diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 93ae9734f..86dff2ea1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,6 +31,7 @@ jobs:
       - prettier
       - alejandra
       - typos
+      - shellcheck
       - translations
       - blueprint-compiler
       - test-pkg-linux
@@ -778,6 +779,40 @@ jobs:
       - name: typos check
         run: nix develop -c typos
 
+  shellcheck:
+    if: github.repository == 'ghostty-org/ghostty'
+    runs-on: namespace-profile-ghostty-xsm
+    timeout-minutes: 60
+    env:
+      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
+      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Setup Cache
+        uses: namespacelabs/nscloud-cache-action@449c929cd5138e6607e7e78458e88cc476e76f89 # v1.2.8
+        with:
+          path: |
+            /nix
+            /zig
+      - uses: cachix/install-nix-action@cebd211ec2008b83bda8fb0b21c3c072f004fe04 # v31.5.0
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          name: ghostty
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          skipPush: true
+          useDaemon: false # sometimes fails on short jobs
+      - name: shellcheck
+        run: |
+          nix develop -c shellcheck \
+            --check-sourced \
+            --color=always \
+            --severity=warning \
+            --shell=bash \
+            --external-sources \
+            $(find . \( -name "*.sh" -o -name "*.bash" \) -type f ! -path "./zig-out/*" ! -path "./macos/build/*" ! -path "./.git/*" | sort)
+
   translations:
     if: github.repository == 'ghostty-org/ghostty'
     runs-on: namespace-profile-ghostty-xsm
diff --git a/nix/build-support/update-mirror.sh b/nix/build-support/update-mirror.sh
index 35fd841e2..f346572ed 100755
--- a/nix/build-support/update-mirror.sh
+++ b/nix/build-support/update-mirror.sh
@@ -6,7 +6,7 @@
 
 set -e  # Exit immediately if a command exits with a non-zero status
 
-SCRIPT_PATH="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+SCRIPT_PATH="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 INPUT_FILE="$SCRIPT_PATH/../../build.zig.zon2json-lock"
 OUTPUT_DIR="blob"
 
diff --git a/nix/devShell.nix b/nix/devShell.nix
index 8a8ab441f..653c0c0b0 100644
--- a/nix/devShell.nix
+++ b/nix/devShell.nix
@@ -61,6 +61,7 @@
   pinact,
   hyperfine,
   typos,
+  shellcheck,
   uv,
   wayland,
   wayland-scanner,
@@ -101,6 +102,7 @@ in
         alejandra
         pinact
         typos
+        shellcheck
 
         # Testing
         parallel
diff --git a/test/run-all.sh b/test/run-all.sh
index 77beb344a..d4a785a44 100755
--- a/test/run-all.sh
+++ b/test/run-all.sh
@@ -9,9 +9,6 @@ DIR=$(cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd)
 # We always copy the bin in case it was rebuilt
 cp ${DIR}/../zig-out/bin/ghostty ${DIR}/
 
-# Build our image once
-IMAGE=$(docker build --file ${DIR}/Dockerfile -q ${DIR})
-
 # Unix shortcut to just execute ./run-host for each one. We can do
 # this less esoterically if we ever wanted.
 find ${DIR}/cases \
@@ -23,4 +20,4 @@ find ${DIR}/cases \
   ${DIR}/run-host.sh \
     --case '{}' \
     --rewrite-abs-path \
-    $@
+    "$@"
diff --git a/test/run-host.sh b/test/run-host.sh
index 887f2cfc1..da9dbe2e5 100755
--- a/test/run-host.sh
+++ b/test/run-host.sh
@@ -13,4 +13,4 @@ docker run \
   --entrypoint "xvfb-run" \
   $IMAGE \
   --server-args="-screen 0, 1600x900x24" \
-  /entrypoint.sh $@
+  /entrypoint.sh "$@"
diff --git a/test/run.sh b/test/run.sh
index 641dc6943..db05ede76 100755
--- a/test/run.sh
+++ b/test/run.sh
@@ -63,6 +63,7 @@ if [ $bad -ne 0 ]; then
 fi
 
 # Load our test case
+# shellcheck disable=SC1090
 source ${ARG_CASE}
 if ! has_func "test_do"; then
   echo "Test case is invalid."
@@ -79,7 +80,7 @@ if [ "$ARG_EXEC" = "ghostty" ]; then
   # We build in Nix (maybe). To be sure, we replace the interpreter so
   # it doesn't point to a Nix path. If we don't build in Nix, this should
   # still be safe.
-  patchelf --set-interpreter /lib/ld-linux-$(uname -m).so.1 ${ARG_EXEC}
+  patchelf --set-interpreter /lib/ld-linux-"$(uname -m)".so.1 ${ARG_EXEC}
 fi
 
 #--------------------------------------------------------------------