diff --git a/misc/make-deps.sh b/misc/make-deps.sh
index 8b7b21b9..b6a76489 100755
--- a/misc/make-deps.sh
+++ b/misc/make-deps.sh
@@ -38,6 +38,10 @@ if [ ! -z "$APT" ]; then
 	$sudo_command $APT install -y libpcap0.8-dev || true
 	# dependencies for building debian packages with `make deb`
 	$sudo_command $APT install -y dpkg-dev devscripts debhelper dh-golang dh-systemd
+	# `realpath` is a more universal alternative to `readlink -f` for absolute path resolution
+	# (-f is missing on BSD/macOS), but older Debian/Ubuntu's don't include it in coreutils yet.
+	# https://unix.stackexchange.com/a/136527
+	$sudo_command $APT install -y realpath || true
 fi
 
 if [ ! -z "$BREW" ]; then
diff --git a/test/shell/augeas-1.sh b/test/shell/augeas-1.sh
index 87b78304..321d1516 100755
--- a/test/shell/augeas-1.sh
+++ b/test/shell/augeas-1.sh
@@ -10,7 +10,7 @@ mkdir -p "${MGMT_TMPDIR}"
 > "${MGMT_TMPDIR}"sshd_config
 
 # run empty graph, with prometheus support
-$timeout --kill-after=60s 55s ./mgmt run --tmp-prefix --yaml=augeas-1.yaml &
+$timeout --kill-after=60s 55s "$MGMT" run --tmp-prefix --yaml=augeas-1.yaml &
 pid=$!
 sleep 10s	# let it converge
 
diff --git a/test/shell/exec-fail.sh b/test/shell/exec-fail.sh
index 96bd9ac0..bc86720f 100755
--- a/test/shell/exec-fail.sh
+++ b/test/shell/exec-fail.sh
@@ -3,7 +3,7 @@
 # should take a few seconds plus converged timeout, and test we don't hang!
 # TODO: should we return a different exit code if the resources fail?
 # TODO: should we be converged if one of the resources has permanently failed?
-$timeout --kill-after=60s 55s ./mgmt run --yaml exec-fail.yaml --converged-timeout=5 --no-watch --no-pgp --tmp-prefix &
+$timeout --kill-after=60s 55s "$MGMT" run --yaml exec-fail.yaml --converged-timeout=5 --no-watch --no-pgp --tmp-prefix &
 pid=$!
 wait $pid	# get exit status
 exit $?
diff --git a/test/shell/exec-usergroup.sh b/test/shell/exec-usergroup.sh
index 578c81cd..a3b80b73 100755
--- a/test/shell/exec-usergroup.sh
+++ b/test/shell/exec-usergroup.sh
@@ -38,7 +38,7 @@ function run_usergroup_test() {
 	setup
 
 	# run till completion
-	sudo -A timeout --kill-after=30s 25s ./mgmt run --yaml ./exec-usergroup/${graph} --converged-timeout=5 --no-watch --tmp-prefix &
+	sudo -A timeout --kill-after=30s 25s "$MGMT" run --yaml ./exec-usergroup/${graph} --converged-timeout=5 --no-watch --tmp-prefix &
 	pid=$!
 	wait $pid	# get exit status
 	e=$?
diff --git a/test/shell/file-mode.sh b/test/shell/file-mode.sh
index aef2ca63..08f26e65 100755
--- a/test/shell/file-mode.sh
+++ b/test/shell/file-mode.sh
@@ -9,7 +9,7 @@ fi
 set -x
 
 # run till completion
-$timeout --kill-after=60s 55s ./mgmt run --yaml file-mode.yaml --converged-timeout=5 --no-watch --tmp-prefix &
+$timeout --kill-after=60s 55s "$MGMT" run --yaml file-mode.yaml --converged-timeout=5 --no-watch --tmp-prefix &
 pid=$!
 wait $pid	# get exit status
 e=$?
diff --git a/test/shell/file-move-upper-dir.sh b/test/shell/file-move-upper-dir.sh
index c77eb985..6dec6287 100755
--- a/test/shell/file-move-upper-dir.sh
+++ b/test/shell/file-move-upper-dir.sh
@@ -7,7 +7,7 @@ exit 0
 mkdir -p /tmp/mgmt/a/b/c/
 
