diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 56bef6024..df47cbdbc 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -62,7 +62,7 @@ The linter can be run locally using `composer lint`.
 
 [PHP Parallel Lint]: https://github.com/php-parallel-lint/PHP-Parallel-Lint
 
-## Coding Style
+## PHP Coding Style
 
 Please follow the existing coding style and best practices.
 This project uses [PHP_CodeSniffer][] to detect coding standard violations and apply automated fixes (whenever possible).
@@ -72,6 +72,19 @@ This project uses [PHP_CodeSniffer][] to detect coding standard violations and a
 
 [PHP_CodeSniffer]: https://github.com/squizlabs/PHP_CodeSniffer
 
+## Shell script QA & Coding Style
+
+All shell scripts used in this project are, and should be, located in the `/scripts` directory.
+
+Please follow the existing coding style and best practices.
+This project uses [ShellCheck][] to detect violations.
+
+* Shellcheck can be [installed on all platforms][shellcheck-install]
+* All files can be checked for coding standard violations by running `shellcheck`.
+
+[ShellCheck]:         https://github.com/koalaman/shellcheck
+[shellcheck-install]: https://github.com/koalaman/shellcheck#user-content-installing
+
 ## Unit Tests
 
 PRs should include unit tests for all changes.
diff --git a/.github/workflows/cs.yml b/.github/workflows/cs.yml
index e738b12c0..dc6f5b1c5 100644
--- a/.github/workflows/cs.yml
+++ b/.github/workflows/cs.yml
@@ -67,3 +67,21 @@ jobs:
       - name: Show PHPCS results in PR
         if: ${{ always() && steps.phpcs.outcome == 'failure' }}
         run: cs2pr ./phpcs-report.xml
+
+  shellcheck: #----------------------------------------------------------------------
+    name: 'ShellCheck'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up problem matcher
+        uses: lumaxis/shellcheck-problem-matchers@v2
+        with:
+          format: gcc
+
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@2.0.0
+        with:
+          format: gcc
diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 000000000..02cbe4b93
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,9 @@
+shell=bash
+color=always
+
+external-sources=false
+source-path=/scripts
+source-path=/scripts/proxy
+
+# Turn on all checks.
+enable=all
diff --git a/scripts/proxy/start.sh b/scripts/proxy/start.sh
index e1e30e4b7..77c868602 100755
--- a/scripts/proxy/start.sh
+++ b/scripts/proxy/start.sh
@@ -4,16 +4,17 @@ PROXYDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 PORT=${PORT:-9000}
 
 PROXYBIN=${PROXYBIN:-"$(which mitmdump)"}
-ARGS="-s '$PROXYDIR/proxy.py' -p $PORT"
-if [[ ! -z "$AUTH" ]]; then
-	ARGS="$ARGS --proxyauth $AUTH"
+
+ARGS=(-s "$PROXYDIR/proxy.py" -p "$PORT")
+if [[ -n "$AUTH" ]]; then
+	ARGS+=("--proxyauth" "$AUTH")
 fi
 PIDFILE="$PROXYDIR/proxy-$PORT.pid"
 
 set -x
 
-start-stop-daemon --verbose --start --background --pidfile $PIDFILE --make-pidfile --exec $PROXYBIN -- $ARGS
+start-stop-daemon --verbose --start --background --pidfile "$PIDFILE" --make-pidfile --exec "$PROXYBIN" -- "${ARGS[@]}"
 
-ps -p $(cat $PIDFILE) u
+ps -p "$(cat "$PIDFILE")" u
 sleep 2
-ps -p $(cat $PIDFILE) u
+ps -p "$(cat "$PIDFILE")" u
diff --git a/scripts/proxy/stop.sh b/scripts/proxy/stop.sh
index 8cb0eb92f..805db7e25 100755
--- a/scripts/proxy/stop.sh
+++ b/scripts/proxy/stop.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 
-PROXYDIR="$PWD/$(dirname $0)"
+PROXYDIR="$PWD/$(dirname "$0")"
 PORT=${PORT:-9000}
 
 PIDFILE="$PROXYDIR/proxy-$PORT.pid"
 
 set -x
 
-start-stop-daemon --verbose --stop --pidfile $PIDFILE --remove-pidfile
+start-stop-daemon --verbose --stop --pidfile "$PIDFILE" --remove-pidfile