diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 48a3b0f..3b0f6b9 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -14,6 +14,8 @@ jobs:
     - name: Checkout
       uses: actions/checkout@v2
     - uses: brpaz/hadolint-action@v1.5.0
+    - name: Run ShellCheck
+      uses: ludeeus/action-shellcheck@1.1.0
     - name: Docker meta
       id: meta
       uses: docker/metadata-action@v3
diff --git a/entrypoint.sh b/entrypoint.sh
index fb0ea24..b0c077d 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -3,28 +3,28 @@
 set -e
 
 #remove any stale socket file so that restarts do not fail
-rm -f ${OVERMIND_SOCKET}
+rm -f "${OVERMIND_SOCKET}"
 
 # If GOSU_CHOWN environment variable set, recursively chown all specified directories 
 # to match the user:group set in GOSU_USER environment variable.
 if [ -n "$GOSU_CHOWN" ]; then
   for DIR in $GOSU_CHOWN
   do
-    chown -R $GOSU_USER $DIR
+    chown -R "$GOSU_USER" "$DIR"
   done
 fi
 
-if (( `id -u` == 0 )); then
+if (( $(id -u) == 0 )); then
   chown -R app:app /app || true
 fi
 
 # If GOSU_USER environment variable set to something other than 0:0 (root:root),
 # become user:group set within and exec command passed in args
 if [ -n "$GOSU_USER" ] && [ "$GOSU_USER" != "0:0" ]; then
-  IFS=':' read -r -a uidgid <<< $GOSU_USER
+  IFS=':' read -r -a uidgid <<< "$GOSU_USER"
   groupmod -o -g "${uidgid[1]}" app || true
   usermod -u "${uidgid[0]}" -g "${uidgid[1]}" app
-  exec gosu $GOSU_USER "$@"
+  exec gosu "$GOSU_USER" "$@"
 fi
 
 if [ -n "$OTEL_ENABLED" ]; then
diff --git a/tag.sh b/tag.sh
index d265b2b..0c95782 100755
--- a/tag.sh
+++ b/tag.sh
@@ -1,3 +1,3 @@
 #!/usr/bin/env bash
 
-git tag $(git branch --show-current)-$(date +%Y%m%d) -f
+git tag "$(git branch --show-current)"-"$(date +%Y%m%d)" -f