diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000000..c4e38c1d1d
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,26 @@
+---
+name: Shellcheck
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    name: Check shell scripts
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Install dependencies
+        run: |
+          sudo apt update && sudo apt install -y shellcheck
+      - name: shellcheck
+        run: |
+          git grep -l '^#\( *shellcheck \|!\(/bin/\|/usr/bin/env \)\(sh\|bash\|dash\|ksh\)\)' | xargs shellcheck
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 8d032c6a49..9812b4d133 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,5 +1,7 @@
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
+ci:
+  skip: [shellcheck]
 exclude: 'tools/schemacode/bidsschematools/tests/data/broken_dataset_description.json'
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
@@ -71,3 +73,7 @@ repos:
           - types-jsonschema
         args: ["tools/schemacode/bidsschematools"]
         pass_filenames: false
+  - repo: https://github.com/koalaman/shellcheck-precommit
+    rev: v0.9.0
+    hooks:
+      - id: shellcheck
diff --git a/scripts/test_tag b/scripts/test_tag
index f11ef697dd..64e0ddd20f 100755
--- a/scripts/test_tag
+++ b/scripts/test_tag
@@ -9,7 +9,7 @@
 EPOCH="$(date +%s)"
 
 GIT_DIR=$( git rev-parse --git-dir )
-REPO_ROOT=$( ls -d ${GIT_DIR%.git} )
+REPO_ROOT=$( ls -d "${GIT_DIR%.git}" )
 
 VERSION_FILE="$REPO_ROOT/src/schema/SCHEMA_VERSION"