diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000..f704fc5
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,16 @@
+name: Shellcheck
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+permissions: {}
+
+jobs:
+  shellcheck:
+    name: Shellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ludeeus/action-shellcheck@master
diff --git a/endpoint/setup.sh b/endpoint/setup.sh
index 948c9eb..751c91b 100644
--- a/endpoint/setup.sh
+++ b/endpoint/setup.sh
@@ -12,9 +12,9 @@ GATEWAY="${IP%.*}.2"
 UNNEEDED_ROUTE="${IP%.*}.0"
 echo "Endpoint's IPv4 address is $IP"
 
-route add -net 193.167.0.0 netmask 255.255.0.0 gw $GATEWAY
+route add -net 193.167.0.0 netmask 255.255.0.0 gw "$GATEWAY"
 # delete unused route
-route del -net $UNNEEDED_ROUTE netmask 255.255.255.0
+route del -net "$UNNEEDED_ROUTE" netmask 255.255.255.0
 
 # this relies on the IPv6 address being second in the "hostname -I" output
 IP=$(hostname -I | cut -f2 -d" ")
@@ -22,9 +22,9 @@ GATEWAY="${IP%:*}:2"
 UNNEEDED_ROUTE="${IP%:*}:"
 echo "Endpoint's IPv6 address is $IP"
 
-ip -d route add fd00:cafe:cafe::/48 via $GATEWAY
+ip -d route add fd00:cafe:cafe::/48 via "$GATEWAY"
 # delete unused route
-ip -d route del $UNNEEDED_ROUTE/64
+ip -d route del "$UNNEEDED_ROUTE/64"
 
 # create the /logs and the /logs/qlog directory
 mkdir -p /logs/qlog
diff --git a/sim/run.sh b/sim/run.sh
index 9be56e6..f0f4e61 100644
--- a/sim/run.sh
+++ b/sim/run.sh
@@ -17,15 +17,15 @@ ip6tables -A FORWARD -i eth0 -o eth1 -j DROP
 ip6tables -A FORWARD -i eth1 -o eth0 -j DROP
 
 if [[ -n "$WAITFORSERVER" ]]; then
-  wait-for-it-quic -t 10s $WAITFORSERVER
+  wait-for-it-quic -t 10s "$WAITFORSERVER"
 fi
 
-echo "Using scenario:" $SCENARIO
+echo "Using scenario: $SCENARIO"
 
 eval ./scratch/"$SCENARIO &"
 
-PID=`jobs -p`
-trap "kill -SIGINT $PID" INT
-trap "kill -SIGTERM $PID" TERM
-trap "kill -SIGKILL $PID" KILL
+PID=$(jobs -p)
+trap 'kill -SIGINT $PID' INT
+trap 'kill -SIGTERM $PID' TERM
+# SC2173: SIGKILL/SIGSTOP can not be trapped.
 wait