diff --git a/.rubocop_manual_todo.yml b/.rubocop_manual_todo.yml
index 96437f477586d0b4d09d173a9cf15253b7530420..e6aac360ef93699c46c21f3b0773981b7983350c 100644
--- a/.rubocop_manual_todo.yml
+++ b/.rubocop_manual_todo.yml
@@ -2494,29 +2494,5 @@ Style/FrozenStringLiteralComment:
     - 'app/views/projects/tags/_tag.atom.builder'
     - 'app/views/projects/tags/index.atom.builder'
     - 'app/views/users/show.atom.builder'
-    - 'bin/secpick'
     - 'danger/changes_size/Dangerfile'
     - 'danger/metadata/Dangerfile'
-    - 'scripts/flaky_examples/detect-new-flaky-examples'
-    - 'scripts/flaky_examples/prune-old-flaky-examples'
-    - 'scripts/gather-test-memory-data'
-    - 'scripts/generate-gems-memory-metrics-static'
-    - 'scripts/generate-gems-size-metrics-static'
-    - 'scripts/generate-memory-metrics-on-boot'
-    - 'scripts/generate-test-mapping'
-    - 'scripts/gitaly-test-build'
-    - 'scripts/gitaly-test-spawn'
-    - 'scripts/gitaly_test.rb'
-    - 'scripts/insert-rspec-profiling-data'
-    - 'scripts/lint-rugged'
-    - 'scripts/merge-html-reports'
-    - 'scripts/merge-reports'
-    - 'scripts/merge-simplecov'
-    - 'scripts/no-ee-check'
-    - 'scripts/pack-test-mapping'
-    - 'scripts/static-analysis'
-    - 'scripts/sync-reports'
-    - 'scripts/unpack-test-mapping'
-    - 'scripts/update-feature-categories'
-    - 'scripts/used-feature-flags'
-    - 'scripts/verify-tff-mapping'
diff --git a/bin/secpick b/bin/secpick
index 517465d3f5d1b24991b978a17cb42dcc2f309765..07bac9270c9d8b8f5a99282dcfbe11e39aac6840 100755
--- a/bin/secpick
+++ b/bin/secpick
@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 
-# frozen_string_literal: false
+# frozen_string_literal: true
 
 require 'active_support/core_ext/object/to_query'
 require 'optparse'
@@ -9,12 +9,12 @@ require 'rainbow/refinement'
 using Rainbow
 
 module Secpick
-  BRANCH_PREFIX = 'security'.freeze
-  STABLE_SUFFIX = 'stable'.freeze
+  BRANCH_PREFIX = 'security'
+  STABLE_SUFFIX = 'stable'
 
-  DEFAULT_REMOTE = 'security'.freeze
+  DEFAULT_REMOTE = 'security'
 
-  SECURITY_MR_URL = 'https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/new'.freeze
+  SECURITY_MR_URL = 'https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/new'
 
   class SecurityFix
     def initialize
@@ -27,12 +27,12 @@ module Secpick
 
     def source_branch
       branch = "#{@options[:branch]}-#{@options[:version]}"
-      branch.prepend("#{BRANCH_PREFIX}-") unless branch.start_with?("#{BRANCH_PREFIX}-")
-      branch.freeze
+      branch = "#{BRANCH_PREFIX}-#{branch}" unless branch.start_with?("#{BRANCH_PREFIX}-")
+      branch
     end
 
     def stable_branch
-      "#{@options[:version]}-#{STABLE_SUFFIX}-ee".freeze
+      "#{@options[:version]}-#{STABLE_SUFFIX}-ee"
     end
 
     def git_commands
diff --git a/scripts/flaky_examples/detect-new-flaky-examples b/scripts/flaky_examples/detect-new-flaky-examples
index 3bee4f9a34bb09a8ea2e4cf1e76ca00b12936d82..4805c5054a5fd27a610412e35e55922b7e16320f 100755
--- a/scripts/flaky_examples/detect-new-flaky-examples
+++ b/scripts/flaky_examples/detect-new-flaky-examples
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'json'
 
