diff --git a/build/scripts/nix-mac-installer.sh b/build/scripts/nix-mac-installer.sh
index 9e436fdc..d341fd58 100755
--- a/build/scripts/nix-mac-installer.sh
+++ b/build/scripts/nix-mac-installer.sh
@@ -20,13 +20,13 @@ echo "created nixbld group with gid $gid"
 for i in $(seq 1 10); do
   user=/Users/nixbld$i
   uid="$((30000 + i))"
-  dscl . -create $user
-  dscl . -create $user RealName "Nix build user $i"
-  dscl . -create $user PrimaryGroupID "$gid"
-  dscl . -create $user UserShell /usr/bin/false
-  dscl . -create $user NFSHomeDirectory /var/empty
-  dscl . -create $user UniqueID "$uid"
-  dseditgroup -o edit -a nixbld$i -t user nixbld
+  dscl . -create "$user"
+  dscl . -create "$user" RealName "Nix build user $i"
+  dscl . -create "$user" PrimaryGroupID "$gid"
+  dscl . -create "$user" UserShell /usr/bin/false
+  dscl . -create "$user" NFSHomeDirectory /var/empty
+  dscl . -create "$user" UniqueID "$uid"
+  dseditgroup -o edit -a "nixbld$i" -t user nixbld
   echo "created nixbld$i user with uid $uid"
 done
 
diff --git a/build/scripts/nix-mac-nuke.sh b/build/scripts/nix-mac-nuke.sh
index fb843da7..984fe8bd 100755
--- a/build/scripts/nix-mac-nuke.sh
+++ b/build/scripts/nix-mac-nuke.sh
@@ -8,12 +8,12 @@ launchctl unload $service_plist
 dscl . -delete /Groups/nixbld
 
 for i in $(seq 1 20); do
-  dscl . -delete /Users/nixbld$i
+  dscl . -delete "/Users/nixbld$i"
 done
 
 sudo rm -f $service_plist
 
 sudo rm -rf /nix /etc/nix/nix.conf
 
-rm -f $HOME/.nix-channels $HOME/.nix-profile
-rm -rf $HOME/.nix-defexpr
+rm -f "$HOME/.nix-channels" "$HOME/.nix-profile"
+rm -rf "$HOME/.nix-defexpr"
diff --git a/formatter/flake-module.nix b/formatter/flake-module.nix
index e55beb04..b420ce39 100644
--- a/formatter/flake-module.nix
+++ b/formatter/flake-module.nix
@@ -15,8 +15,7 @@
         programs.nixfmt.package = pkgs.nixfmt-rfc-style;
         programs.ruff-format.enable = true;
 
-        # TODO: fix shellcheck errors in a follow up pr
-        #programs.shellcheck.enable = true;
+        programs.shellcheck.enable = true;
 
         programs.shfmt.enable = true;
         programs.rustfmt.enable = true;
diff --git a/metrics/fastly/cron.sh b/metrics/fastly/cron.sh
index 14370408..1a1cdb93 100755
--- a/metrics/fastly/cron.sh
+++ b/metrics/fastly/cron.sh
@@ -1,4 +1,6 @@
-#! /bin/sh -e
+#!/usr/bin/env bash
+
+set -e
 
 export AWS_PROFILE=nixos-org
 
@@ -19,7 +21,7 @@ if [[ -e $marker ]]; then
 fi
 
 mkdir -p "$(dirname "$marker")"
-touch $marker
+touch "$marker"
 
 ./ingest-raw-logs.sh "$from_date_incl" "$to_date_incl"
 
diff --git a/metrics/fastly/ingest-raw-logs.sh b/metrics/fastly/ingest-raw-logs.sh
index 639036f9..72c8c14e 100755
--- a/metrics/fastly/ingest-raw-logs.sh
+++ b/metrics/fastly/ingest-raw-logs.sh
@@ -1,4 +1,6 @@
-#! /bin/sh -e
+#!/usr/bin/env bash
+
+set -e
 
 region=eu-west-1
 
@@ -14,7 +16,7 @@ run_query() {
 
   res=$(aws athena start-query-execution \
     --region $region \
-    --result-configuration OutputLocation=s3://nixos-athena/ingestion/$name/ \
+    --result-configuration "OutputLocation=s3://nixos-athena/ingestion/$name/" \
     --query-string "$query")
 
