diff --git a/centaur/centaur.sh b/centaur/centaur.sh
index da077161816..e4c04b63c79 100644
--- a/centaur/centaur.sh
+++ b/centaur/centaur.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 CMD='sbt'
 if [ -n "$1" ]; then
diff --git a/centaur/src/main/resources/standardTestCases/output_redirection/output_redirection.wdl b/centaur/src/main/resources/standardTestCases/output_redirection/output_redirection.wdl
index 67d396f2acd..f43de892a88 100644
--- a/centaur/src/main/resources/standardTestCases/output_redirection/output_redirection.wdl
+++ b/centaur/src/main/resources/standardTestCases/output_redirection/output_redirection.wdl
@@ -1,6 +1,6 @@
 task output_redirection {
     command {
-        echo "#!/bin/bash" > writeToStderr.sh
+        echo "#!/usr/bin/env bash" > writeToStderr.sh
         # Yes, this is deliberate. We'll eventually end up redirecting this to stdout:
         echo "echo 'should be on stdout' >&2" >> writeToStderr.sh
 
diff --git a/cromwell.example.backends/HtCondor.conf b/cromwell.example.backends/HtCondor.conf
index 60dff5e01fd..45ce8de0b1b 100644
--- a/cromwell.example.backends/HtCondor.conf
+++ b/cromwell.example.backends/HtCondor.conf
@@ -54,7 +54,7 @@ backend {
         submit-docker = """
           chmod 755 ${script}
           cat > ${cwd}/execution/dockerScript <<EOF
-          #!/bin/bash
+          #!/usr/bin/env bash
           docker run --rm -i -v ${cwd}:${docker_cwd} ${docker} /bin/bash ${script}
           EOF
           chmod 755 ${cwd}/execution/dockerScript
diff --git a/docker/install.sh b/docker/install.sh
index d3f6c58818f..824099ccfe8 100755
--- a/docker/install.sh
+++ b/docker/install.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 
diff --git a/docker/run.sh b/docker/run.sh
index 65494e57ef5..b5aed152754 100755
--- a/docker/run.sh
+++ b/docker/run.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 java $JAVA_OPTS -jar /cromwell/cromwell.jar server
diff --git a/docs/backends/HTcondor.md b/docs/backends/HTcondor.md
index 7b4ba74b722..2246857d972 100644
--- a/docs/backends/HTcondor.md
+++ b/docs/backends/HTcondor.md
@@ -72,7 +72,7 @@ This backend also supports docker as optional feature. Configuration key `backen
 ```
 chmod 755 ${script}
 cat > ${cwd}/execution/dockerScript <<EOF
-#!/bin/bash
+#!/usr/bin/env bash
 docker run --rm -i -v ${cwd}:${docker_cwd} ${docker} /bin/bash ${docker_script}
 EOF
 chmod 755 ${cwd}/execution/dockerScript
diff --git a/docs/tutorials/PipelinesApi101.md b/docs/tutorials/PipelinesApi101.md
index ef94d111d04..2beda0792a9 100644
--- a/docs/tutorials/PipelinesApi101.md
+++ b/docs/tutorials/PipelinesApi101.md
@@ -15,7 +15,7 @@ Google recommends using a service account to authenticate to GCP.
 You may create a service account using the `gcloud` command, consider running the following script and replace MY-GOOGLE-PROJECT:
 
 ```
-#!/bin/bash
+#!/usr/bin/env bash
 export LC_ALL=C 
 RANDOM_BUCKET_NAME=$(head /dev/urandom | tr -dc a-z | head -c 32 ; echo '')
 
diff --git a/scripts/make_pr_clone_branch.sh b/scripts/make_pr_clone_branch.sh
index 0431a688596..8919b3a3cd5 100755
--- a/scripts/make_pr_clone_branch.sh
+++ b/scripts/make_pr_clone_branch.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -euo pipefail
 
