diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
new file mode 100644
index 0000000..977a685
--- /dev/null
+++ b/.github/workflows/lint.yaml
@@ -0,0 +1,24 @@
+name: lint
+
+on: [push]
+
+jobs:
+  lint:
+    name: Run ShellCheck
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Check out code
+      uses: actions/checkout@v4
+
+    - name: Install ShellCheck
+      run: sudo apt-get install shellcheck
+
+    - name: Find shell scripts with \#!/bin/sh or \#!/bin/bash and run ShellCheck
+      run: |
+        files=$(find . -type f ! -path '*/\.*' -exec grep -lE '^#!(/usr)?/bin/(ba)?sh' {} +)
+        if [ -n "$files" ]; then
+          shellcheck -a -S warning $files
+        else
+          echo "No shell scripts with #!/bin/sh or #!/bin/bash shebang found."
+        fi
diff --git a/files/extra-files/etc/rc.d/dsbd_lab b/files/extra-files/etc/rc.d/dsbd_lab
index 3fdb751..dac7852 100755
--- a/files/extra-files/etc/rc.d/dsbd_lab
+++ b/files/extra-files/etc/rc.d/dsbd_lab
@@ -4,6 +4,8 @@
 # REQUIRE: NETWORKING LOGIN FILESYSTEM
 # BEFORE: securelevel
 
+# shellcheck disable=SC2034
+
 . /etc/rc.subr
 
 name="dsbd_lab"
@@ -28,7 +30,7 @@ configure_pot() {
     if [ ! -d "$HOME/pot" ]; then
         git -C $HOME clone https://github.com/digicatapult/pot --no-progress
     fi
-    cd $HOME/pot
+    cd $HOME/pot || exit
 
     # Copy to /usr/local64 for the hybrid ABI port
     for dir in bin etc share; do
@@ -51,7 +53,7 @@ install_act() {
     if [ ! -d "$HOME/act-pot-cheribsd" ]; then
         git -C $HOME clone https://github.com/digicatapult/act-pot-cheribsd --no-progress
     fi
-    cd $HOME/act-pot-cheribsd
+    cd $HOME/act-pot-cheribsd || exit
     # Install runner scripts/flavours
     ./install.sh
 }
@@ -105,25 +107,25 @@ fetch_manifests() {
 }
 
 get_latest_version() {
-    if [ ! -z $(echo releases) ]; then
-        version=$(echo $releases | awk -F " " '{print $NF}')
+    if [ ! -z "$(echo "$releases")" ]; then
+        version=$(echo "$releases" | awk -F " " '{print $NF}')
     else
         version="23.11"
     fi
-    echo $version
+    echo "$version"
 }
 
 create_base() {
     base_name=$(get_latest_version)
 
     # Create a base pot for the latest aarch64c release
-    if [ ! $(pot list -b | grep -Eo '$base_name') ]; then
-        pot create-base -r $base_name
+    if [ ! "$(pot list -b | grep -Eo '$base_name')" ]; then
+        pot create-base -r "$base_name"
     fi
 
     # Copy libraries for the hybrid and benchmark ABIs
     for lib in lib64 lib64cb; do
-        cp -nR /usr/$lib /opt/pot/bases/$base_name/usr/
+        cp -nR /usr/$lib /opt/pot/bases/"$base_name"/usr/
     done
 }
 
@@ -131,8 +133,8 @@ create_base_bridge() {
     bridge_name="bridge-"$(get_latest_version)
 
     # Create a private VNET for the release
-    pot create-private-bridge -B $bridge_name -S 256
-    pot vnet-start -B $bridge_name
+    pot create-private-bridge -B "$bridge_name" -S 256
+    pot vnet-start -B "$bridge_name"
 }
 
 configure_base_sshd() {
@@ -158,7 +160,7 @@ start_pots() {
     max_runners=3
 
     . $HOME/.profile
-    cd "$HOME/act-pot-cheribsd"
+    cd "$HOME/act-pot-cheribsd" || exit
 
     while [ "$count" -lt "$max_runners" ]; do
         # Calculate the index for the next runner
diff --git a/files/update_qemu_morello_config.sh b/files/update_qemu_morello_config.sh
index 4e2971b..25645ea 100755
--- a/files/update_qemu_morello_config.sh
+++ b/files/update_qemu_morello_config.sh
@@ -41,23 +41,28 @@ get_cpu_sockets() {
 
