diff --git a/.github/workflows/script_checks.yml b/.github/workflows/script_checks.yml
new file mode 100644
index 0000000000..c32a433e46
--- /dev/null
+++ b/.github/workflows/script_checks.yml
@@ -0,0 +1,21 @@
+name: Script
+
+on:
+  pull_request:
+    paths:
+      - "script/**"
+  push:
+    branches:
+      - main
+
+jobs:
+  shellcheck:
+    name: "ShellCheck Scripts"
+    if: github.repository_owner == 'zed-industries'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - name: Shellcheck ./scripts
+        run: |
+          ./script/shellcheck-scripts error
diff --git a/script/analyze_highlights.py b/script/analyze_highlights.py
index 1fd16f2c0f..09a6419653 100644
--- a/script/analyze_highlights.py
+++ b/script/analyze_highlights.py
@@ -1,3 +1,4 @@
+#!/usr/bin/env python3
 """
 This script analyzes all the highlight.scm files in our embedded languages and extensions.
 It counts the number of unique instances of @{name} and the languages in which they are used.
diff --git a/script/bundle-linux b/script/bundle-linux
index 2aa1dcab4a..98b49ae4da 100755
--- a/script/bundle-linux
+++ b/script/bundle-linux
@@ -69,7 +69,9 @@ strip --strip-debug "${target_dir}/${remote_server_triple}/release/remote_server
 
 
 # Ensure that remote_server does not depend on libssl nor libcrypto, as we got rid of these deps.
-! ldd "${target_dir}/${remote_server_triple}/release/remote_server" | grep -q 'libcrypto\|libssl'
+if ldd "${target_dir}/${remote_server_triple}/release/remote_server" | grep -q 'libcrypto\|libssl'; then
+    echo "Error: remote_server still depends on libssl or libcrypto" && exit 1
+fi
 
 suffix=""
 if [ "$channel" != "stable" ]; then
@@ -89,8 +91,8 @@ cp "${target_dir}/${target_triple}/release/cli" "${zed_dir}/bin/zed"
 # Libs
 find_libs() {
     ldd ${target_dir}/${target_triple}/release/zed |\
-    cut -d' ' -f3 |\
-    grep -v '\<\(libstdc++.so\|libc.so\|libgcc_s.so\|libm.so\|libpthread.so\|libdl.so\)'
+        cut -d' ' -f3 |\
+        grep -v '\<\(libstdc++.so\|libc.so\|libgcc_s.so\|libm.so\|libpthread.so\|libdl.so\)'
 }
 
 mkdir -p "${zed_dir}/lib"
diff --git a/script/clear-target-dir-if-larger-than b/script/clear-target-dir-if-larger-than
index d23c111ec1..691ff42ffd 100755
--- a/script/clear-target-dir-if-larger-than
+++ b/script/clear-target-dir-if-larger-than
@@ -2,7 +2,7 @@
 
 set -eu
 
-if [[ $# < 1 ]]; then
+if [[ $# -ne 1 ]]; then
     echo "usage: $0 <MAX_SIZE_IN_GB>"
     exit 1
 fi
diff --git a/script/deploy-postgrest b/script/deploy-postgrest
index 14fbd50e30..2a0b21a991 100755
--- a/script/deploy-postgrest
+++ b/script/deploy-postgrest
@@ -3,7 +3,7 @@
 set -eu
 source script/lib/deploy-helpers.sh
 
-if [[ $# < 1 ]]; then
+if [[ $# != 1 ]]; then
   echo "Usage: $0 <production|staging> (postgrest not needed on preview or nightly)"
   exit 1
 fi
diff --git a/script/get-crate-version b/script/get-crate-version
index b6346b32ec..0a35e4d49d 100755
--- a/script/get-crate-version
+++ b/script/get-crate-version
@@ -2,7 +2,7 @@
 
 set -eu
 
-if [[ $# < 1 ]]; then
+if [[ $# -ne 1 ]]; then
   echo "Usage: $0 <crate_name>" >&2
   exit 1
 fi
@@ -14,4 +14,4 @@ cargo metadata \
     --format-version=1 \
     | jq \
         --raw-output \
-        ".packages[] | select(.name == \"${CRATE_NAME}\") | .version"
\ No newline at end of file
+        ".packages[] | select(.name == \"${CRATE_NAME}\") | .version"
diff --git a/script/kube-shell b/script/kube-shell
index 9181dc959c..0ca77acdd0 100755
--- a/script/kube-shell
+++ b/script/kube-shell
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-if [[ $# < 1 ]]; then
+if [[ $# -ne 1 ]]; then
   echo "Usage: $0 [production|staging|...]"
   exit 1
 fi
@@ -8,4 +8,4 @@ fi
 export ZED_KUBE_NAMESPACE=$1
 
 pod=$(kubectl --namespace=${ZED_KUBE_NAMESPACE} get pods --selector=app=zed --output=jsonpath='{.items[*].metadata.name}')
-exec kubectl --namespace $ZED_KUBE_NAMESPACE exec --tty --stdin $pod -- /bin/bash
\ No newline at end of file
+exec kubectl --namespace $ZED_KUBE_NAMESPACE exec --tty --stdin $pod -- /bin/bash
diff --git a/script/metal-debug b/script/metal-debug
index 6fc18e5ebd..de8476f3e3 100755
--- a/script/metal-debug
+++ b/script/metal-debug
@@ -10,4 +10,4 @@ export GPUProfilerEnabled="YES"
 export METAL_DEBUG_ERROR_MODE=0
 export LD_LIBRARY_PATH="/Applications/Xcode.app/Contents/Developer/../SharedFrameworks/"
 
-cargo run $@
+cargo run "$@"
diff --git a/script/shellcheck-scripts b/script/shellcheck-scripts
new file mode 100755
index 0000000000..d42b31d02f
--- /dev/null
+++ b/script/shellcheck-scripts
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+mode=${1:-error}
+[[ "$mode" =~ ^(error|warning)$ ]] || { echo "Usage: $0 [error|warning]"; exit 1; }
+
+cd "$(dirname "$0")/.." || exit 1
+
+find script -maxdepth 1 -type f -print0 |
+  xargs -0 grep -l -E '^#!(/bin/|/usr/bin/env )(sh|bash|dash)' |
+  xargs -r shellcheck -x -S "$mode" -C
diff --git a/script/upload-nightly b/script/upload-nightly
index 61b73d4e56..fd37941981 100755
--- a/script/upload-nightly
+++ b/script/upload-nightly
@@ -19,12 +19,12 @@ if [[ -n "${1:-}" ]]; then
         target="$1"
     else
         echo "Error: Target '$1' is not allowed"
-        echo "Usage: $0 [${allowed_targets[@]}]"
+        echo "Usage: $0 [${allowed_targets[*]}]"
         exit 1
     fi
 else
 echo "Error: Target is not specified"
-echo "Usage: $0 [${allowed_targets[@]}]"
+echo "Usage: $0 [${allowed_targets[*]}]"
 exit 1
 fi
 echo "Uploading nightly for target: $target"