diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 000000000..2762d90ac
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,16 @@
+
+name: Shellcheck
+on:
+  pull_request:
+    branches:
+      - master
+jobs:
+  shellcheck:
+    name: Shellcheck
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Run ShellCheck
+      uses: ludeeus/action-shellcheck@2.0.0
+      env:
+        SHELLCHECK_OPTS: -x # allow outside sources
diff --git a/embedded/scripts/env.sh b/embedded/scripts/env.sh
index f1c93fd90..95928e28e 100644
--- a/embedded/scripts/env.sh
+++ b/embedded/scripts/env.sh
@@ -1,2 +1,4 @@
+# we don't want shebangs in env.sh, disable shellcheck warning
+# shellcheck disable=SC2148
 export RUSTFLAGS="-C link-arg=-Tlink.x"
 export CARGO_TARGET_THUMBV7M_NONE_EABI_RUNNER="qemu-system-arm -cpu cortex-m3 -machine mps2-an385 -nographic -semihosting-config enable=on,target=native -kernel"
\ No newline at end of file
diff --git a/fuzz/cycle.sh b/fuzz/cycle.sh
index 0b59827a1..4e55a295b 100755
--- a/fuzz/cycle.sh
+++ b/fuzz/cycle.sh
@@ -7,7 +7,8 @@
 
 set -e
 REPO_DIR=$(git rev-parse --show-toplevel)
-# shellcheck source=./fuzz-util.sh
+# can't find the file because of the ENV var
+# shellcheck source=/dev/null
 source "$REPO_DIR/fuzz/fuzz-util.sh"
 
 while :
diff --git a/fuzz/fuzz.sh b/fuzz/fuzz.sh
index 5fc65ae63..1932f0413 100755
--- a/fuzz/fuzz.sh
+++ b/fuzz/fuzz.sh
@@ -3,7 +3,8 @@ set -ex
 
 REPO_DIR=$(git rev-parse --show-toplevel)
 
-# shellcheck source=./fuzz-util.sh
+# can't find the file because of the ENV var
+# shellcheck source=/dev/null
 source "$REPO_DIR/fuzz/fuzz-util.sh"
 
 # Check that input files are correct Windows file names
diff --git a/fuzz/generate-files.sh b/fuzz/generate-files.sh
index b2bec2159..29f23d63e 100755
--- a/fuzz/generate-files.sh
+++ b/fuzz/generate-files.sh
@@ -4,7 +4,8 @@ set -e
 
 REPO_DIR=$(git rev-parse --show-toplevel)
 
-# shellcheck source=./fuzz-util.sh
+# can't find the file because of the ENV var
+# shellcheck source=/dev/null
 source "$REPO_DIR/fuzz/fuzz-util.sh"
 
 # 1. Generate fuzz/Cargo.toml