 # run empty graph, with prometheus support
-$timeout --kill-after=60s 55s ./mgmt run --tmp-prefix --yaml=examples/deep-dirs.yaml &
+$timeout --kill-after=60s 55s "$MGMT" run --tmp-prefix --yaml=examples/deep-dirs.yaml &
 pid=$!
 sleep 10s	# let it converge
 
diff --git a/test/shell/file-move.sh b/test/shell/file-move.sh
index dab57472..8e0add4a 100755
--- a/test/shell/file-move.sh
+++ b/test/shell/file-move.sh
@@ -10,7 +10,7 @@ mkdir -p /tmp/mgmt/
 rm /tmp/mgmt/f1 || true
 
 # run empty graph, with prometheus support
-$timeout --kill-after=60s 55s ./mgmt run --tmp-prefix --yaml=file-move.yaml 2>&1 | tee /tmp/mgmt/file-move.log &
+$timeout --kill-after=60s 55s "$MGMT" run --tmp-prefix --yaml=file-move.yaml 2>&1 | tee /tmp/mgmt/file-move.log &
 pid=$!
 sleep 5s	# let it converge
 
diff --git a/test/shell/file-owner.sh b/test/shell/file-owner.sh
index e7961ce9..abb4a318 100755
--- a/test/shell/file-owner.sh
+++ b/test/shell/file-owner.sh
@@ -9,7 +9,7 @@ if ! timeout 1s sudo -A true; then
 fi
 
 # run till completion
-$timeout --kill-after=30s 25s sudo -A ./mgmt run --yaml file-owner.yaml --converged-timeout=5 --no-watch --tmp-prefix &
+$timeout --kill-after=30s 25s sudo -A "$MGMT" run --yaml file-owner.yaml --converged-timeout=5 --no-watch --tmp-prefix &
 pid=$!
 wait $pid	# get exit status
 e=$?
diff --git a/test/shell/graph-exit1.sh b/test/shell/graph-exit1.sh
index 37845b98..6dad88b3 100755
--- a/test/shell/graph-exit1.sh
+++ b/test/shell/graph-exit1.sh
@@ -2,7 +2,7 @@
 
 # should take 15 seconds for longest resources plus startup time to shutdown
 # we don't want the ^C to allow the rest of the graph to continue executing!
-$timeout --kill-after=65s 55s ./mgmt run --yaml graph-exit1.yaml --no-watch --no-pgp --tmp-prefix &
+$timeout --kill-after=65s 55s "$MGMT" run --yaml graph-exit1.yaml --no-watch --no-pgp --tmp-prefix &
 pid=$!
 sleep 5s	# let the initial resources start to run...
 killall -SIGINT mgmt	# send ^C to exit mgmt
diff --git a/test/shell/graph-exit2.sh b/test/shell/graph-exit2.sh
index 56b8f8c6..64a4b651 100755
--- a/test/shell/graph-exit2.sh
+++ b/test/shell/graph-exit2.sh
@@ -2,7 +2,7 @@
 
 # should take 15 seconds for longest resources plus startup time to shutdown
 # we don't want the ^C to allow the rest of the graph to continue executing!
-$timeout --kill-after=65s 55s ./mgmt run --yaml graph-exit2.yaml --no-watch --no-pgp --tmp-prefix &
+$timeout --kill-after=65s 55s "$MGMT" run --yaml graph-exit2.yaml --no-watch --no-pgp --tmp-prefix &
 pid=$!
 sleep 10s	# let the initial resources start to run...
 killall -SIGINT mgmt	# send ^C to exit mgmt
diff --git a/test/shell/graph-fanin-1.sh b/test/shell/graph-fanin-1.sh
index 33424e2d..ab222ff2 100755
--- a/test/shell/graph-fanin-1.sh
+++ b/test/shell/graph-fanin-1.sh
@@ -1,7 +1,7 @@
 #!/bin/bash -e
 
 # should take more than 25s plus overhead
-$timeout --kill-after=50s 45s ./mgmt run --yaml graph-fanin-1.yaml --converged-timeout=5 --no-watch --tmp-prefix --no-pgp &
+$timeout --kill-after=50s 45s "$MGMT" run --yaml graph-fanin-1.yaml --converged-timeout=5 --no-watch --tmp-prefix --no-pgp &
 pid=$!
 wait $pid	# get exit status
 exit $?
diff --git a/test/shell/load0.sh b/test/shell/load0.sh
index 53ebee00..8ac69ec8 100755
--- a/test/shell/load0.sh
+++ b/test/shell/load0.sh
@@ -34,7 +34,7 @@ file "${tmpdir}/loadavg" {
 }
 EOF
 