   execution_id="$(printf "%s" "$res" | jq -r -e .QueryExecutionId)"
@@ -24,14 +26,14 @@ run_query() {
 
   printf "Waiting..."
   while true; do
-    res="$(aws athena get-query-execution --region $region --query-execution-id $execution_id)"
+    res="$(aws athena get-query-execution --region $region --query-execution-id "$execution_id")"
     status="$(printf %s "$res" | jq -r -e .QueryExecution.Status.State)"
-    if [[ $status = RUNNING || $status = QUEUED ]]; then
+    if [[ $status == RUNNING || $status == QUEUED ]]; then
       printf "."
       sleep 1
       continue
     fi
-    if [[ $status = SUCCEEDED ]]; then
+    if [[ $status == SUCCEEDED ]]; then
       printf " done.\n"
       break
     fi
diff --git a/metrics/fastly/run-queries.sh b/metrics/fastly/run-queries.sh
index 833378b1..8634ec17 100755
--- a/metrics/fastly/run-queries.sh
+++ b/metrics/fastly/run-queries.sh
@@ -1,4 +1,6 @@
-#! /bin/sh -e
+#!/usr/bin/env bash
+
+set -e
 
 region=eu-west-1
 
@@ -10,7 +12,7 @@ run_query() {
 
   res=$(aws athena start-query-execution \
     --region $region \
-    --result-configuration OutputLocation=s3://nixos-metrics/$report_date/$name/ \
+    --result-configuration "OutputLocation=s3://nixos-metrics/$report_date/$name/" \
     --query-string "$query")
 
   execution_id="$(printf "%s" "$res" | jq -r -e .QueryExecutionId)"
@@ -21,8 +23,8 @@ run_query() {
   redirect=latest/$name.csv
   aws s3api put-object \
     --bucket nixos-metrics \
-    --key $redirect \
-    --website-redirect-location /$report_date/$name/$execution_id.csv >/dev/null
+    --key "$redirect" \
+    --website-redirect-location "/$report_date/$name/$execution_id.csv" >/dev/null
 
   echo "Created redirect http://nixos-metrics.s3-website-eu-west-1.amazonaws.com/$redirect."
 }
diff --git a/modules/prometheus/system-version-exporter.sh b/modules/prometheus/system-version-exporter.sh
index ebf457ad..32c5d233 100755
--- a/modules/prometheus/system-version-exporter.sh
+++ b/modules/prometheus/system-version-exporter.sh
@@ -1,11 +1,16 @@
-#!/bin/sh
+#!/usr/bin/env bash
 
 set -euo pipefail
 
-readonly VERSION="$(cat /run/current-system/nixos-version)"
-readonly CURRENT_SYSTEM_DRV="$(readlink /run/current-system)"
-readonly CURRENT_SYSTEM_PROFILE="$(find /nix/var/nix/profiles -ilname "${CURRENT_SYSTEM_DRV}")"
-readonly DEPLOY_TIMESTAMP="$(stat -c '%y' "${CURRENT_SYSTEM_PROFILE}" | cut -c '-16')"
-readonly DEPLOY_SECONDS="$(stat -c '%Y' "${CURRENT_SYSTEM_PROFILE}")"
+readonly VERSION
+VERSION="$(cat /run/current-system/nixos-version)"
+readonly CURRENT_SYSTEM_DRV
+CURRENT_SYSTEM_DRV="$(readlink /run/current-system)"
+readonly CURRENT_SYSTEM_PROFILE
+CURRENT_SYSTEM_PROFILE="$(find /nix/var/nix/profiles -ilname "${CURRENT_SYSTEM_DRV}")"
+readonly DEPLOY_TIMESTAMP
+DEPLOY_TIMESTAMP="$(stat -c '%y' "${CURRENT_SYSTEM_PROFILE}" | cut -c '-16')"
+readonly DEPLOY_SECONDS
+DEPLOY_SECONDS="$(stat -c '%Y' "${CURRENT_SYSTEM_PROFILE}")"
 
 echo "node_deployed{version=\"${VERSION}\",date=\"${DEPLOY_TIMESTAMP}\"} ${DEPLOY_SECONDS}"