diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 4815313dd..a54499654 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -106,31 +106,8 @@
             enable = true;
             excludes = [
               # We haven't linted these files yet
-              ''^config/install-sh$''
-              ''^misc/bash/completion\.sh$''
-              ''^misc/fish/completion\.fish$''
-              ''^misc/zsh/completion\.zsh$''
-              ''^scripts/create-darwin-volume\.sh$''
-              ''^scripts/install-darwin-multi-user\.sh$''
               ''^scripts/install-multi-user\.sh$''
               ''^scripts/install-systemd-multi-user\.sh$''
-              ''^src/nix/get-env\.sh$''
-              ''^tests/functional/ca/build-dry\.sh$''
-              ''^tests/functional/ca/build-with-garbage-path\.sh$''
-              ''^tests/functional/ca/common\.sh$''
-              ''^tests/functional/ca/concurrent-builds\.sh$''
-              ''^tests/functional/ca/eval-store\.sh$''
-              ''^tests/functional/ca/gc\.sh$''
-              ''^tests/functional/ca/import-from-derivation\.sh$''
-              ''^tests/functional/ca/new-build-cmd\.sh$''
-              ''^tests/functional/ca/nix-shell\.sh$''
-              ''^tests/functional/ca/post-hook\.sh$''
-              ''^tests/functional/ca/recursive\.sh$''
-              ''^tests/functional/ca/repl\.sh$''
-              ''^tests/functional/ca/selfref-gc\.sh$''
-              ''^tests/functional/ca/why-depends\.sh$''
-              ''^tests/functional/characterisation-test-infra\.sh$''
-              ''^tests/functional/common/vars-and-functions\.sh$''
               ''^tests/functional/completions\.sh$''
               ''^tests/functional/compute-levels\.sh$''
               ''^tests/functional/config\.sh$''
@@ -248,6 +225,25 @@
               ''^tests/functional/user-envs\.builder\.sh$''
               ''^tests/functional/user-envs\.sh$''
               ''^tests/functional/why-depends\.sh$''
+
+              # Shellcheck doesn't support fish or zsh shell syntax
+              ''^misc/fish/completion\.fish$''
+              ''^misc/zsh/completion\.zsh$''
+
+              # Content-addressed test files that use recursive-*looking* sourcing
+              # (cd .. && source <self>), causing shellcheck to loop
+              # They're small wrapper scripts with not a lot going on
+              ''^tests/functional/ca/build-dry\.sh$''
+              ''^tests/functional/ca/eval-store\.sh$''
+              ''^tests/functional/ca/gc\.sh$''
+              ''^tests/functional/ca/import-from-derivation\.sh$''
+              ''^tests/functional/ca/new-build-cmd\.sh$''
+              ''^tests/functional/ca/nix-shell\.sh$''
+              ''^tests/functional/ca/post-hook\.sh$''
+              ''^tests/functional/ca/recursive\.sh$''
+              ''^tests/functional/ca/repl\.sh$''
+              ''^tests/functional/ca/selfref-gc\.sh$''
+              ''^tests/functional/ca/why-depends\.sh$''
             ];
           };
         };
diff --git a/misc/bash/completion.sh b/misc/bash/completion.sh
index c4ba96cd3..96f98d6c1 100644
--- a/misc/bash/completion.sh
+++ b/misc/bash/completion.sh
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 function _complete_nix {
     local -a words
     local cword cur
diff --git a/packaging/dev-shell.nix b/packaging/dev-shell.nix
index 949f79752..ccfb9c4ae 100644
--- a/packaging/dev-shell.nix
+++ b/packaging/dev-shell.nix
@@ -118,6 +118,7 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
         modular.pre-commit.settings.package
         (pkgs.writeScriptBin "pre-commit-hooks-install" modular.pre-commit.settings.installationScript)
         pkgs.buildPackages.nixfmt-rfc-style
+        pkgs.buildPackages.shellcheck
         pkgs.buildPackages.gdb
       ]
       ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) (
diff --git a/src/nix/get-env.sh b/src/nix/get-env.sh
index 071edf9b9..39fa6f9ac 100644
--- a/src/nix/get-env.sh
+++ b/src/nix/get-env.sh
@@ -1,11 +1,14 @@
+# shellcheck shell=bash
 set -e
+# shellcheck disable=SC1090  # Dynamic sourcing is intentional
 if [ -e "$NIX_ATTRS_SH_FILE" ]; then source "$NIX_ATTRS_SH_FILE"; fi
 
 export IN_NIX_SHELL=impure
 export dontAddDisableDepTrack=1
 
 if [[ -n $stdenv ]]; then
-    source $stdenv/setup
+    # shellcheck disable=SC1091  # setup file is in nix store
+    source "$stdenv"/setup
 fi
 