-$timeout --kill-after=60s 55s ./mgmt run --tmp-prefix --converged-timeout=1 --lang "$tmpdir/load0.mcl"  &
+$timeout --kill-after=60s 55s "$MGMT" run --tmp-prefix --converged-timeout=1 --lang "$tmpdir/load0.mcl"  &
 pid=$!
 wait $pid	# get exit status
 e=$?
diff --git a/test/shell/prometheus-1.sh b/test/shell/prometheus-1.sh
index a47db819..5480c9c7 100755
--- a/test/shell/prometheus-1.sh
+++ b/test/shell/prometheus-1.sh
@@ -1,7 +1,7 @@
 #!/bin/bash -e
 
 # run empty graph, with prometheus support
-$timeout --kill-after=60s 55s ./mgmt run --tmp-prefix --prometheus &
+$timeout --kill-after=60s 55s "$MGMT" run --tmp-prefix --prometheus &
 pid=$!
 sleep 5s	# let it converge
 
diff --git a/test/shell/prometheus-2.sh b/test/shell/prometheus-2.sh
index 3f520675..cabf9ee8 100755
--- a/test/shell/prometheus-2.sh
+++ b/test/shell/prometheus-2.sh
@@ -1,7 +1,7 @@
 #!/bin/bash -e
 
 # run empty graph, with prometheus support
-$timeout --kill-after=60s 55s ./mgmt run --tmp-prefix --prometheus --prometheus-listen :52637 &
+$timeout --kill-after=60s 55s "$MGMT" run --tmp-prefix --prometheus --prometheus-listen :52637 &
 pid=$!
 sleep 5s	# let it converge
 
diff --git a/test/shell/prometheus-3.sh b/test/shell/prometheus-3.sh
index 31f30ab6..0b0e0f45 100755
--- a/test/shell/prometheus-3.sh
+++ b/test/shell/prometheus-3.sh
@@ -7,7 +7,7 @@ if [[ $(uname) == "Darwin" ]] ; then
 fi
 
 # run a graph, with prometheus support
-$timeout --kill-after=60s 55s ./mgmt run --tmp-prefix --no-pgp --prometheus --yaml prometheus-3.yaml &
+$timeout --kill-after=60s 55s "$MGMT" run --tmp-prefix --no-pgp --prometheus --yaml prometheus-3.yaml &
 pid=$!
 sleep 10s	# let it converge
 
diff --git a/test/shell/prometheus-4.sh b/test/shell/prometheus-4.sh
index 4b970e1d..c3d2db5c 100755
--- a/test/shell/prometheus-4.sh
+++ b/test/shell/prometheus-4.sh
@@ -7,7 +7,7 @@ if [[ $(uname) == "Darwin" ]] ; then
 fi
 
 # run a graph, with prometheus support
-$timeout --kill-after=60s 55s ./mgmt run --tmp-prefix --no-pgp --prometheus --yaml prometheus-4.yaml &
+$timeout --kill-after=60s 55s "$MGMT" run --tmp-prefix --no-pgp --prometheus --yaml prometheus-4.yaml &
 pid=$!
 sleep 15s	# let it converge
 
diff --git a/test/shell/sema-1.sh b/test/shell/sema-1.sh
index 8c9cb212..68e720de 100755
--- a/test/shell/sema-1.sh
+++ b/test/shell/sema-1.sh
@@ -2,7 +2,7 @@
 
 # should take at least 55s, but fail if we block this
 # TODO: it would be nice to make sure this test doesn't exit too early!
-$timeout --kill-after=120s 110s ./mgmt run --yaml sema-1.yaml --sema 2 --converged-timeout=5 --no-watch --no-pgp --tmp-prefix &
+$timeout --kill-after=120s 110s "$MGMT" run --yaml sema-1.yaml --sema 2 --converged-timeout=5 --no-watch --no-pgp --tmp-prefix &
 pid=$!
 wait $pid	# get exit status
 exit $?
diff --git a/test/shell/t1.sh b/test/shell/t1.sh
index 2d3b02df..ac0218be 100755
--- a/test/shell/t1.sh
+++ b/test/shell/t1.sh
@@ -9,7 +9,7 @@
 set -o errexit
 set -o pipefail
 
