diff --git a/.circleci/config.yml b/.circleci/config.yml
index 913b0b2f5d1..89e0b630325 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -11,6 +11,7 @@ orbs:
   go: circleci/go@1.5.0
   prettier: ory/prettier@0.0.11
   node: circleci/node@4.2.0
+  shellcheck: circleci/shellcheck@2.2.4
 
 jobs:
 #  test-legacy-migrations:
@@ -55,6 +56,8 @@ jobs:
 
       - nancy/install
       - nancy/check
+      - shellcheck/install
+      - shellcheck/check
       - prettier/install
       - prettier/check
       - prettier/install:
diff --git a/docs/docs/guides/oauth2-public-spa-mobile.mdx b/docs/docs/guides/oauth2-public-spa-mobile.mdx
index ad10946a74e..98d7bc90101 100644
--- a/docs/docs/guides/oauth2-public-spa-mobile.mdx
+++ b/docs/docs/guides/oauth2-public-spa-mobile.mdx
@@ -39,7 +39,7 @@ client_id=...&
 
 :::note
 
-The public clients using a non-https redirect scheme cannot skip
-consent as per OpenID Sepcification & Certification.
+The public clients using a non-https redirect scheme cannot skip consent as per
+OpenID Sepcification & Certification.
 
 :::
diff --git a/install.sh b/install.sh
index 20e40723a49..9f7a736b14e 100644
--- a/install.sh
+++ b/install.sh
@@ -368,7 +368,6 @@ EOF
 PROJECT_NAME="hydra"
 OWNER=ory
 REPO="hydra"
-BINARY=hydra
 FORMAT=tar.gz
 OS=$(uname_os)
 ARCH=$(uname_arch)
diff --git a/internal/certification/scripts/configure.sh b/internal/certification/scripts/configure.sh
index 09f93f112d1..2bb55e2a601 100644
--- a/internal/certification/scripts/configure.sh
+++ b/internal/certification/scripts/configure.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-source $HOME/.profile
+# shellcheck disable=SC1090,SC1091
+source "$HOME"/.profile
 
 hydra clients delete \
     --endpoint http://localhost:9000 \
diff --git a/internal/certification/scripts/install.sh b/internal/certification/scripts/install.sh
index 54f1e60063e..7e73fbbec8c 100644
--- a/internal/certification/scripts/install.sh
+++ b/internal/certification/scripts/install.sh
@@ -10,10 +10,14 @@ sudo apt-get install -y nodejs
 wget https://dl.google.com/go/go1.10.2.linux-amd64.tar.gz
 tar -C /usr/local -xzf go1.10.2.linux-amd64.tar.gz
 mkdir -p go/bin
-echo "export PATH=\$PATH:/usr/local/go/bin" >> $HOME/.profile
-echo "GOPATH=\$HOME/go" >> $HOME/.profile
-echo "export PATH=\$PATH:\$HOME/go" >> $HOME/.profile
-source $HOME/.profile
+{
+    echo "export PATH=\$PATH:/usr/local/go/bin"
+    echo "GOPATH=\$HOME/go"
+    echo "export PATH=\$PATH:\$HOME/go"
+} >> "$HOME"/.profile
+
+# shellcheck disable=SC1090,SC1091
+source "$HOME"/.profile
 
 # go/dep
 curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
diff --git a/internal/certification/scripts/start.sh b/internal/certification/scripts/start.sh
index d3ba7be297c..91aac08afa8 100644
--- a/internal/certification/scripts/start.sh
+++ b/internal/certification/scripts/start.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-source $HOME/.profile
+# shellcheck disable=SC1090,SC1091
+source "$HOME"/.profile
 
 domain=oidc-certification.ory.sh:8443
 hydraport=9000
@@ -19,7 +20,7 @@ curl -i -X DELETE --url http://localhost:8001/apis/login-consent
 curl -i -X POST \
   --url http://localhost:8001/apis/ \
   --data 'name=hydra-oauth' \
-  --data upstream_url=http://${ip}:9000/ \
+  --data upstream_url=http://"${ip}":9000/ \
   --data 'uris=/oauth2,/.well-known,/userinfo,/clients' \
   --data 'strip_uri=false' \
   --data 'preserve_host=true'
@@ -27,13 +28,13 @@ curl -i -X POST \
 curl -i -X POST \
   --url http://localhost:8001/apis/ \
   --data 'name=login-consent' \
-  --data upstream_url=http://$ip:9001/ \
+  --data upstream_url=http://"$ip":9001/ \
   --data 'uris=/login,/consent' \
   --data 'strip_uri=false' \
   --data 'preserve_host=true'
 
