diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index fca235eea007..1277ad09f661 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -322,6 +322,7 @@ repos:
           ?^dev/release/utils-generate-checksum\.sh$|
           ?^dev/release/utils-watch-gh-workflow\.sh$|
           ?^r/tools/download_dependencies_R\.sh$|
+          ?^r/inst/build_arrow_static\.sh$|
           ?^swift/gen-protobuffers\.sh$|
           )
   - repo: https://github.com/scop/pre-commit-shfmt
diff --git a/r/inst/build_arrow_static.sh b/r/inst/build_arrow_static.sh
index 870e60055c44..34a607cfb6f7 100755
--- a/r/inst/build_arrow_static.sh
+++ b/r/inst/build_arrow_static.sh
@@ -26,18 +26,18 @@ set -x
 # By default, this script assumes it's in the top-level dir of the apache/arrow
 # git repository. Set any of the following env vars to customize where to read
 # and write from
-: ${ARROW_HOME:="$(pwd)"}                       # Only used in default SOURCE/BUILD dirs
-: ${SOURCE_DIR:="${ARROW_HOME}/cpp"}            # Where the C++ source is
-: ${BUILD_DIR:="${ARROW_HOME}/r/libarrow/dist"} # Where cmake should build
-: ${DEST_DIR:="$BUILD_DIR"}                     # Where the resulting /lib and /include should be
-: ${CMAKE:="$(which cmake)"}
+: "${ARROW_HOME:=$(pwd)}"                       # Only used in default SOURCE/BUILD dirs
+: "${SOURCE_DIR:=${ARROW_HOME}/cpp}"            # Where the C++ source is
+: "${BUILD_DIR:=${ARROW_HOME}/r/libarrow/dist}" # Where cmake should build
+: "${DEST_DIR:=$BUILD_DIR}"                     # Where the resulting /lib and /include should be
+: "${CMAKE:=$(which cmake)}"
 
 # Make sure SOURCE and DEST dirs are absolute and exist
 SOURCE_DIR="$(cd "${SOURCE_DIR}" && pwd)"
 DEST_DIR="$(mkdir -p "${DEST_DIR}" && cd "${DEST_DIR}" && pwd)"
 
 if [ "$N_JOBS" = "" ]; then
-  if [ "`uname -s`" = "Darwin" ]; then
+  if [ "$(uname -s)" = "Darwin" ]; then
     N_JOBS="$(sysctl -n hw.logicalcpu)"
   else
     N_JOBS="$(nproc)"
@@ -46,7 +46,7 @@ fi
 
 # Make some env vars case-insensitive
 if [ "$LIBARROW_MINIMAL" != "" ]; then
-  LIBARROW_MINIMAL=`echo $LIBARROW_MINIMAL | tr '[:upper:]' '[:lower:]'`
+  LIBARROW_MINIMAL=$(echo "$LIBARROW_MINIMAL" | tr '[:upper:]' '[:lower:]')
 fi
 
 if [ "$LIBARROW_MINIMAL" = "false" ]; then
@@ -62,61 +62,70 @@ case "$CXX" in
     ;;
 esac
 
+
+CMAKE_COMMAND=("${CMAKE}")
+
 # Used for Emscripten
-: ${CMAKE_WRAPPER:=""}
+if [[ -n "${CMAKE_WRAPPER:-}" ]]; then
+  CMAKE_COMMAND=("${CMAKE_WRAPPER}" "${CMAKE_COMMAND[@]}")
+fi
+
+# Convert the space-separated options into a Bash array.
+# This avoids ShellCheck SC2086 and preserves argument boundaries.
+read -r -a ARROW_EXTRA_CMAKE_FLAGS <<< "${EXTRA_CMAKE_FLAGS}"
 
