diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000..0428d6b
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,26 @@
+name: shellcheck
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install shellcheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+
+      # Only the bash scripts. prestobuntu.zsh, p10k.zsh, zpreztorc and
+      # tmux-new-session.plugin.zsh are zsh, which shellcheck cannot parse.
+      - name: Lint bash scripts
+        run: shellcheck setup create-gruvbox
+
+      - name: Check zsh syntax
+        run: |
+          sudo apt-get install -y zsh
+          zsh -n prestobuntu.zsh
+          zsh -n tmux-new-session.plugin.zsh
diff --git a/setup b/setup
index df939ed..83d86de 100755
--- a/setup
+++ b/setup
@@ -196,7 +196,8 @@ setup_ssh() {
     install_package openssh-server mosh
 
     if [[ -v SSH_REMOTE_ACCESS_PUBKEY ]]; then
-        mkdir -p "$HOME"/.ssh --mode 700
+        mkdir -p "$HOME"/.ssh
+        chmod 700 "$HOME"/.ssh
         touch "$HOME"/.ssh/authorized_keys
         _require_line "$SSH_REMOTE_ACCESS_PUBKEY" "$HOME"/.ssh/authorized_keys
         chmod 600 "$HOME"/.ssh/authorized_keys
@@ -216,7 +217,7 @@ setup_ssh() {
 
 setup_git() {
     install_package git git-lfs
-    get_prestobuntu_file gitconfig $HOME/.gitconfig
+    get_prestobuntu_file gitconfig "$HOME/.gitconfig"
 }
 
 get_internet_file() {
@@ -510,11 +511,14 @@ disable_sleep() {
 
 create_environment_proxy_entries() {
     local file="/etc/environment"
-    if ! grep -q http_proxy $file; then
+    if ! grep -q http_proxy "$file"; then
         echo '#http_proxy=http://192.168.250.10:8888' | sudo tee -a "$file"
     fi
 
-    if ! grep -q https_proxy $file; then
+    if ! grep -q https_proxy "$file"; then
+        # single quotes are deliberate: this writes a commented-out
+        # template line, so $http_proxy must land in the file literally
+        # shellcheck disable=SC2016
         echo '#https_proxy=$http_proxy' | sudo tee -a "$file"
     fi
 }