 # Function to get the adjusted number of CPU threads for QEMU
 get_cpu_threads_for_qemu() {
-    local total_threads=$(nproc --all)
+    local total_threads
+    total_threads=$(nproc --all)
     local threads_for_qemu=$((total_threads > CPU_DEDUCTION ? total_threads - CPU_DEDUCTION : MIN_CPU_THREADS))
     echo "$threads_for_qemu"
 }
 
 # Function to get the adjusted memory for QEMU
 get_memory_for_qemu() {
-    local total_mem_mb=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
+    local total_mem_mb
+    total_mem_mb=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
     local mem_for_qemu=$((total_mem_mb > BUFFER_MEM_MB ? total_mem_mb - BUFFER_MEM_MB : total_mem_mb))
     echo "${mem_for_qemu}M"
 }
 
 # Function to write configuration to the config file
 write_config() {
-    local cpu_sockets=$(get_cpu_sockets) || handle_error "Failed to get CPU sockets."
-    local cpu_threads=$(get_cpu_threads_for_qemu) || handle_error "Failed to calculate CPU threads for QEMU."
-    local memory=$(get_memory_for_qemu) || handle_error "Failed to calculate memory for QEMU."
+    local cpu_sockets
+    cpu_sockets=$(get_cpu_sockets) || handle_error "Failed to get CPU sockets."
+    local cpu_threads
+    cpu_threads=$(get_cpu_threads_for_qemu) || handle_error "Failed to calculate CPU threads for QEMU."
+    local memory
+    memory=$(get_memory_for_qemu) || handle_error "Failed to calculate memory for QEMU."
 
     echo "QEMU_SMP=cores=1,threads=${cpu_threads},sockets=${cpu_sockets}" > "$CONFIG_FILE" || handle_error "Failed to write CPU configuration to $CONFIG_FILE."
     echo "QEMU_MEM=${memory}" >> "$CONFIG_FILE" || handle_error "Failed to write memory configuration to $CONFIG_FILE."
diff --git a/scripts/create-cheribsd-image.sh b/scripts/create-cheribsd-image.sh
index 7edd3d7..54a6a26 100644
--- a/scripts/create-cheribsd-image.sh
+++ b/scripts/create-cheribsd-image.sh
@@ -24,9 +24,9 @@ echo "Configuration variables set."
 # Function to run cheribuild to build QEMU
 run_cheribuild_qemu() {
     echo "Running cheribuild to build QEMU..."
-    pushd "$CHERI_HOME" > /dev/null
+    pushd "$CHERI_HOME" > /dev/null || exit
     runuser -u cheri -- "$CHERIBUILD_DIR/cheribuild.py" --build qemu -d
-    popd > /dev/null
+    popd > /dev/null || exit
     echo "Cheribuild QEMU completed."
 }
 
@@ -40,9 +40,9 @@ resize_zfs() {
 # Function to run cheribuild to build the disk image
 run_cheribuild_disk_image() {
     echo "Running cheribuild to build CheriBSD disk image..."
-    pushd "$CHERI_HOME" > /dev/null
+    pushd "$CHERI_HOME" > /dev/null || exit
     runuser -u cheri -- "$CHERIBUILD_DIR/cheribuild.py" --build disk-image-morello-purecap -d --disk-image/rootfs-type zfs --disk-image/path "$DISK_IMAGE_RAW"
-    popd > /dev/null
+    popd > /dev/null || exit
     echo "Cheribuild CheriBSD disk image completed."
 }
 # Function to convert disk image to QCOW2
diff --git a/scripts/install-cheribuild.sh b/scripts/install-cheribuild.sh
index ee02c4a..7333ef9 100644
--- a/scripts/install-cheribuild.sh
+++ b/scripts/install-cheribuild.sh
@@ -60,7 +60,7 @@ determine_zfs_paths() {
 
 configure_sudoers_for_zfs() {
     local paths
-    paths=($(determine_zfs_paths))
+    mapfile -t paths < <(determine_zfs_paths)
 
     local sudo_cmds=""
     for path in "${paths[@]}"; do