diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 00000000..d3ce9e5d
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,35 @@
+name: Static analysis of shell scripts with ShellCheck
+
+on:
+  # run on pull requests to the main branch
+  pull_request:
+    branches: [main]
+  # run on pushes to the main branch
+  push:
+    branches: [main]
+
+# only need permission to read repository; implicitely set all other
+# permissions to none
+permissions:
+  contents: read
+
+# cancel in progress builds for this workflow triggered by the same ref
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  shellcheck:
+    name: Install and run ShellCheck on shell scripts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install ShellCheck
+        run: sudo apt update && sudo apt -y install shellcheck
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run ShellCheck
+        run: shellcheck scripts/*
+
diff --git a/scripts/build-linux-deb.sh b/scripts/build-linux-deb.sh
index b22e6cf4..ad78b37b 100755
--- a/scripts/build-linux-deb.sh
+++ b/scripts/build-linux-deb.sh
@@ -82,7 +82,7 @@ fi
 
 log_i "Building Linux deb"
 # TODO: build other packages?
-make -j$(nproc) \
+make "-j$(nproc)" \
     ARCH=arm64 DEB_HOST_ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- \
     bindeb-pkg
 
diff --git a/scripts/build-u-boot-rb1.sh b/scripts/build-u-boot-rb1.sh
index 851663a0..d9d12b37 100755
--- a/scripts/build-u-boot-rb1.sh
+++ b/scripts/build-u-boot-rb1.sh
@@ -72,7 +72,7 @@ log_i "Configuring U-Boot (${CONFIG})"
 make "${CONFIG}"
 
 log_i "Building U-Boot (with device tree ${U_BOOT_DEVICE_TREE})"
-make -j`nproc` \
+make "-j$(nproc)" \
     CROSS_COMPILE=aarch64-linux-gnu- DEVICE_TREE="${U_BOOT_DEVICE_TREE}"
 
 log_i "Creating Android boot image (${ABOOT_OUTPUT})"