diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3b2f6a5..ed49deb 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -21,6 +21,7 @@ jobs:
           - docker-compose
           - dockerfile
           - jenkinsfile
+          - shell
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
diff --git a/Dockerfile b/Dockerfile
index 3e9e866..654eb32 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -38,6 +38,7 @@ RUN apt-get update; \
         python3-venv \
         rsync \
         tar \
+        xz-utils \
     ;\
     apt-get clean; \
     rm -rf /var/lib/apt/lists/*
@@ -60,6 +61,17 @@ RUN touch /var/mail/ubuntu; \
 
 WORKDIR /tmp/
 
+# shellcheck:
+# renovate: datasource=github-releases depName=koalaman/shellcheck
+ARG SHELLCHECK_VERSION=0.10.0
+RUN curl -OfsSL \
+        "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"; \
+    tar -xf "shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"; \
+    install -m 755 -o root -g root "shellcheck-v${SHELLCHECK_VERSION}/shellcheck" /usr/local/bin/; \
+    rm -r \
+        "shellcheck-v${SHELLCHECK_VERSION}/" \
+        "shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
+
 # hadolint:
 # renovate: datasource=github-releases depName=hadolint/hadolint
 ARG HADOLINT_VERSION=2.12.0
diff --git a/package.json b/package.json
index 59b0892..38f0443 100644
--- a/package.json
+++ b/package.json
@@ -71,6 +71,7 @@
         "system:pip:outdated": "pip list --outdated",
         "test": "run-s test:*",
         "test:markdown": "remark --rc-path .config/remark.json --ignore-path .gitignore .",
+        "test:shell": "git ls-files | grep -e '\\.sh$' | xargs shellcheck",
         "test:spelling": "cspell '**/*.md' --config .config/cspell.json --gitignore --no-progress --relative --show-context",
         "test:wording": "alex",
         "test:ec": "ec",