diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b2906a19b3..334478e858 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -128,5 +128,10 @@ repos:
           # but the integration only works if shellcheck is installed
           - "github.com/wasilibs/go-shellcheck/cmd/shellcheck@v0.10.0"
 
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.10.0.1
+    hooks:
+      - id: shellcheck
+
 ci:
   skip: [cargo-fmt, dev-generate-all]
diff --git a/fuzz/init-fuzzer.sh b/fuzz/init-fuzzer.sh
index 2419ae2466..e6c410bbdf 100755
--- a/fuzz/init-fuzzer.sh
+++ b/fuzz/init-fuzzer.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+set -eu
 
 # https://stackoverflow.com/a/246128/3549270
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
diff --git a/scripts/mypy_primer.sh b/scripts/mypy_primer.sh
index e1014497a1..f4268eff56 100755
--- a/scripts/mypy_primer.sh
+++ b/scripts/mypy_primer.sh
@@ -5,19 +5,19 @@ echo "Enabling mypy primer specific configuration overloads (see .github/mypy-pr
 mkdir -p ~/.config/ty
 cp .github/mypy-primer-ty.toml ~/.config/ty/ty.toml
 
-PRIMER_SELECTOR="$(paste -s -d'|' $PRIMER_SELECTOR)"
+PRIMER_SELECTOR="$(paste -s -d'|' "${PRIMER_SELECTOR}")"
 
 echo "new commit"
-git rev-list --format=%s --max-count=1 "$GITHUB_SHA"
+git rev-list --format=%s --max-count=1 "${GITHUB_SHA}"
 
-MERGE_BASE="$(git merge-base "$GITHUB_SHA" "origin/$GITHUB_BASE_REF")"
-git checkout -b base_commit "$MERGE_BASE"
+MERGE_BASE="$(git merge-base "${GITHUB_SHA}" "origin/${GITHUB_BASE_REF}")"
+git checkout -b base_commit "${MERGE_BASE}"
 echo "base commit"
 git rev-list --format=%s --max-count=1 base_commit
 
 cd ..
 
-echo "Project selector: $PRIMER_SELECTOR"
+echo "Project selector: ${PRIMER_SELECTOR}"
 # Allow the exit code to be 0 or 1, only fail for actual mypy_primer crashes/bugs
 uvx \
   --from="git+https://github.com/hauntsaninja/mypy_primer@59509d48de6da6aaa4e3a2f5e338769bc471f2d7" \
@@ -25,13 +25,13 @@ uvx \
   --repo ruff \
   --type-checker ty \
   --old base_commit \
-  --new "$GITHUB_SHA" \
+  --new "${GITHUB_SHA}" \
   --project-selector "/($PRIMER_SELECTOR)\$" \
   --output concise \
-  --debug > $DIFF_FILE || [ $? -eq 1 ]
+  --debug > "${DIFF_FILE}" || [ $? -eq 1 ]
 
 # Output diff with ANSI color codes
-cat $DIFF_FILE
+cat "${DIFF_FILE}"
 
 # Remove ANSI color codes before uploading
-sed -ie 's/\x1b\[[0-9;]*m//g' $DIFF_FILE
+sed -ie 's/\x1b\[[0-9;]*m//g' "${DIFF_FILE}"
diff --git a/scripts/release/bump.sh b/scripts/release/bump.sh
index 91921aa59d..f18490c96f 100755
--- a/scripts/release/bump.sh
+++ b/scripts/release/bump.sh
@@ -1,3 +1,4 @@
 #!/usr/bin/env bash
 
+# shellcheck disable=SC2016
 echo 'This script has been removed, use `./scripts/release.sh` instead'