diff --git a/scripts/flaky_examples/prune-old-flaky-examples b/scripts/flaky_examples/prune-old-flaky-examples
index 4df49c6d8fa0551c34436db4187a60b6728d9f2f..8c09c4cc86080f96189ce54eb00f2703e02909e4 100755
--- a/scripts/flaky_examples/prune-old-flaky-examples
+++ b/scripts/flaky_examples/prune-old-flaky-examples
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 # lib/rspec_flaky/flaky_examples_collection.rb is requiring
 # `active_support/hash_with_indifferent_access`, and we install the `activesupport`
diff --git a/scripts/gather-test-memory-data b/scripts/gather-test-memory-data
index 9992a83e6a61f36754e9eca4328082f03cd51040..3156365ac199faae893a85f1aac642e586815827 100755
--- a/scripts/gather-test-memory-data
+++ b/scripts/gather-test-memory-data
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'csv'
 
diff --git a/scripts/generate-gems-memory-metrics-static b/scripts/generate-gems-memory-metrics-static
index aa7ce3615bffef31f1f7e1317728dc6135fcc0fc..42191f078f18187b18cc5459c37986af05cf82c3 100755
--- a/scripts/generate-gems-memory-metrics-static
+++ b/scripts/generate-gems-memory-metrics-static
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 abort "usage: #{__FILE__} <memory_bundle_objects_file_name>" unless ARGV.length == 1
 memory_bundle_objects_file_name = ARGV.first
diff --git a/scripts/generate-gems-size-metrics-static b/scripts/generate-gems-size-metrics-static
index ceec8aaccf17c1b2a6690a729384c905157b8071..2406e7209163f671dae2bf81b5cafc069c7d7241 100755
--- a/scripts/generate-gems-size-metrics-static
+++ b/scripts/generate-gems-size-metrics-static
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 abort "usage: #{__FILE__} <memory_bundle_mem_file_name>" unless ARGV.length == 1
 memory_bundle_mem_file_name = ARGV.first
diff --git a/scripts/generate-memory-metrics-on-boot b/scripts/generate-memory-metrics-on-boot
index 5197a8fcdcd9f8d4c29464c569cefd321436d33a..945661aa057d805b5e62442eb501b159e27bc213 100755
--- a/scripts/generate-memory-metrics-on-boot
+++ b/scripts/generate-memory-metrics-on-boot
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 abort "usage: #{__FILE__} <memory_bundle_mem_file_name>" unless ARGV.length == 1
 memory_bundle_mem_file_name = ARGV.first
diff --git a/scripts/generate-test-mapping b/scripts/generate-test-mapping
index eabe6a5b513f124a378bda62ae73e336e1216376..c4d0dfea4d8cf044e452d7ee52bf5752ec78e9d6 100755
--- a/scripts/generate-test-mapping
+++ b/scripts/generate-test-mapping
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'json'
 require_relative '../tooling/lib/tooling/test_map_generator'
diff --git a/scripts/gitaly-test-build b/scripts/gitaly-test-build
index 62d3dbda91103f6f646494855204a0fc3e638684..bb561e2906afa5cad81290a510d2b0f3fa36f428 100755
--- a/scripts/gitaly-test-build
+++ b/scripts/gitaly-test-build
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'fileutils'
 
diff --git a/scripts/gitaly-test-spawn b/scripts/gitaly-test-spawn
index caa41a9a0c359c183a2d9ff674ef7269e09fef8a..8547d0b13e417585b0dce71a5d2cf8eedc331aa9 100755
--- a/scripts/gitaly-test-spawn
+++ b/scripts/gitaly-test-spawn
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 # This script is used both in CI and in local development 'rspec' runs.
 
diff --git a/scripts/gitaly_test.rb b/scripts/gitaly_test.rb
index c7b3f72d590528bd191d4f6afaff3fc696998e81..2262870eb96f276c7c6dddcb5b1ee6012f7d8ca2 100644
--- a/scripts/gitaly_test.rb
+++ b/scripts/gitaly_test.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # This file contains environment settings for gitaly when it's running
 # as part of the gitlab-ce/ee test suite.
 #
@@ -52,7 +54,7 @@ def env
 
     if ENV['CI']
       bundle_path = File.expand_path('../vendor/gitaly-ruby', __dir__)
-      env_hash['BUNDLE_FLAGS'] << " --path=#{bundle_path}"
+      env_hash['BUNDLE_FLAGS'] += " --path=#{bundle_path}"
     end
 
