diff --git a/.github/workflows/_shellcheck.yaml b/.github/workflows/_shellcheck.yaml
new file mode 100644
index 0000000..c1985f7
--- /dev/null
+++ b/.github/workflows/_shellcheck.yaml
@@ -0,0 +1,19 @@
+name: ShellCheck
+
+on:
+  workflow_call:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      # hack/ holds the drift and coverage gates. They decide whether CI
+      # passes, so a quoting mistake there fails builds or, worse, makes a
+      # check silently succeed.
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@2.0.0
+        with:
+          scandir: hack
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 9befc92..cdaafac 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -20,6 +20,9 @@ jobs:
   unicode:
     uses: ./.github/workflows/_unicode-lint.yaml
 
+  shellcheck:
+    uses: ./.github/workflows/_shellcheck.yaml
+
   go:
     uses: ./.github/workflows/_go.yaml
 
diff --git a/Makefile b/Makefile
index d4a257f..f512bbf 100644
--- a/Makefile
+++ b/Makefile
@@ -173,6 +173,15 @@ check-manifests: manifests generate ## Check for CRD and deepcopy drift.
 		exit 1; \
 	fi
 
+.PHONY: shellcheck
+shellcheck: ## Lint the shell scripts in hack/.
+	@if ! command -v shellcheck >/dev/null 2>&1; then \
+		echo "error: shellcheck not found on PATH."; \
+		echo "Install it from https://github.com/koalaman/shellcheck#installing."; \
+		exit 1; \
+	fi
+	shellcheck hack/*.sh
+
 .PHONY: check-rbac
 check-rbac: manifests ## Check the chart RBAC matches the kubebuilder markers.
 	./hack/check-rbac.sh
@@ -186,7 +195,7 @@ check-helm-docs: helm-docs helm-schema ## Check the chart README and schema are
 	fi
 
 .PHONY: ci
-ci: lint vet check-tidy check-coverage check-manifests vulncheck helm-lint helm-unittest check-helm-docs check-rbac ## Run all CI checks locally.
+ci: lint vet shellcheck check-tidy check-coverage check-manifests vulncheck helm-lint helm-unittest check-helm-docs check-rbac ## Run all CI checks locally.
 	@echo "All CI checks passed."
 
 ##@ E2E