diff --git a/.github/scripts/notary/lib.sh b/.github/scripts/notary/lib.sh
index c1d8edda125..0be33995d6c 100644
--- a/.github/scripts/notary/lib.sh
+++ b/.github/scripts/notary/lib.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-SCRIPTDIR=${SCRIPTDIR:="$(dirname $(realpath -s "$0"))"}
+
+SCRIPTDIR=${SCRIPTDIR:="$(dirname "$(realpath -s "$0")")"}
 QUERY_FOLDER=$SCRIPTDIR/graphql
 
 # List project fields like `status`, `tag`, `labels` and other
@@ -10,7 +11,7 @@ function list_project_fields() {
 
     gh api graphql \
         -f project="$project_id" \
-        -f query="$(<$QUERY_FILE)" \
+        -f query="$(<"$QUERY_FILE")" \
         --jq .data.node.fields.nodes | cat
 }
 
@@ -23,8 +24,8 @@ function update_project_item_field() {
         -f project="$1" \
         -f item="$2" \
         -f field="$3" \
-        -f field_value="$4"
-        -f query="$(<$QUERY_FILE)" | cat
+        -f field_value="$4" \
+        -f query="$(<"$QUERY_FILE")" | cat
 }
 
 # Retrieve the organization project identified by:
@@ -43,7 +44,7 @@ function get_project_v2() {
     gh api graphql \
         -f organization="$organization" \
         -F number="$project_number" \
-        -f query="$(<${QUERY_FILE})" \
+        -f query="$(<"$QUERY_FILE")" \
         --jq .data.organization.projectV2 | cat
 }
 
@@ -57,7 +58,7 @@ function add_item_to_project() {
     gh api graphql \
         -f project="$project_id" \
         -f item="$item_id" \
-        -f query="$(<$QUERY_FILE)" \
+        -f query="$(<"$QUERY_FILE")" \
         --jq .data.addProjectV2ItemById.item | cat
 }
 
@@ -66,5 +67,5 @@ function project_status_field_with_init_value() {
     local project_id=$1
     local init_status_name=$2
 
-    list_project_fields $project_id | jq ". | map(select(.name == \"Status\"))[0] | {\"name\": .name, \"id\": .id, \"init_status_id\": .options | map(select(.name == \"$init_status_name\"))[0].id }"
+    list_project_fields "$project_id" | jq ". | map(select(.name == \"Status\"))[0] | {\"name\": .name, \"id\": .id, \"init_status_id\": .options | map(select(.name == \"$init_status_name\"))[0].id }"
 }
diff --git a/.github/scripts/notary/script.sh b/.github/scripts/notary/script.sh
index 60aa843a53e..209ac4a009c 100644
--- a/.github/scripts/notary/script.sh
+++ b/.github/scripts/notary/script.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-SCRIPTDIR=${SCRIPTDIR:="$(dirname $(realpath -s "$0"))"}
+
+SCRIPTDIR=${SCRIPTDIR:="$(dirname "$(realpath -s "$0")")"}
 source "$SCRIPTDIR"/lib.sh
 
 if [ $# -ne 2 ]; then
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index fd9b1881d1d..cfeb6f6b9ca 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -80,6 +80,24 @@ repos:
           - "@cspell/dict-shell"
           - "@cspell/dict-win32"
 
+  # ShellCheck, the static analysis tool for shell scripts
+  #
+  # We do not use the official pre-commit hook [0] because it requires
+  # docker executable (see [1]).
+  # To learn more about a specific error or warning, take a look at
+  # shellcheck's wiki (e.g. for SC1090 directive, see [2]).
+  # [0] https://github.com/koalaman/shellcheck-precommit
+  # [1] https://github.com/koalaman/shellcheck/issues/2495
+  # [2] https://www.shellcheck.net/wiki/SC1090
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.9.0.6
+    hooks:
+      - id: shellcheck
+        args: [
+          --exclude=SC1090,    # Do not follow non-constant sources
+          --severity=warning,  # Optionally only show errors and warnings
+        ]
+
   ########
   # Python
 
diff --git a/cli/run_testenv.sh b/cli/run_testenv.sh
old mode 100644
new mode 100755
index e6a0647a99a..48257f0b2a4
--- a/cli/run_testenv.sh
+++ b/cli/run_testenv.sh
@@ -1,21 +1,19 @@
 #!/usr/bin/env bash
-: '
-Create a temporary environment and initialize a test setup for parsec.
 
-Run `tests/scripts/run_testenv.sh --help` for more information.
-
-For MacOS, please install coreutils from brew to get realpath:
-`brew install coreutils`
-'
+# Create a temporary environment and initialize a test setup for Parsec.
+#
+# For MacOS, please install coreutils from brew to get realpath:
+#`brew install coreutils`
 
 # Make sure this script is sourced
 if [[ "${BASH_SOURCE[0]}" == "${0}" ]]
 then
-    echo "This script must be sourced. Use --help for more information."
+    echo "This script must be sourced:"
+    echo ". ./run_testenv.sh"
     exit 1
 fi
 
-# Prevent pre-commit from losing it work dir
+# Prevent pre-commit from losing its work dir
 if [[ -z "$PRE_COMMIT_HOME" ]]
 then
     if [[ -z "$XDG_CACHE_HOME" ]]
@@ -29,10 +27,10 @@ fi
 # In Python we trust (aka shell's tempfile&mktemp doesn't work on all platforms)
 SOURCE_FILE=$(python -c "import tempfile; print(tempfile.mkstemp()[1])")
 
