diff --git a/ci/buildkite.yml b/ci/buildkite.yml
index 540a6fe57bab20..a1d8c755dc8bbc 100644
--- a/ci/buildkite.yml
+++ b/ci/buildkite.yml
@@ -29,6 +29,8 @@ steps:
         user: "998:997" # buildkite-agent:buildkite-agent
   - command: "ci/test-cuda.sh"
     label: "cuda"
+  - command: "ci/shellcheck.sh"
+    label: "shellcheck [public]"
   - wait
   - command: "ci/publish.sh"
     label: "publish release artifacts"
diff --git a/ci/coverage.sh b/ci/coverage.sh
index 46d287772d36f0..af5e4e89d1e1b4 100755
--- a/ci/coverage.sh
+++ b/ci/coverage.sh
@@ -1,9 +1,10 @@
 #!/bin/bash -e
 
-cd $(dirname $0)/..
+cd "$(dirname "$0")/.."
 
 if [[ -r ~/.cargo/env ]]; then
   # Pick up local install of kcov/cargo-kcov
+  # shellcheck disable=SC1090
   source ~/.cargo/env
 fi
 
diff --git a/ci/publish.sh b/ci/publish.sh
index 494db9dd89db73..fb700a6ae73778 100755
--- a/ci/publish.sh
+++ b/ci/publish.sh
@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-cd $(dirname $0)/..
+cd "$(dirname "$0")/.."
 
 if [[ -z "$BUILDKITE_TAG" ]]; then
   # Skip publish if this is not a tagged release
diff --git a/ci/shellcheck.sh b/ci/shellcheck.sh
new file mode 100755
index 00000000000000..8a33cec9d5665d
--- /dev/null
+++ b/ci/shellcheck.sh
@@ -0,0 +1,14 @@
+#!/bin/bash -e
+#
+# Reference: https://github.com/koalaman/shellcheck/wiki/Directive
+
+cd "$(dirname "$0")/.."
+
+set -x
+docker pull koalaman/shellcheck
+find . -name "*.sh" -not -regex ".*/.cargo/.*" -print0 \
+  | xargs -0 \
+      docker run -w /work -v "$PWD:/work" \
+        koalaman/shellcheck --color=always --external-sources --shell=bash
+
+exit 0
diff --git a/ci/test-cuda.sh b/ci/test-cuda.sh
index 4b3a451d6cf757..236f4fb0b531c7 100755
--- a/ci/test-cuda.sh
+++ b/ci/test-cuda.sh
@@ -1,17 +1,15 @@
 #!/bin/bash -e
 
-cd $(dirname $0)/..
+cd "$(dirname "$0")/.."
 
-if [[ -z "$libcuda_verify_ed25519_URL" ]]; then
-  echo libcuda_verify_ed25519_URL undefined
-  exit 1
-fi
+: "${libcuda_verify_ed25519_URL:?environment variable undefined}"
 
 export LD_LIBRARY_PATH=/usr/local/cuda/lib64
 export PATH=$PATH:/usr/local/cuda/bin
 curl -X GET -o libcuda_verify_ed25519.a "$libcuda_verify_ed25519_URL"
 
-source $HOME/.cargo/env
+# shellcheck disable=SC1090    # <-- shellcheck can't follow ~
+source ~/.cargo/env
 cargo test --features=cuda
 
 exit 0
diff --git a/ci/test-ignored.sh b/ci/test-ignored.sh
index 832c72a029946e..cab9545c898ec3 100755
--- a/ci/test-ignored.sh
+++ b/ci/test-ignored.sh
@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-cd $(dirname $0)/..
+cd "$(dirname "$0")/.."
 
 rustc --version
 cargo --version
diff --git a/ci/test-nightly.sh b/ci/test-nightly.sh
index 462867937c37cb..843c5ad1ab7ad1 100755
--- a/ci/test-nightly.sh
+++ b/ci/test-nightly.sh
@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-cd $(dirname $0)/..
+cd "$(dirname "$0")/.."
 
 rustc --version
 cargo --version
diff --git a/ci/test-stable.sh b/ci/test-stable.sh
index 31dbbda32e87f9..e1414a9f338c63 100755
--- a/ci/test-stable.sh
+++ b/ci/test-stable.sh
@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-cd $(dirname $0)/..
+cd "$(dirname "$0")/.."
 
 rustc --version
 cargo --version
diff --git a/multinode-demo/client.sh b/multinode-demo/client.sh
index 0c9702fe71d4b0..f6fc01fa8aac01 100755
--- a/multinode-demo/client.sh
+++ b/multinode-demo/client.sh
@@ -1,5 +1,16 @@
-#!/bin/bash
+#!/bin/bash -e
+
+if [[ -z "$1" ]]; then
+  echo "usage: $0 [leader machine]"
+  exit 1
+fi
+
+LEADER="$1"
+
+set -x
 export RUST_LOG=solana=info
-rsync -v -e ssh $1:~/solana/leader.json .
-rsync -v -e ssh $1:~/solana/mint-demo.json .
-cat mint-demo.json | cargo run --release --bin solana-client-demo -- -l leader.json -c 8100 -n 1
+rsync -v -e ssh "$LEADER:~/solana/leader.json" .
+rsync -v -e ssh "$LEADER:~/solana/mint-demo.json" .
+
+cargo run --release --bin solana-client-demo -- \
+  -l leader.json -c 8100 -n 1 < mint-demo.json
diff --git a/multinode-demo/validator.sh b/multinode-demo/validator.sh
index 1e2ce97b0b6516..358364c7f1741f 100755
--- a/multinode-demo/validator.sh
+++ b/multinode-demo/validator.sh
@@ -1,9 +1,24 @@
-#!/bin/bash
-rsync -v -e ssh $1:~/solana/mint-demo.json .
-rsync -v -e ssh $1:~/solana/leader.json .
-rsync -v -e ssh $1:~/solana/genesis.log .
-rsync -v -e ssh $1:~/solana/leader.log .
-rsync -v -e ssh $1:~/solana/libcuda_verify_ed25519.a .
+#!/bin/bash -e
+
+if [[ -z "$1" ]]; then
+  echo "usage: $0 [leader machine]"
+  exit 1
+fi
+
+LEADER="$1"
+
+set -x
+
+rsync -v -e ssh "$LEADER:~/solana/mint-demo.json" .
+rsync -v -e ssh "$LEADER:~/solana/leader.json" .
+rsync -v -e ssh "$LEADER:~/solana/genesis.log" .
+rsync -v -e ssh "$LEADER:~/solana/leader.log" .
+rsync -v -e ssh "$LEADER:~/solana/libcuda_verify_ed25519.a" .
+
 export RUST_LOG=solana=info
+
 sudo sysctl -w net.core.rmem_max=26214400
-cat genesis.log leader.log | cargo run --release --features cuda --bin solana-fullnode -- -l validator.json -s validator.json -v leader.json -b 9000 -d 2>&1 | tee validator-tee.log
+
+cat genesis.log leader.log | \
+  cargo run --release --features cuda --bin solana-fullnode -- \
+    -l validator.json -s validator.json -v leader.json -b 9000 -d 2>&1 | tee validator-tee.log