 mkdir -p "${BUILD_DIR}"
 pushd "${BUILD_DIR}"
-${CMAKE_WRAPPER} ${CMAKE} -DARROW_BOOST_USE_SHARED=OFF \
+"${CMAKE_COMMAND[@]}" -DARROW_BOOST_USE_SHARED=OFF \
     -DARROW_SNAPPY_USE_SHARED=OFF \
     -DARROW_BUILD_TESTS=OFF \
     -DARROW_BUILD_SHARED=OFF \
     -DARROW_BUILD_STATIC=ON \
-    -DARROW_ACERO=${ARROW_ACERO:-ON} \
+    -DARROW_ACERO="${ARROW_ACERO:-ON}" \
     -DARROW_COMPUTE=ON \
     -DARROW_CSV=ON \
-    -DARROW_DATASET=${ARROW_DATASET:-ON} \
-    -DARROW_DEPENDENCY_SOURCE=${ARROW_DEPENDENCY_SOURCE:-AUTO} \
-    -DARROW_DEPENDENCY_USE_SHARED=${ARROW_DEPENDENCY_USE_SHARED:-ON} \
-    -DARROW_ENABLE_THREADING=${ARROW_ENABLE_THREADING:-ON} \
-    -DAWSSDK_SOURCE=${AWSSDK_SOURCE:-} \
-    -DBoost_SOURCE=${Boost_SOURCE:-} \
-    -Dlz4_SOURCE=${lz4_SOURCE:-} \
+    -DARROW_DATASET="${ARROW_DATASET:-ON}" \
+    -DARROW_DEPENDENCY_SOURCE="${ARROW_DEPENDENCY_SOURCE:-AUTO}" \
+    -DARROW_DEPENDENCY_USE_SHARED="${ARROW_DEPENDENCY_USE_SHARED:-ON}" \
+    -DARROW_ENABLE_THREADING="${ARROW_ENABLE_THREADING:-ON}" \
+    -DAWSSDK_SOURCE="${AWSSDK_SOURCE:-}" \
+    -DBoost_SOURCE="${Boost_SOURCE:-}" \
+    -Dlz4_SOURCE="${lz4_SOURCE:-}" \
     -DARROW_FILESYSTEM=ON \
-    -DARROW_GCS=${ARROW_GCS:-OFF} \
-    -DARROW_AZURE=${ARROW_AZURE:-$ARROW_DEFAULT_PARAM} \
-    -DARROW_JEMALLOC=${ARROW_JEMALLOC:-$ARROW_DEFAULT_PARAM} \
-    -DARROW_MIMALLOC=${ARROW_MIMALLOC:-ON} \
-    -DARROW_JSON=${ARROW_JSON:-ON} \
-    -DARROW_PARQUET=${ARROW_PARQUET:-ON} \
-    -DARROW_S3=${ARROW_S3:-$ARROW_DEFAULT_PARAM} \
-    -DARROW_WITH_BROTLI=${ARROW_WITH_BROTLI:-$ARROW_DEFAULT_PARAM} \
-    -DARROW_WITH_BZ2=${ARROW_WITH_BZ2:-$ARROW_DEFAULT_PARAM} \
-    -DARROW_WITH_LZ4=${ARROW_WITH_LZ4:-ON} \
-    -DARROW_WITH_RE2=${ARROW_WITH_RE2:-ON} \
-    -DARROW_WITH_SNAPPY=${ARROW_WITH_SNAPPY:-ON} \
-    -DARROW_WITH_UTF8PROC=${ARROW_WITH_UTF8PROC:-ON} \
-    -DARROW_WITH_ZLIB=${ARROW_WITH_ZLIB:-$ARROW_DEFAULT_PARAM} \
-    -DARROW_WITH_ZSTD=${ARROW_WITH_ZSTD:-$ARROW_DEFAULT_PARAM} \
-    -DARROW_VERBOSE_THIRDPARTY_BUILD=${ARROW_VERBOSE_THIRDPARTY_BUILD:-OFF} \
-    -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE:-Release} \
-    -DCMAKE_FIND_DEBUG_MODE=${CMAKE_FIND_DEBUG_MODE:-OFF} \
+    -DARROW_GCS="${ARROW_GCS:-OFF}" \