 
-(cd ./hydra-login-consent-node; HYDRA_URL=http://localhost:$hydraport PORT=$idport npm start &)
+(cd ./hydra-login-consent-node || exit; HYDRA_URL=http://localhost:$hydraport PORT=$idport npm start &)
 
 PORT=$hydraport \
     OAUTH2_CONSENT_URL=https://$domain/consent \
diff --git a/internal/certification/scripts/update.sh b/internal/certification/scripts/update.sh
index 8e4ef86b05b..ced23c99aac 100644
--- a/internal/certification/scripts/update.sh
+++ b/internal/certification/scripts/update.sh
@@ -1,10 +1,11 @@
 #!/bin/bash
 
-source $HOME/.profile
+# shellcheck disable=SC1090,SC1091
+source "$HOME"/.profile
 
 go get -u -d github.com/ory/hydra
 go get -d -u github.com/devopsfaith/krakend-examples/gin
-(cd $HOME/hydra-login-consent-node; git pull -ff; npm i)
-cd $HOME
+(cd "$HOME"/hydra-login-consent-node || exit; git pull -ff; npm i)
+cd "$HOME" || exit
 go install github.com/ory/hydra
-go install github.com/devopsfaith/krakend-examples/gin
\ No newline at end of file
+go install github.com/devopsfaith/krakend-examples/gin
diff --git a/scripts/run-bench.sh b/scripts/run-bench.sh
index 238379d95c6..6b5cf5ac598 100755
--- a/scripts/run-bench.sh
+++ b/scripts/run-bench.sh
@@ -56,7 +56,6 @@ hydra clients create \
     --endpoint http://localhost:9001
 
 echo "Generating initial access tokens for token introspection benchmark"
-authToken=$(hydra token client --endpoint http://localhost:9000 --client-id $clientId --client-secret $clientSecret)
 introToken=$(hydra token client --endpoint http://localhost:9000 --client-id $clientId --client-secret $clientSecret)
 
 cat >> BENCHMARKS.md << EOF
@@ -94,6 +93,7 @@ hey -n $numReqs -c $numParallel -m POST \
     | tee -a BENCHMARKS.md
 
 
+# shellcheck disable=SC2006
 cat >> BENCHMARKS.md << EOF
 \`\`\`
 
diff --git a/scripts/run-configuration.sh b/scripts/run-configuration.sh
index 6721ec906f7..39c10a565a0 100755
--- a/scripts/run-configuration.sh
+++ b/scripts/run-configuration.sh
@@ -4,6 +4,7 @@ set -Eeuxo pipefail
 
 cd "$( dirname "${BASH_SOURCE[0]}" )/.."
 
+# shellcheck disable=SC2006
 cat > configuration.md << EOF
 ---
 id: configuration
diff --git a/test/conformance/ssl/generate.sh b/test/conformance/ssl/generate.sh
index 0fc9932362d..39779e4c431 100755
--- a/test/conformance/ssl/generate.sh
+++ b/test/conformance/ssl/generate.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 set -euxo pipefail
 cd "$( dirname "${BASH_SOURCE[0]}" )"
diff --git a/test/conformance/start.sh b/test/conformance/start.sh
index 1b03571d5dd..6262d7855bc 100755
--- a/test/conformance/start.sh
+++ b/test/conformance/start.sh
@@ -3,4 +3,5 @@
 set -euxo pipefail
 cd "$( dirname "${BASH_SOURCE[0]}" )/../.."
 
+# shellcheck disable=SC2086
 docker-compose -f quickstart.yml -f quickstart-postgres.yml -f test/conformance/docker-compose.yml up ${1:-} -d