 # Better to use compgen, but stdenv bash doesn't have it.
@@ -17,10 +20,10 @@ __dumpEnv() {
 
     printf '  "bashFunctions": {\n'
     local __first=1
-    while read __line; do
+    while read -r __line; do
         if ! [[ $__line =~ ^declare\ -f\ (.*) ]]; then continue; fi
         __fun_name="${BASH_REMATCH[1]}"
-        __fun_body="$(type $__fun_name)"
+        __fun_body="$(type "$__fun_name")"
         if [[ $__fun_body =~ \{(.*)\} ]]; then
             if [[ -z $__first ]]; then printf ',\n'; else __first=; fi
             __fun_body="${BASH_REMATCH[1]}"
@@ -37,7 +40,7 @@ __dumpEnv() {
 
     printf '  "variables": {\n'
     local __first=1
-    while read __line; do
+    while read -r __line; do
         if ! [[ $__line =~ ^declare\ (-[^ ])\ ([^=]*) ]]; then continue; fi
         local type="${BASH_REMATCH[1]}"
         local __var_name="${BASH_REMATCH[2]}"
@@ -76,7 +79,9 @@ __dumpEnv() {
         elif [[ $type == -a ]]; then
             printf '"type": "array", "value": ['
             local __first2=1
+            # shellcheck disable=SC1087  # Complex array manipulation, syntax is correct
             __var_name="$__var_name[@]"
+            # shellcheck disable=SC1087  # Complex array manipulation, syntax is correct
             for __i in "${!__var_name}"; do
                 if [[ -z $__first2 ]]; then printf ', '; else __first2=; fi
                 __escapeString "$__i"
@@ -142,6 +147,7 @@ __dumpEnvToOutput() {
 # array with a format like `outname => /nix/store/hash-drvname-outname`.
 # Otherwise it is a space-separated list of output variable names.
 if [ -e "$NIX_ATTRS_SH_FILE" ]; then
+    # shellcheck disable=SC2154  # outputs is set by sourced file
     for __output in "${outputs[@]}"; do
         __dumpEnvToOutput "$__output"
     done
diff --git a/tests/functional/ca/build-with-garbage-path.sh b/tests/functional/ca/build-with-garbage-path.sh
index 884cd2802..298cd469a 100755
--- a/tests/functional/ca/build-with-garbage-path.sh
+++ b/tests/functional/ca/build-with-garbage-path.sh
@@ -8,6 +8,7 @@ requireDaemonNewerThan "2.4pre20210621"
 
 # Get the output path of `rootCA`, and put some garbage instead
 outPath="$(nix-build ./content-addressed.nix -A rootCA --no-out-link)"
+# shellcheck disable=SC2046  # Multiple store paths need to become individual args
 nix-store --delete $(nix-store -q --referrers-closure "$outPath")
 touch "$outPath"
 
diff --git a/tests/functional/ca/common.sh b/tests/functional/ca/common.sh
index 48f1ac46b..dc8e650fd 100644
--- a/tests/functional/ca/common.sh
+++ b/tests/functional/ca/common.sh
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 source ../common.sh
 
 enableFeatures "ca-derivations"
diff --git a/tests/functional/characterisation-test-infra.sh b/tests/functional/characterisation-test-infra.sh
index 279454550..fecae29e8 100755
--- a/tests/functional/characterisation-test-infra.sh
+++ b/tests/functional/characterisation-test-infra.sh
@@ -40,7 +40,7 @@ echo Bye! > "$TEST_ROOT/expected"
   diffAndAcceptInner test "$TEST_ROOT/got" "$TEST_ROOT/expected"
   (( "$badDiff" == 1 ))
 )
-[[ "$(echo Bye! )" == $(< "$TEST_ROOT/expected") ]]
+[[ "Bye!" == $(< "$TEST_ROOT/expected") ]]
 
 # _NIX_TEST_ACCEPT=1 matches non-empty
 echo Hi! > "$TEST_ROOT/got"
@@ -57,7 +57,7 @@ echo Bye! > "$TEST_ROOT/expected"
   _NIX_TEST_ACCEPT=1 diffAndAcceptInner test "$TEST_ROOT/got" "$TEST_ROOT/expected"
   (( "$badDiff" == 1 ))
 )
-[[ "$(echo Hi! )" == $(< "$TEST_ROOT/expected") ]]
+[[ "Hi!" == $(< "$TEST_ROOT/expected") ]]
 # second time succeeds
 (
   diffAndAcceptInner test "$TEST_ROOT/got" "$TEST_ROOT/expected"