+    -DARROW_AZURE="${ARROW_AZURE:-$ARROW_DEFAULT_PARAM}" \
+    -DARROW_JEMALLOC="${ARROW_JEMALLOC:-$ARROW_DEFAULT_PARAM}" \
+    -DARROW_MIMALLOC="${ARROW_MIMALLOC:-ON}" \
+    -DARROW_JSON="${ARROW_JSON:-ON}" \
+    -DARROW_PARQUET="${ARROW_PARQUET:-ON}" \
+    -DARROW_S3="${ARROW_S3:-$ARROW_DEFAULT_PARAM}" \
+    -DARROW_WITH_BROTLI="${ARROW_WITH_BROTLI:-$ARROW_DEFAULT_PARAM}" \
+    -DARROW_WITH_BZ2="${ARROW_WITH_BZ2:-$ARROW_DEFAULT_PARAM}" \
+    -DARROW_WITH_LZ4="${ARROW_WITH_LZ4:-ON}" \
+    -DARROW_WITH_RE2="${ARROW_WITH_RE2:-ON}" \
+    -DARROW_WITH_SNAPPY="${ARROW_WITH_SNAPPY:-ON}" \
+    -DARROW_WITH_UTF8PROC="${ARROW_WITH_UTF8PROC:-ON}" \
+    -DARROW_WITH_ZLIB="${ARROW_WITH_ZLIB:-$ARROW_DEFAULT_PARAM}" \
+    -DARROW_WITH_ZSTD="${ARROW_WITH_ZSTD:-$ARROW_DEFAULT_PARAM}" \
+    -DARROW_VERBOSE_THIRDPARTY_BUILD="${ARROW_VERBOSE_THIRDPARTY_BUILD:-OFF}" \
+    -DCMAKE_BUILD_TYPE="${CMAKE_BUILD_TYPE:-Release}" \
+    -DCMAKE_FIND_DEBUG_MODE="${CMAKE_FIND_DEBUG_MODE:-OFF}" \
     -DCMAKE_INSTALL_LIBDIR=lib \
-    -DCMAKE_INSTALL_PREFIX=${DEST_DIR} \
+    -DCMAKE_INSTALL_PREFIX="${DEST_DIR}" \
     -DCMAKE_EXPORT_NO_PACKAGE_REGISTRY=ON \
     -DCMAKE_FIND_PACKAGE_NO_PACKAGE_REGISTRY=ON \
-    -DCMAKE_UNITY_BUILD=${CMAKE_UNITY_BUILD:-OFF} \
-    -DOPENSSL_ROOT_DIR=${OPENSSL_ROOT_DIR} \
-    -Dabsl_SOURCE=${absl_SOURCE:-BUNDLED} \
-    -Dre2_SOURCE=${re2_SOURCE:-BUNDLED} \
-    -Dsimdjson_SOURCE=${simdjson_SOURCE:-BUNDLED} \
-    -Dxsimd_SOURCE=${xsimd_SOURCE:-} \
-    -Dzstd_SOURCE=${zstd_SOURCE:-} \
-    ${EXTRA_CMAKE_FLAGS} \
+    -DCMAKE_UNITY_BUILD="${CMAKE_UNITY_BUILD:-OFF}" \
+    -DOPENSSL_ROOT_DIR="${OPENSSL_ROOT_DIR}" \
+    -Dabsl_SOURCE="${absl_SOURCE:-BUNDLED}" \
+    -Dre2_SOURCE="${re2_SOURCE:-BUNDLED}" \
+    -Dsimdjson_SOURCE="${simdjson_SOURCE:-BUNDLED}" \
+    -Dxsimd_SOURCE="${xsimd_SOURCE:-}" \
+    -Dzstd_SOURCE="${zstd_SOURCE:-}" \
+    "${ARROW_EXTRA_CMAKE_FLAGS[@]}" \
     -G "${CMAKE_GENERATOR:-Unix Makefiles}" \
-    ${SOURCE_DIR}
+    "${SOURCE_DIR}"
 
-${CMAKE} --build . --target install -- -j $N_JOBS
+"${CMAKE}" --build . --target install -- -j "$N_JOBS"
 
 if command -v sccache &> /dev/null; then
   echo "=== sccache stats after the build ==="