diff --git a/.github/workflows/macos.yml b/.github/macos.yml
similarity index 100%
rename from .github/workflows/macos.yml
rename to .github/macos.yml
diff --git a/.github/shell_check.bsh b/.github/shell_check.bsh
new file mode 100755
index 00000000..75f8bae5
--- /dev/null
+++ b/.github/shell_check.bsh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+# docker run -it --rm -v "${VSI_COMMON_DIR}:/code:ro" registry.gitlab.com/pipeline-components/shellcheck:latest /code/.github/shell_check.bsh
+
+set -eu
+
+SHELLCHECK_ARGS=(
+  # no fancy args with spaces, won't work because of how I pass array below
+  -f json
+  # -S error
+  # -e ...
+)
+
+cd "${GITHUB_WORKSPACE-/code}"
+
+git config --global --add safe.directory /src/external/terra/external/vsi_common
+
+git ls-files -z |
+  xargs -0 -n1 sh -c '[ -f "${1}" ] && \
+                      head -n 1 "$1" | \
+                      grep -qE "^#!.*(bash|false)" \
+                      && echo "$1"' _ | \
+  grep -v '\.simplecov' | \
+  xargs -n10 -P "$(nproc)" bash -c 'shellcheck '"${SHELLCHECK_ARGS[*]}"' "${@}" > /tmp/results.$$; for x in "${@}"; do echo "${x}" processed.; done' _
+  # process 10 at a time, because 50 at a time causes it to hang. 49 worked
+
+mkdir -p /tmp/results
+jq -s add /tmp/results.* > /tmp/results/shellcheck.json
+
+jq -r '.[] | select(.level == "error" or .level == "warning") | "::\(.level) file=\(.file),line=\(.line),endLine=\(.endLine),col=\(.column),endColumn=\(.endColumn),title=ShellCheck::\(.message)"' /tmp/results/shellcheck.json
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 00000000..920f1050
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,27 @@
+name: Shellcheck linting
+
+# This is required
+on:
+  push:
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    container:
+      image: registry.gitlab.com/pipeline-components/shellcheck:latest
+    steps:
+      - name: Preinstall
+        run: |
+          apk add --no-cache git jq
+          git config --global --add safe.directory '*'
+      - name: Checkout repository
+        uses: actions/checkout@v4 # This step will also run inside the container
+        with:
+          submodules: false
+      - name: Run ShellCheck
+        run: "${GITHUB_WORKSPACE}/.github/shell_check.bsh"
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ShellCheck-results
+          path: /tmp/results/shellcheck.json
diff --git a/linux/common_source.sh b/linux/common_source.sh
index f70365a8..7aeda266 100644
--- a/linux/common_source.sh
+++ b/linux/common_source.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env false
+
 #*# linux/common_source
 
 # Use the sh POSIX compliant version of source_once
diff --git a/setup.env b/setup.env
index 703c800d..b58ea558 100644
--- a/setup.env
+++ b/setup.env
@@ -1,3 +1,4 @@
+#!/usr/bin/env false
 test -f ./linux/check_shell && ./linux/check_shell bash zsh
 export JUST_SETUP_SCRIPT="$(basename "${BASH_SOURCE[0]}")"
 source "$(dirname "${BASH_SOURCE[0]}")/env.bsh"
diff --git a/tests/test_colors.sh b/tests/test_colors.sh
index 82936884..ba3b11eb 100644
--- a/tests/test_colors.sh
+++ b/tests/test_colors.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env false
 
 #*# tests/test_colors
 
diff --git a/vsi_common.env b/vsi_common.env
index 91539909..811f50e8 100644
--- a/vsi_common.env
+++ b/vsi_common.env
@@ -1,3 +1,5 @@
+#!/usr/bin/env false
+
 JUST_PROJECT_PREFIX=VSI_COMMON
 source "${VSI_COMMON_DIR}/linux/just_files/just_version.bsh"