     env_hash
diff --git a/scripts/insert-rspec-profiling-data b/scripts/insert-rspec-profiling-data
index 3af5fe763a2b5235b873215711ad9b2b9ae874c3..b20118585588cd57a3d6d3f7bbf2a02eb637204a 100755
--- a/scripts/insert-rspec-profiling-data
+++ b/scripts/insert-rspec-profiling-data
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'csv'
 require 'rspec_profiling'
diff --git a/scripts/lint-rugged b/scripts/lint-rugged
index d7af5499e1cbbe90251e961da95bfeaf896d4042..038fd5199c2b88db28c04770c8fb0fe9314f5664 100755
--- a/scripts/lint-rugged
+++ b/scripts/lint-rugged
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 ALLOWED = [
   # https://gitlab.com/gitlab-org/gitaly/issues/760
diff --git a/scripts/merge-html-reports b/scripts/merge-html-reports
index 7d1e15186c8b9ba9de8a2b7aaa0a83d034b1a04a..de30085199079c916e62727830117c0919846e42 100755
--- a/scripts/merge-html-reports
+++ b/scripts/merge-html-reports
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'nokogiri'
 
diff --git a/scripts/merge-reports b/scripts/merge-reports
index 3a421f1f1fc23b23f7f6dc66949d4d5676573ba4..a1164495f2fb927a18380025dcdc1120fd68db55 100755
--- a/scripts/merge-reports
+++ b/scripts/merge-reports
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'json'
 
diff --git a/scripts/merge-simplecov b/scripts/merge-simplecov
index c00dae81c4d752ba5818e83ece76b67719718830..38dd2dfe2e933b62901bc37f4573ca6e6983a549 100755
--- a/scripts/merge-simplecov
+++ b/scripts/merge-simplecov
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require_relative '../spec/simplecov_env'
 SimpleCovEnv.configure_profile
diff --git a/scripts/no-ee-check b/scripts/no-ee-check
index 29d319dc8224843fdc5927c249ada7ec84016a56..a878a4424e9752cbd1edf67b7dc835c8c15933f3 100755
--- a/scripts/no-ee-check
+++ b/scripts/no-ee-check
@@ -1,4 +1,6 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
+
 ee_path = File.join(File.expand_path(__dir__), '../ee')
 
 if Dir.exist?(ee_path)
diff --git a/scripts/pack-test-mapping b/scripts/pack-test-mapping
index 58ace3eca67974e20500fd9329c569e55cee4223..b5148cd1882d63c1357f9067687381eadecbfcaf 100755
--- a/scripts/pack-test-mapping
+++ b/scripts/pack-test-mapping
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'json'
 require_relative '../tooling/lib/tooling/test_map_packer'
diff --git a/scripts/static-analysis b/scripts/static-analysis
index 9103a9c14afca3623174db32095922bffa60b707..febfdbd1da4034d840f59c5ca567087ff38045e2 100755
--- a/scripts/static-analysis
+++ b/scripts/static-analysis
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 # We don't have auto-loading here
 require_relative '../lib/gitlab'
diff --git a/scripts/sync-reports b/scripts/sync-reports
index 5ed65e7800550c35c92234775b8fb1f1f854a4ba..73afd276e6c7ec0e1c76e809224ca87f0f75e69c 100755
--- a/scripts/sync-reports
+++ b/scripts/sync-reports
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'rubygems'
 require 'fog/aws'
diff --git a/scripts/unpack-test-mapping b/scripts/unpack-test-mapping
index c0f706c3f9f0c4f8ce99f53278b02563c9c39bb6..7176f9cecead96dea0ca0fd5fb1a2122d872da48 100755
--- a/scripts/unpack-test-mapping
+++ b/scripts/unpack-test-mapping
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'json'
 require_relative '../tooling/lib/tooling/test_map_packer'
diff --git a/scripts/update-feature-categories b/scripts/update-feature-categories
index ed5d8dccdd67dd1f792215f0216286de92e7cdd4..88520b9f95f26be10b8014d3052fa5e35a924a60 100755
--- a/scripts/update-feature-categories
+++ b/scripts/update-feature-categories
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'uri'
 require 'net/http'
diff --git a/scripts/used-feature-flags b/scripts/used-feature-flags
index 7ef3dbafd363513fe1b064838d7a6f75b2e55811..aebd007dda9a5c8a112de683d9bf6b4776099686 100755
--- a/scripts/used-feature-flags
+++ b/scripts/used-feature-flags
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'set'
 
diff --git a/scripts/verify-tff-mapping b/scripts/verify-tff-mapping
index 8bf25ea3b5f2606ca614461e723f03d8388cacdd..9931e14008a9308a4508f42f692cd3a430395adf 100755
--- a/scripts/verify-tff-mapping
+++ b/scripts/verify-tff-mapping
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'set'