!/bin/bash\n"
-        "export GH_URL=\"https://ghp_abcdefghijklmnopqrstuvwxyz1234567890@github.com/repo\"\n"
+        "export GH_URL=\"https://ghp_FAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKE@github.com/repo\"\n"
         "export NORMAL_ENDPOINT=\"https://api.example.com/orders\"\n");
 
     cbm_env_binding_t bindings[32];