diff --git a/.github/renovate.json5 b/.github/renovate.json5
index be3a4d41d..f0cc4a760 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -2,7 +2,11 @@
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
   dependencyDashboard: true,
   suppressNotifications: ["prEditedNotification"],
-  extends: ["config:recommended"],
+  extends: [
+    "config:recommended",
+    // For tool versions defined in GitHub Actions:
+    "customManagers:githubActionsVersions",
+  ],
   labels: ["internal"],
   schedule: ["before 4am on Monday"],
   semanticCommits: "disabled",
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df5c362e1..41a626d76 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -81,6 +81,17 @@ jobs:
       - name: "Python type check"
         run: uvx mypy
 
+      - name: "Lint shell scripts"
+        uses: ludeeus/action-shellcheck@2.0.0
+        env:
+          # renovate: datasource=github-tags depName=koalaman/shellcheck
+          SHELLCHECK_VERSION: "v0.10.0"
+          SHELLCHECK_OPTS: --shell bash
+        with:
+          version: ${{ env.SHELLCHECK_VERSION }}
+          severity: style
+          check_together: "yes"
+
   cargo-clippy:
     timeout-minutes: 10
     needs: determine_changes
diff --git a/scripts/sync_scenarios.sh b/scripts/sync_scenarios.sh
index d89cbb4eb..befbb1a1c 100755
--- a/scripts/sync_scenarios.sh
+++ b/scripts/sync_scenarios.sh
@@ -25,6 +25,7 @@ cd "$script_root/scenarios"
 echo "Setting up a temporary environment..."
 uv venv
 
+# shellcheck disable=SC1091
 source ".venv/bin/activate"
 uv pip install -r requirements.txt --refresh-package packse