diff --git a/scripts/reference_disks/create_images.sh b/scripts/reference_disks/create_images.sh
index adc76f99873..8f0bd5ac70b 100755
--- a/scripts/reference_disks/create_images.sh
+++ b/scripts/reference_disks/create_images.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # uncomment/comment toggle verbose debugging
 #set -x
diff --git a/scripts/test_upgrade/test_upgrade.sh b/scripts/test_upgrade/test_upgrade.sh
index 7eb6a22e6db..89739d467db 100755
--- a/scripts/test_upgrade/test_upgrade.sh
+++ b/scripts/test_upgrade/test_upgrade.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # test_upgrade.sh
 #
diff --git a/src/ci/resources/acquire_b2c_token.sh b/src/ci/resources/acquire_b2c_token.sh
index 23eb25461c6..4ff3bbfa932 100755
--- a/src/ci/resources/acquire_b2c_token.sh
+++ b/src/ci/resources/acquire_b2c_token.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # This script acquires a b2c token using gcloud auth and writes it to a file.
 # This file is used by renderCiResources to populate the CROMWELL_B2C_TOKEN in tes_application.conf.
diff --git a/supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/Delocalization.scala b/supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/Delocalization.scala
index 4e1ab74104b..a80e96b9f00 100644
--- a/supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/Delocalization.scala
+++ b/supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/Delocalization.scala
@@ -58,7 +58,7 @@ trait Delocalization {
     /*
      * Delocalize all the files returned by the runtime output extractor
      */
-    s"""|#!/bin/bash
+    s"""|#!/usr/bin/env bash
         |
         |set -x
         |
diff --git a/supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/RunnableCommands.scala b/supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/RunnableCommands.scala
index 8c7c024691e..3c421536620 100644
--- a/supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/RunnableCommands.scala
+++ b/supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/RunnableCommands.scala
@@ -168,7 +168,7 @@ object RunnableCommands {
 
   def multiLineCommandTransformer(shell: String)(commandString: String): String = {
     val randomUuid = UUID.randomUUID().toString
-    val withBashShebang = s"#!/bin/bash\n\n$commandString"
+    val withBashShebang = s"#!/usr/bin/env bash\n\n$commandString"
     val base64EncodedScript = Base64.encodeBase64String(withBashShebang.getBytes(StandardCharsets.UTF_8))
     val scriptPath = s"/tmp/$randomUuid.sh"
 
diff --git a/supportedBackends/google/pipelines/common/src/main/scala/cromwell/backend/google/pipelines/common/action/ActionCommands.scala b/supportedBackends/google/pipelines/common/src/main/scala/cromwell/backend/google/pipelines/common/action/ActionCommands.scala
index 54af3200acb..64212fbaa24 100644
--- a/supportedBackends/google/pipelines/common/src/main/scala/cromwell/backend/google/pipelines/common/action/ActionCommands.scala
+++ b/supportedBackends/google/pipelines/common/src/main/scala/cromwell/backend/google/pipelines/common/action/ActionCommands.scala
@@ -169,7 +169,7 @@ object ActionCommands {
 
   def multiLineCommandTransformer(shell: String)(commandString: String): String = {
     val randomUuid = UUID.randomUUID().toString
-    val withBashShebang = s"#!/bin/bash\n\n$commandString"
+    val withBashShebang = s"#!/usr/bin/env bash\n\n$commandString"
     val base64EncodedScript = Base64.encodeBase64String(withBashShebang.getBytes(StandardCharsets.UTF_8))
     val scriptPath = s"/tmp/$randomUuid.sh"
 
