diff --git a/ci-checks.sh b/ci-checks.sh
index 303255c5d..5bb449621 100755
--- a/ci-checks.sh
+++ b/ci-checks.sh
@@ -1,8 +1,25 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash
+# shellcheck shell=bash
 
 set -eux
 
-codespell -q 3 -I .codespell-whitelist *
-prettier --check '**/*.json' '**/*.md' '**/*.yml'
-shfmt -l -d .
+failed=0
+
+if ! git ls-files | xargs codespell -q 3 -I .codespell-whitelist; then
+	failed=1
+fi
+
+if ! git ls-files '*.yml' '*.json' '*.md' | xargs prettier --check; then
+	failed=1
+fi
+
+if ! git ls-files '*.sh' | xargs shfmt -l -d; then
+	failed=1
+fi
+
+if ! git ls-files '*.sh' | xargs shellcheck; then
+	failed=1
+fi
+
+exit "$failed"
diff --git a/protos/protoc.sh b/protos/protoc.sh
index bcd8c716d..fa8429298 100755
--- a/protos/protoc.sh
+++ b/protos/protoc.sh
@@ -1,8 +1,8 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 
-for proto in $(echo hardware template workflow); do
+for proto in hardware template workflow; do
 	echo "Generating ${proto}.pb.go..."
-	protoc -I ./ -I ./common/ ${proto}/${proto}.proto --go_out=plugins=grpc:./
+	protoc -I ./ -I ./common/ "${proto}/${proto}.proto" --go_out=plugins=grpc:./
 done
diff --git a/setup.sh b/setup.sh
index f75ece2c8..71227581b 100755
--- a/setup.sh
+++ b/setup.sh
@@ -305,7 +305,7 @@ check_container_status() (
 	esac
 
 	local status
-	read status < <(docker events \
+	read -r status < <(docker events \
 		--since "$start_moment" \
 		--filter "container=$container_id" \
 		--filter "event=health_status" \
diff --git a/shell.nix b/shell.nix
index ea1a2e519..1b613ccf6 100644
--- a/shell.nix
+++ b/shell.nix
@@ -11,6 +11,7 @@ with pkgs;
 
 mkShell {
   buildInputs = [
+    git
     gnumake
     go
     jq
diff --git a/test/push_images.sh b/test/push_images.sh
index 8acb0d2ab..52deb3e2d 100755
--- a/test/push_images.sh
+++ b/test/push_images.sh
@@ -1,10 +1,6 @@
 #!/bin/bash
 
-for i in {1..10}; do
-	docker login -u username -p password localhost
-	if [ $? -eq 0 ]; then
-		break
-	fi
+while ! docker login -u username -p password localhost; do
 	sleep 1
 done
 docker push localhost/update-data