-$timeout --kill-after=3s 1s ./mgmt --help # hello world!
+$timeout --kill-after=3s 1s "$MGMT" --help # hello world!
 pid=$!
 wait $pid	# get exit status
 exit $?
diff --git a/test/shell/t2.sh b/test/shell/t2.sh
index d436db73..2cfc7fbd 100755
--- a/test/shell/t2.sh
+++ b/test/shell/t2.sh
@@ -7,7 +7,7 @@ if env | grep -q -e '^TRAVIS=true$'; then
 fi
 
 # run till completion
-$timeout --kill-after=15s 10s ./mgmt run --yaml t2.yaml --converged-timeout=5 --no-watch --tmp-prefix &
+$timeout --kill-after=15s 10s "$MGMT" run --yaml t2.yaml --converged-timeout=5 --no-watch --tmp-prefix &
 pid=$!
 wait $pid	# get exit status
 e=$?
diff --git a/test/shell/t3.sh b/test/shell/t3.sh
index 6f226ddb..16812047 100755
--- a/test/shell/t3.sh
+++ b/test/shell/t3.sh
@@ -10,11 +10,11 @@ fi
 mkdir -p "${MGMT_TMPDIR}"mgmt{A..C}
 
 # run till completion
-$timeout --kill-after=15s 10s ./mgmt run --yaml t3-a.yaml --converged-timeout=5 --no-watch --tmp-prefix &
+$timeout --kill-after=15s 10s "$MGMT" run --yaml t3-a.yaml --converged-timeout=5 --no-watch --tmp-prefix &
 pid1=$!
-$timeout --kill-after=15s 10s ./mgmt run --yaml t3-b.yaml --converged-timeout=5 --no-watch --tmp-prefix &
+$timeout --kill-after=15s 10s "$MGMT" run --yaml t3-b.yaml --converged-timeout=5 --no-watch --tmp-prefix &
 pid2=$!
-$timeout --kill-after=15s 10s ./mgmt run --yaml t3-c.yaml --converged-timeout=5 --no-watch --tmp-prefix &
+$timeout --kill-after=15s 10s "$MGMT" run --yaml t3-c.yaml --converged-timeout=5 --no-watch --tmp-prefix &
 pid3=$!
 
 wait $pid1	# get exit status
diff --git a/test/shell/t5.sh b/test/shell/t5.sh
index 33c6ebea..6af2e8b2 100755
--- a/test/shell/t5.sh
+++ b/test/shell/t5.sh
@@ -1,7 +1,7 @@
 #!/bin/bash -e
 
 # should take slightly more than 35s, but fail if we take much longer)
-$timeout --kill-after=55s 50s ./mgmt run --yaml t5.yaml --converged-timeout=5 --no-watch --no-pgp --tmp-prefix &
+$timeout --kill-after=55s 50s "$MGMT" run --yaml t5.yaml --converged-timeout=5 --no-watch --no-pgp --tmp-prefix &
 pid=$!
 wait $pid	# get exit status
 exit $?
diff --git a/test/shell/t5b.sh b/test/shell/t5b.sh
index 7995128f..3eb42b52 100755
--- a/test/shell/t5b.sh
+++ b/test/shell/t5b.sh
@@ -1,7 +1,7 @@
 #!/bin/bash -e
 
 # should take slightly more than 35s, but fail if we take much longer)
-$timeout --kill-after=55s 50s ./mgmt run --yaml t5b.yaml --converged-timeout=5 --no-watch --no-pgp --tmp-prefix &
+$timeout --kill-after=55s 50s "$MGMT" run --yaml t5b.yaml --converged-timeout=5 --no-watch --no-pgp --tmp-prefix &
 pid=$!
 wait $pid	# get exit status
 exit $?
diff --git a/test/shell/t6.sh b/test/shell/t6.sh
index 27b31ec7..b39cf070 100755
--- a/test/shell/t6.sh
+++ b/test/shell/t6.sh
@@ -7,7 +7,7 @@ if env | grep -q -e '^TRAVIS=true$'; then
 fi
 
