diff --git a/.github/workflows/shellcheck-ci.yml b/.github/workflows/shellcheck-ci.yml
new file mode 100644
index 0000000000..d1c7b58580
--- /dev/null
+++ b/.github/workflows/shellcheck-ci.yml
@@ -0,0 +1,30 @@
+name: ShellCheck CI
+run-name: ShellCheck CI triggered from @${{ github.actor }} of ${{ github.head_ref }}
+
+on:
+  workflow_dispatch:
+  merge_group:
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  shellcheck:
+    name: Run ShellCheck
+    runs-on: ubuntu-8
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master
+        with:
+          ignore_paths: >-
+            ./fastcache/**
+            ./contracts/**
+            ./safe-smart-account/**
+            ./go-ethereum/**
+            ./nitro-testnode/**
+            ./brotli/**
+            ./arbitrator/**
diff --git a/scripts/build-brotli.sh b/scripts/build-brotli.sh
index 7160936baa..1a23a88ae0 100755
--- a/scripts/build-brotli.sh
+++ b/scripts/build-brotli.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-mydir=`dirname $0`
+mydir=$(dirname "$0")
 cd "$mydir"
 
 BUILD_WASM=false
@@ -35,7 +35,7 @@ usage(){
     echo "all relative paths are relative to script location"
 }
 
-while getopts "s:t:c:D:wldhf" option; do
+while getopts "n:s:t:c:D:wldhf" option; do
     case $option in
         h)
             usage
@@ -62,6 +62,9 @@ while getopts "s:t:c:D:wldhf" option; do
         s)
             SOURCE_DIR="$OPTARG"
             ;;
+        *)
+            usage
+            ;;
     esac
 done
 
@@ -74,7 +77,7 @@ if [ ! -d "$TARGET_DIR" ]; then
     mkdir -p "${TARGET_DIR}lib"
     ln -s "lib" "${TARGET_DIR}lib64" # Fedora build
 fi
-TARGET_DIR_ABS=`cd -P "$TARGET_DIR"; pwd`
+TARGET_DIR_ABS=$(cd -P "$TARGET_DIR"; pwd)
 
 
 if $USE_DOCKER; then
@@ -94,9 +97,9 @@ cd "$SOURCE_DIR"
 if $BUILD_WASM; then
     mkdir -p buildfiles/build-wasm
     mkdir -p buildfiles/install-wasm
-    TEMP_INSTALL_DIR_ABS=`cd -P buildfiles/install-wasm; pwd`
+    TEMP_INSTALL_DIR_ABS=$(cd -P buildfiles/install-wasm; pwd)
     cd buildfiles/build-wasm
-    cmake ../../ -DCMAKE_C_COMPILER=emcc -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS=-fPIC -DCMAKE_INSTALL_PREFIX="$TEMP_INSTALL_DIR_ABS" -DCMAKE_AR=`which emar` -DCMAKE_RANLIB=`which touch`
+    cmake ../../ -DCMAKE_C_COMPILER=emcc -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS=-fPIC -DCMAKE_INSTALL_PREFIX="$TEMP_INSTALL_DIR_ABS" -DCMAKE_AR="$(which emar)" -DCMAKE_RANLIB="$(which touch)"
     make -j
     make install
     cp -rv "$TEMP_INSTALL_DIR_ABS/lib" "$TARGET_DIR_ABS/lib-wasm"
diff --git a/scripts/convert-databases.bash b/scripts/convert-databases.bash
index 3020b389b4..baddcdcacd 100755
--- a/scripts/convert-databases.bash
+++ b/scripts/convert-databases.bash
@@ -33,7 +33,7 @@ printStatus() {
 }
 
 printUsage() {
-echo Usage: $0 \[OPTIONS..\]
+echo Usage: "$0" \[OPTIONS..\]
     echo
     echo OPTIONS:
     echo "--dbconv          dbconv binary path (default: \"$DEFAULT_DBCONV\")"
@@ -42,15 +42,15 @@ echo Usage: $0 \[OPTIONS..\]
     echo "--force           remove destination directory if it exists"
     echo "--skip-existing   skip convertion of databases which directories already exist in the destination directory"
     echo "--clean           sets what should be removed in case of error, possible values:"
-	echo "                      \"failed\" - remove database which conversion failed (default)"
+    echo "                      \"failed\" - remove database which conversion failed (default)"
     echo "                      \"none\"   - remove nothing, leave unfinished and potentially corrupted databases"
     echo "                      \"all\"    - remove whole destination directory"
 }
 
 removeDir() {
     cmd="rm -r \"$1\""
-    echo $cmd
-    eval $cmd
+    echo "$cmd"
+    eval "$cmd"
     return $?
 }
 
