We investigate routing policies for shortest path problems with uncertain arc lengths. The objective is to minimize a risk measure of the total travel time. We use the conditional value-at-risk (CVaR) for when the arc lengths (durations) have known distributions and the worst-case CVaR for when these distributions are only partially described. Policies which minimize the expected travel time (average-optimal policies) are desirable for experiments that are repeated several times, but the fact that they take no account of risk makes them unsuitable for decisions that need to be taken only once. In these circumstances, policies that minimize a risk measure provide protection against rare events with high cost.