diff --git a/supportedBackends/google/pipelines/v2alpha1/src/main/scala/cromwell/backend/google/pipelines/v2alpha1/api/Delocalization.scala b/supportedBackends/google/pipelines/v2alpha1/src/main/scala/cromwell/backend/google/pipelines/v2alpha1/api/Delocalization.scala
index 41a5dbbc81c..c5814f434b1 100644
--- a/supportedBackends/google/pipelines/v2alpha1/src/main/scala/cromwell/backend/google/pipelines/v2alpha1/api/Delocalization.scala
+++ b/supportedBackends/google/pipelines/v2alpha1/src/main/scala/cromwell/backend/google/pipelines/v2alpha1/api/Delocalization.scala
@@ -99,7 +99,7 @@ trait Delocalization {
     /*
      * Delocalize all the files returned by the runtime output extractor
      */
-    s"""|#!/bin/bash
+    s"""|#!/usr/bin/env bash
         |
         |set -x
         |
diff --git a/supportedBackends/google/pipelines/v2beta/src/main/resources/gcs_transfer.sh b/supportedBackends/google/pipelines/v2beta/src/main/resources/gcs_transfer.sh
index f729f46bdc0..f5bc4f4b7de 100755
--- a/supportedBackends/google/pipelines/v2beta/src/main/resources/gcs_transfer.sh
+++ b/supportedBackends/google/pipelines/v2beta/src/main/resources/gcs_transfer.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # The `papi_v2_log` Centaur test is opinionated about the number of log messages around localization/delocalization.
 # The trace logging of `set -x` must be turned off for the `papi_v2_log` test to pass.
 set +x
diff --git a/supportedBackends/google/pipelines/v2beta/src/main/scala/cromwell/backend/google/pipelines/v2beta/api/Delocalization.scala b/supportedBackends/google/pipelines/v2beta/src/main/scala/cromwell/backend/google/pipelines/v2beta/api/Delocalization.scala
index 4d8416c46af..1703a206ece 100644
--- a/supportedBackends/google/pipelines/v2beta/src/main/scala/cromwell/backend/google/pipelines/v2beta/api/Delocalization.scala
+++ b/supportedBackends/google/pipelines/v2beta/src/main/scala/cromwell/backend/google/pipelines/v2beta/api/Delocalization.scala
@@ -97,7 +97,7 @@ trait Delocalization {
     /*
      * Delocalize all the files returned by the runtime output extractor
      */
-    s"""|#!/bin/bash
+    s"""|#!/usr/bin/env bash
         |
         |set -x
         |
diff --git a/supportedBackends/sfs/src/main/scala/cromwell/backend/impl/sfs/config/ConfigAsyncJobExecutionActor.scala b/supportedBackends/sfs/src/main/scala/cromwell/backend/impl/sfs/config/ConfigAsyncJobExecutionActor.scala
index 8c34d576148..66962a58449 100644
--- a/supportedBackends/sfs/src/main/scala/cromwell/backend/impl/sfs/config/ConfigAsyncJobExecutionActor.scala
+++ b/supportedBackends/sfs/src/main/scala/cromwell/backend/impl/sfs/config/ConfigAsyncJobExecutionActor.scala
@@ -109,7 +109,7 @@ sealed trait ConfigAsyncJobExecutionActor extends SharedFileSystemAsyncJobExecut
     val command = womInstantiation.toTry.get.commandString
     jobLogger.info(s"executing: $command")
     val scriptBody =
-      s"""|#!/bin/bash
+      s"""|#!/usr/bin/env bash
           |SCRIPT_COMMAND
           |""".stripMargin.replace("SCRIPT_COMMAND", command)
     script.write(scriptBody)
diff --git a/supportedBackends/sfs/src/main/scala/cromwell/backend/sfs/BackgroundAsyncJobExecutionActor.scala b/supportedBackends/sfs/src/main/scala/cromwell/backend/sfs/BackgroundAsyncJobExecutionActor.scala
index 9648d7ea411..f06bd82d0b0 100644
--- a/supportedBackends/sfs/src/main/scala/cromwell/backend/sfs/BackgroundAsyncJobExecutionActor.scala
+++ b/supportedBackends/sfs/src/main/scala/cromwell/backend/sfs/BackgroundAsyncJobExecutionActor.scala
@@ -17,7 +17,7 @@ trait BackgroundAsyncJobExecutionActor extends SharedFileSystemAsyncJobExecution
   private def writeBackgroundScriptContents(): Either[ExecutionHandle, Unit] = {
     val backgroundCommand = redirectOutputs(processArgs.argv.mkString("'", "' '", "'"))
     // $! contains the previous background command's process id (PID)
-    backgroundScript.write(s"""|#!/bin/bash
+    backgroundScript.write(s"""|#!/usr/bin/env bash
                                |BACKGROUND_COMMAND &
                                |echo $$!
                                |""".stripMargin.replace("BACKGROUND_COMMAND", backgroundCommand))
@@ -49,7 +49,7 @@ trait BackgroundAsyncJobExecutionActor extends SharedFileSystemAsyncJobExecution
     /*
     Use pgrep to find the children of a process, and recursively kill the children before killing the parent.
      */
-    killScript.write(s"""|#!/bin/bash
+    killScript.write(s"""|#!/usr/bin/env bash
                          |kill_tree() {
                          |  local pid
                          |  local cpid