@@ -62,7 +62,7 @@ cleanup() {
             ;;
         failed)
             echo "== Note: removing only failed destination directory"
-            dstdir=$(echo $dst/$1 | tr -s /)
+            dstdir=$(echo "$dst"/"$1" | tr -s /)
             removeDir "$dstdir"
             ;;
         none)
@@ -127,8 +127,8 @@ if $force && $skip_existing; then
     exit 1
 fi
 
-if [ $clean != "all" ] && [ $clean != "failed" ] && [ $clean != "none" ] ; then
-    echo Error: Invalid --clean value: $clean
+if [ "$clean" != "all" ] && [ "$clean" != "failed" ] && [ "$clean" != "none" ] ; then
+    echo Error: Invalid --clean value: "$clean"
     printUsage
     exit 1
 fi
@@ -138,8 +138,8 @@ if ! [ -e "$dbconv" ]; then
     exit 1
 fi
 
-if ! [ -n "$dst" ]; then
-    echo Error: Missing destination directory \(\-\-dst\)
+if [ -z "$dst" ]; then
+    echo "Error: Missing destination directory (--dst)"
     printUsage
     exit 1
 fi
@@ -168,9 +168,8 @@ fi
 
 if [ -e "$dst" ] && ! $skip_existing; then
     if $force; then
-        echo == Warning! Destination already exists, --force is set, removing all files under path: "$dst"
-        removeDir "$dst"
-        if [ $? -ne 0 ]; then
+        echo "== Warning! Destination already exists, --force is set, removing all files under path: $dst"
+        if ! removeDir "$dst"; then
             echo Error: failed to remove "$dst"
             exit 1
         fi
@@ -183,14 +182,13 @@ fi
 convert_result=
 convert () {
     srcdir="$src"/$1
-    dstdir=$(echo $dst/$1 | tr -s /)
-    if ! [ -e $dstdir ]; then
+    dstdir=$(echo "$dst"/"$1" | tr -s /)
+    if ! [ -e "$dstdir" ]; then
         echo "== Converting $1 db"
         cmd="$dbconv --src.db-engine=leveldb --src.data \"$srcdir\" --dst.db-engine=pebble --dst.data \"$dstdir\" --convert --compact"
-        echo $cmd
-        eval $cmd
-        if [ $? -ne 0 ]; then
-            cleanup $1
+        echo "$cmd"
+        if ! eval "$cmd"; then
+            cleanup "$1"
             convert_result="FAILED"
             return 1
         fi
@@ -221,9 +219,8 @@ if ! [ -e "$dst"/l2chaindata/ancient ]; then
     ancient_dst=$(echo "$dst"/l2chaindata/ | tr -s /)
     echo "== Copying l2chaindata ancients"
     cmd="cp -r \"$ancient_src\" \"$ancient_dst\""
-    echo $cmd
-    eval $cmd
-    if [ $? -ne 0 ]; then
+    echo "$cmd"
+    if ! eval "$cmd"; then
         l2chaindata_ancient_status="FAILED (failed to copy)"
         cleanup "l2chaindata"
         printStatus
@@ -249,7 +246,7 @@ if [ $res -ne 0 ]; then
     exit 1
 fi
 
-if [ -e $src/wasm ]; then
+if [ -e "$src"/wasm ]; then
     convert "wasm"
     res=$?
     wasm_status=$convert_result
@@ -262,7 +259,7 @@ else
     wasm_status="not found in source directory"
 fi
 