-cargo run --package parsec_cli --features testenv run-testenv --main-process-id $$ --source-file "$SOURCE_FILE" $@ || return $?
-source $SOURCE_FILE
+cargo run --package parsec_cli --features testenv run-testenv --main-process-id $$ --source-file "$SOURCE_FILE" "$@" || return $?
+source "$SOURCE_FILE"
 
 # Clean up
-rm $SOURCE_FILE
+rm "$SOURCE_FILE"
 unset SOURCE_FILE
 unset SCRIPT_DIR
diff --git a/docs/adminguide/hosting/gen-admin-token.sh b/docs/adminguide/hosting/gen-admin-token.sh
index b32c83c8b0f..8d01ce0af10 100644
--- a/docs/adminguide/hosting/gen-admin-token.sh
+++ b/docs/adminguide/hosting/gen-admin-token.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 ENV_FILE=parsec-admin-token.env
 if [ ! -f $ENV_FILE ]; then
diff --git a/docs/adminguide/hosting/ping-mailhog.sh b/docs/adminguide/hosting/ping-mailhog.sh
index 726990be53d..d1e9c787f0d 100644
--- a/docs/adminguide/hosting/ping-mailhog.sh
+++ b/docs/adminguide/hosting/ping-mailhog.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -a
 source parsec-email.env
diff --git a/docs/adminguide/hosting/setup-tls.sh b/docs/adminguide/hosting/setup-tls.sh
index 584f573c521..6850af340b0 100644
--- a/docs/adminguide/hosting/setup-tls.sh
+++ b/docs/adminguide/hosting/setup-tls.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 function generate_cert_conf() {
     local name=$1
@@ -66,12 +66,12 @@ for service in parsec-{s3,server}; do
     fi
 done
 
-if [ $(stat -c %g parsec-server.key) -ne 1234 ]; then
+if [ "$(stat -c %g parsec-server.key)" -ne 1234 ]; then
     echo "Changing group id of parsec-server.key to 1234"
     sudo chown $USER:1234 parsec-server.key
 fi
 
-if [ $(stat -c %a parsec-server.key) -ne 640 ]; then
+if [ "$(stat -c %a parsec-server.key)" -ne 640 ]; then
     echo "Changing permission of parsec-server.key to 640"
     chmod 640 parsec-server.key
 fi
diff --git a/misc/setup-rust.sh b/misc/setup-rust.sh
index 4e20c4cc93c..ab4a891b2ea 100644
--- a/misc/setup-rust.sh
+++ b/misc/setup-rust.sh
@@ -1,16 +1,12 @@
-#!bash
+#!/usr/bin/env bash
 
-# Script that install the specific rust toolchain
-#
-# It will install rust with the minimal profile
+# Installs the specific rust toolchain with the minimal profile
 #
 # Basic usage:
-#
 # ```bash
 # $ bash setup-rust.sh
 # ```
 
-
 set -eux
 set -o pipefail
 
diff --git a/server/packaging/server/build.sh b/server/packaging/server/build.sh
index 2da908b4d9c..b90d6a085e4 100644
--- a/server/packaging/server/build.sh
+++ b/server/packaging/server/build.sh
@@ -1,10 +1,11 @@
-#! /bin/bash
+#!/usr/bin/env bash
+
 # Execute the script line `bash packaging/backend/build.sh ...`
 
 set -e -o pipefail
 
 # Allow the user to overwrite `SCRIPTDIR` by exporting it beforehand.
-SCRIPTDIR=${SCRIPTDIR:=$(dirname $(realpath -s "$0"))}
+SCRIPTDIR=${SCRIPTDIR:=$(dirname "$(realpath -s "$0")")}
 # Allow the user to overwrite `ROOTDIR` by exporting it beforehand.
 ROOTDIR=${ROOTDIR:=$(realpath -s "$SCRIPTDIR/../../..")}
 
@@ -28,7 +29,7 @@ DOCKER_BUILDKIT=1 docker build \
     -f $SCRIPTDIR/server.dockerfile \
     -t $PREFIX/$IMAGE_NAME:latest \
     -t $PREFIX/$IMAGE_NAME:$UNIQ_TAG \
-    $ROOTDIR $@
+    $ROOTDIR "$@"
 
 echo
 echo "You can now test/use the docker image with:"
diff --git a/server/packaging/testbed-server/build.sh b/server/packaging/testbed-server/build.sh
index 6b321167a19..58461dc0e3f 100755
--- a/server/packaging/testbed-server/build.sh
+++ b/server/packaging/testbed-server/build.sh
@@ -1,10 +1,11 @@
-#! /bin/bash
+#!/usr/bin/env bash
+
 # Execute the script like `bash packaging/testbed-server/build.sh ...`
 
 set -e -o pipefail
 
 # Allow the user to overwrite `SCRIPTDIR` by exporting it beforehand.
-SCRIPTDIR=${SCRIPTDIR:=$(dirname $(realpath -s "$0"))}
+SCRIPTDIR=${SCRIPTDIR:=$(dirname "$(realpath -s "$0")")}
 # Allow the user to overwrite `ROOTDIR` by exporting it beforehand.
 ROOTDIR=${ROOTDIR:=$(realpath -s "$SCRIPTDIR/../../..")}
 
@@ -33,7 +34,7 @@ echo "On top of that the image will use the following prefix \`$PREFIX\`"
 DOCKER_BUILDKIT=1 docker build \
     -f $SCRIPTDIR/testbed-server.dockerfile \
     -t $PREFIX/parsec-testbed-server:$UNIQ_TAG \
-    $ROOTDIR $@
+    $ROOTDIR "$@"
 
 echo "You can now test/use the docker image with:"
 echo "docker run --publish 6777:6777 --rm --name=parsec-testbed-server $PREFIX/parsec-testbed-server:$UNIQ_TAG"