diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2cdd75e357..a324d4e3e2 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -76,4 +76,12 @@ jobs:
     - name: Build cryptography
       run: cargo build --target wasm32-unknown-unknown --release --manifest-path cryptography/Cargo.toml && du -h target/wasm32-unknown-unknown/release/commonware_cryptography.wasm
     - name: Build utils
-      run: cargo build --target wasm32-unknown-unknown --release --manifest-path utils/Cargo.toml && du -h target/wasm32-unknown-unknown/release/commonware_utils.wasm
\ No newline at end of file
+      run: cargo build --target wasm32-unknown-unknown --release --manifest-path utils/Cargo.toml && du -h target/wasm32-unknown-unknown/release/commonware_utils.wasm
+
+  Scripts:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Run shellcheck
+      run: find scripts -name "*.sh" -exec shellcheck -o all {} +
\ No newline at end of file
diff --git a/scripts/bump_versions.sh b/scripts/bump_versions.sh
index fee58b9b98..093175d459 100755
--- a/scripts/bump_versions.sh
+++ b/scripts/bump_versions.sh
@@ -9,9 +9,9 @@ set -euo pipefail
 bump_version() {
   local old="$1"
   local major minor patch
-  IFS='.' read -r major minor patch <<< "$old"
+  IFS='.' read -r major minor patch <<< "${old}"
   patch=$((patch + 1))
-  echo "$major.$minor.$patch"
+  echo "${major}.${minor}.${patch}"
 }
 
 # Recursively find all Cargo.toml files
@@ -24,35 +24,35 @@ find . -name "Cargo.toml" | while read -r cargo_file; do
   name=""
   while IFS= read -r line; do
     # 1) Match workspace deps like: commonware-foo = { version = "0.0.3", path = "foo" }
-    if [[ "$line" =~ ^[[:space:]]*(commonware-[^[:space:]]+)[[:space:]]*=\ {[[:space:]]*version[[:space:]]*=[[:space:]]*\"([0-9]+\.[0-9]+\.[0-9]+)\" ]]; then
+    if [[ "${line}" =~ ^[[:space:]]*(commonware-[^[:space:]]+)[[:space:]]*=\ {[[:space:]]*version[[:space:]]*=[[:space:]]*\"([0-9]+\.[0-9]+\.[0-9]+)\" ]]; then
       old="${BASH_REMATCH[2]}"
-      new="$(bump_version "$old")"
-      line="${line/$old/$new}"
+      new="$(bump_version "${old}")"
+      line="${line/${old}/${new}}"
       changed=true
     fi
 
     # 2) Check for package name lines like: name = "commonware-foo"
-    if [[ "$line" =~ ^[[:space:]]*name[[:space:]]*=[[:space:]]*\"(commonware-[^\"]+)\" ]]; then
+    if [[ "${line}" =~ ^[[:space:]]*name[[:space:]]*=[[:space:]]*\"(commonware-[^\"]+)\" ]]; then
       name="${BASH_REMATCH[1]}"
     else
       # 3) If name is set, we may be on a version line
-      if [[ -n "$name" && "$line" =~ ^[[:space:]]*version[[:space:]]*=[[:space:]]*\"([0-9]+\.[0-9]+\.[0-9]+)\" ]]; then
+      if [[ -n "${name}" && "${line}" =~ ^[[:space:]]*version[[:space:]]*=[[:space:]]*\"([0-9]+\.[0-9]+\.[0-9]+)\" ]]; then
         old="${BASH_REMATCH[1]}"
-        new="$(bump_version "$old")"
-        line="${line/$old/$new}"
+        new="$(bump_version "${old}")"
+        line="${line/${old}/${new}}"
         changed=true
         name=""
       fi
     fi
 
-    content+=("$line")
-  done < "$cargo_file"
+    content+=("${line}")
+  done < "${cargo_file}"
 
   # If we changed anything, overwrite the file
-  if $changed; then
+  if ${changed}; then
     for line in "${content[@]}"; do
-      printf "%s\n" "$line"
-    done > "$cargo_file"
-    echo "Updated $cargo_file"
+      printf "%s\n" "${line}"
+    done > "${cargo_file}"
+    echo "Updated ${cargo_file}"
   fi
 done