-if [ -e $src/classic-msg ]; then
+if [ -e "$src"/classic-msg ]; then
     convert "classic-msg"
     res=$?
     classicmsg_status=$convert_result
diff --git a/scripts/fuzz.bash b/scripts/fuzz.bash
index 6271b917b6..a73c208e88 100755
--- a/scripts/fuzz.bash
+++ b/scripts/fuzz.bash
@@ -2,12 +2,12 @@
 
 set -e
 
-mydir=`dirname $0`
+mydir=$(dirname "$0")
 cd "$mydir"
 
 function printusage {
-    echo Usage: $0 --build \[--binary-path PATH\]
-    echo "      "  $0 \<fuzzer-name\> \[--binary-path PATH\] \[--fuzzcache-path PATH\]  \[--nitro-path PATH\] \[--duration DURATION\]
+    echo Usage: "$0" --build \[--binary-path PATH\]
+    echo "      "  "$0" \<fuzzer-name\> \[--binary-path PATH\] \[--fuzzcache-path PATH\]  \[--nitro-path PATH\] \[--duration DURATION\]
     echo
     echo fuzzer names:
     echo "   " FuzzPrecompiles
@@ -22,7 +22,6 @@ if [[ $# -eq 0 ]]; then
     exit
 fi
 
-fuzz_executable=../target/bin/system_test.fuzz
 binpath=../target/bin/
 fuzzcachepath=../target/var/fuzz-cache
 nitropath=../
@@ -72,7 +71,7 @@ while [[ $# -gt 0 ]]; do
             shift
             ;;
         FuzzPrecompiles | FuzzStateTransition)
-            if [[ ! -z "$test_name" ]]; then
+            if [[ -n "$test_name" ]]; then
                 echo can only run one fuzzer at a time
                 exit 1
             fi
@@ -81,7 +80,7 @@ while [[ $# -gt 0 ]]; do
             shift
             ;;
         FuzzInboxMultiplexer)
-            if [[ ! -z "$test_name" ]]; then
+            if [[ -n "$test_name" ]]; then
                 echo can only run one fuzzer at a time
                 exit 1
             fi
@@ -102,17 +101,17 @@ fi
 
 if $run_build; then
     for build_group in system_tests arbstate; do
-        go test -c ${nitropath}/${build_group} -fuzz Fuzz -o "$binpath"/${build_group}.fuzz
+        go test -c "${nitropath}"/${build_group} -fuzz Fuzz -o "$binpath"/${build_group}.fuzz
     done
 fi
 
-if [[ ! -z $test_group ]]; then
-    timeout "$((60 * duration))" "$binpath"/${test_group}.fuzz -test.run "^$" -test.fuzzcachedir "$fuzzcachepath" -test.fuzz $test_name || exit_status=$?
+if [[ -n $test_group ]]; then
+    timeout "$((60 * duration))" "$binpath"/${test_group}.fuzz -test.run "^$" -test.fuzzcachedir "$fuzzcachepath" -test.fuzz "$test_name" || exit_status=$?
 fi
 
-if  [ -n "$exit_status" ] && [ $exit_status -ne 0 ] && [ $exit_status -ne 124 ]; then
+if  [ -n "$exit_status" ] && [ "$exit_status" -ne 0 ] && [ "$exit_status" -ne 124 ]; then
     echo "Fuzzing failed."
-    exit $exit_status
+    exit "$exit_status"
 fi
 
 echo "Fuzzing succeeded."
diff --git a/scripts/startup-testnode.bash b/scripts/startup-testnode.bash
index 701e7ff59a..5313a9ec5d 100755
--- a/scripts/startup-testnode.bash
+++ b/scripts/startup-testnode.bash
@@ -5,9 +5,9 @@
 
 timeout 60 ./nitro-testnode/test-node.bash --init --dev || exit_status=$?
 
-if  [ -n "$exit_status" ] && [ $exit_status -ne 0 ] && [ $exit_status -ne 124 ]; then
+if  [ -n "$exit_status" ] && [ "$exit_status" -ne 0 ] && [ "$exit_status" -ne 124 ]; then
     echo "Startup failed."
-    exit $exit_status
+    exit "$exit_status"
 fi
 
 echo "Startup succeeded."