diff --git a/.envrc b/.envrc
index 3550a30f2d..0f94eedeb5 100644
--- a/.envrc
+++ b/.envrc
@@ -1 +1,2 @@
+# shellcheck shell=bash
 use flake
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 488dfdbca6..54d45ab1a3 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -7,6 +7,7 @@ repos:
     hooks:
       - id: check-hooks-apply
       - id: check-useless-excludes
+
   - repo: local
     hooks:
       - id: forbid-symlinks
@@ -14,10 +15,12 @@ repos:
         entry: Forbid symlinks
         language: fail
         types: [symlink]
+
   - repo: https://github.com/Lucas-C/pre-commit-hooks
     rev: v1.5.6
     hooks:
       - id: forbid-crlf
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
@@ -41,6 +44,7 @@ repos:
         # document contents. For example
         # data/fixtures/recorded/languages/ruby/changeCondition.yml
         exclude: ^data/fixtures/recorded/.*/[^/]*\.yml$|\.scope$|/generated/|^patches/
+
   - repo: local
     hooks:
       - id: eslint
@@ -49,6 +53,7 @@ repos:
         language: system
         entry: pnpm exec eslint
         args: [--fix]
+
   - repo: local
     hooks:
       - id: prettier
@@ -57,6 +62,7 @@ repos:
         language: system
         entry: pnpm exec prettier
         args: [--write, --list-different, --ignore-unknown]
+
   - repo: local
     hooks:
       - id: format-recorded-tests
@@ -64,6 +70,7 @@ repos:
         files: ^data/fixtures/recorded/.*/[^/]*\.yml$
         language: system
         entry: pnpm exec ./packages/common/scripts/my-ts-node.js packages/cursorless-engine/src/scripts/transformRecordedTests/index.ts
+
   - repo: local
     hooks:
       - id: check-recorded-test-marks
@@ -71,17 +78,26 @@ repos:
         files: ^data/fixtures/recorded/.*/[^/]*\.yml$
         language: system
         entry: pnpm exec ./packages/common/scripts/my-ts-node.js packages/cursorless-engine/src/scripts/transformRecordedTests/index.ts --check-marks
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.1
+    rev: v0.15.5
     hooks:
-      - id: ruff
+      - id: ruff-check
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
+
   - repo: https://github.com/lunarmodules/luacheck
     rev: v1.2.0
     hooks:
       - id: luacheck
+
   - repo: https://github.com/JohnnyMorganz/StyLua
     rev: v0.20.0
     hooks:
       - id: stylua
+
+  - repo: https://github.com/koalaman/shellcheck-precommit
+    rev: v0.11.0
+    hooks:
+      - id: shellcheck
+        name: ShellCheck
diff --git a/packages/test-harness/scripts/build-tests.sh b/packages/test-harness/scripts/build-tests.sh
index b5c99511ea..c738692a89 100755
--- a/packages/test-harness/scripts/build-tests.sh
+++ b/packages/test-harness/scripts/build-tests.sh
@@ -1,4 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-find .. -name '*.test.ts' | xargs -n 50 pnpm run build:base --outdir=dist --out-extension:.js=.cjs
+find .. -name '*.test.ts' -print0 | xargs -0 -n 50 pnpm run build:base --outdir=dist --out-extension:.js=.cjs
diff --git a/scripts/deploy-cursorless-talon.sh b/scripts/deploy-cursorless-talon.sh
index b9429910b4..d7ee17fef9 100755
--- a/scripts/deploy-cursorless-talon.sh
+++ b/scripts/deploy-cursorless-talon.sh
@@ -8,20 +8,20 @@ set -euo pipefail
 git switch -c cursorless-talon-staging origin/cursorless-talon-staging
 
 # Exit if there were no changes to the cursorless-talon directory
-[[ "$(git rev-parse $GITHUB_SHA:cursorless-talon)" == "$(git rev-parse cursorless-talon-staging^{tree})" ]] && exit 0
+[[ "$(git rev-parse "${GITHUB_SHA}:cursorless-talon")" == "$(git rev-parse 'cursorless-talon-staging^{tree}')" ]] && exit 0
 
 # Fetch current cursorless-talon main
 git remote add cursorless-talon 'https://github.com/cursorless-dev/cursorless-talon.git'
 git fetch cursorless-talon
 
 # Sanity check that cursorless-talon/main is identical to cursorless-talon-staging
-[[ "$(git rev-parse cursorless-talon/main^{tree})" == "$(git rev-parse cursorless-talon-staging^{tree})" ]]
+[[ "$(git rev-parse 'cursorless-talon/main^{tree}')" == "$(git rev-parse 'cursorless-talon-staging^{tree}')" ]]
 
 # Tag previous version of staging branch
 git tag cursorless-talon-staging-previous cursorless-talon-staging
 
 # Update the staging branch
-git switch -c github-sha $GITHUB_SHA
+git switch -c github-sha "$GITHUB_SHA"
 git subtree split --prefix=cursorless-talon --branch=cursorless-talon-staging
 
 # Sanity check that the previous staging commit is an ancestor of the new one
@@ -32,11 +32,11 @@ git switch -c cursorless-talon-main cursorless-talon/main
 git cherry-pick cursorless-talon-staging-previous..cursorless-talon-staging
 
 # Sanity check that cursorless-talon-main is identical to cursorless-talon-staging
-[[ "$(git rev-parse cursorless-talon-main^{tree})" == "$(git rev-parse cursorless-talon-staging^{tree})" ]]
+[[ "$(git rev-parse 'cursorless-talon-main^{tree}')" == "$(git rev-parse 'cursorless-talon-staging^{tree}')" ]]
 
 # Sanity check that cursorless-talon-main is identical to cursorless-talon
 # subdirectory of cursorless-vscode
-[[ "$(git rev-parse cursorless-talon-main^{tree})" == "$(git rev-parse $GITHUB_SHA:cursorless-talon)" ]]
+[[ "$(git rev-parse 'cursorless-talon-main^{tree}')" == "$(git rev-parse "${GITHUB_SHA}:cursorless-talon")" ]]
 
 # Push to cursorless-talon
 git push cursorless-talon cursorless-talon-main:main