 # run till completion
-$timeout --kill-after=60s 55s ./mgmt run --yaml t6.yaml --no-watch --tmp-prefix &
+$timeout --kill-after=60s 55s "$MGMT" run --yaml t6.yaml --no-watch --tmp-prefix &
 pid=$!
 sleep 10s	# let it converge
 test -e /tmp/mgmt/f1
diff --git a/test/shell/t7.sh b/test/shell/t7.sh
index ff651d7a..3af554c9 100755
--- a/test/shell/t7.sh
+++ b/test/shell/t7.sh
@@ -1,7 +1,7 @@
 #!/bin/bash -e
 
 # run empty graph
-$timeout --kill-after=45s 35s ./mgmt run --tmp-prefix --no-pgp &
+$timeout --kill-after=45s 35s "$MGMT" run --tmp-prefix --no-pgp &
 pid=$!
 sleep 10s	# let it converge
 $(sleep 3s && killall -SIGINT mgmt)&	# send ^C to exit mgmt
diff --git a/test/shell/t8.sh b/test/shell/t8.sh
index 0a175633..a4dae8c6 100755
--- a/test/shell/t8.sh
+++ b/test/shell/t8.sh
@@ -3,11 +3,11 @@
 exit 0	# XXX: test temporarily disabled till etcd or mgmt regression is fixed.
 
 # run empty graphs, we're just testing etcd clustering
-$timeout --kill-after=180s 120s ./mgmt run --hostname h1 --tmp-prefix &
+$timeout --kill-after=180s 120s "$MGMT" run --hostname h1 --tmp-prefix &
 pid1=$!
 sleep 15s	# let it startup
 
-$timeout --kill-after=180s 120s ./mgmt run --hostname h2 --seeds http://127.0.0.1:2379 --client-urls http://127.0.0.1:2381 --server-urls http://127.0.0.1:2382 --tmp-prefix &
+$timeout --kill-after=180s 120s "$MGMT" run --hostname h2 --seeds http://127.0.0.1:2379 --client-urls http://127.0.0.1:2381 --server-urls http://127.0.0.1:2382 --tmp-prefix &
 pid2=$!
 sleep 15s
 
diff --git a/test/shell/yaml-change1.sh b/test/shell/yaml-change1.sh
index f84c67cf..c9bab4df 100755
--- a/test/shell/yaml-change1.sh
+++ b/test/shell/yaml-change1.sh
@@ -14,7 +14,7 @@ fi
 
 # set the config file
 cp -a yaml-change1a.yaml /tmp/mgmt/yaml-change.yaml
-$timeout --kill-after=30s 20s ./mgmt run --yaml /tmp/mgmt/yaml-change.yaml --tmp-prefix &
+$timeout --kill-after=30s 20s "$MGMT" run --yaml /tmp/mgmt/yaml-change.yaml --tmp-prefix &
 pid=$!
 sleep 5s	# let it converge
 grep -q 'hello world' /tmp/mgmt/change1	# check contents are correct
diff --git a/test/test-shell.sh b/test/test-shell.sh
index d753daee..b97c48c8 100755
--- a/test/test-shell.sh
+++ b/test/test-shell.sh
@@ -21,8 +21,6 @@ fi
 LINE=$(printf '=%.0s' `seq -s ' ' $(tput cols)`)	# a terminal width string
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && cd .. && pwd )"	# dir!
 cd "$DIR" >/dev/null	# work from main mgmt directory
-MGMT="$DIR/test/shell/mgmt"
-cp -a "$DIR/mgmt" "$MGMT"	# put a copy there
 failures=""
 count=0
 
diff --git a/test/util.sh b/test/util.sh
index 66e95128..3b8bf741 100755
--- a/test/util.sh
+++ b/test/util.sh
@@ -2,6 +2,12 @@
 
 # common settings and functions for test scripts
 
+# get the fully expanded path of the project directory
+ROOT="$(realpath "$(dirname "$(realpath "${BASH_SOURCE}")")/..")"
+
+# absolute location to freshly build binary to be used for testing
+export MGMT="$ROOT/mgmt"
+
 if [[ $(uname) == "Darwin" ]] ; then
 	export timeout="gtimeout"
 	export mktemp="gmktemp"