diff --git a/.github/workflows/cache-test.sh b/.github/workflows/cache-test.sh
index 218ef9d..d6159c9 100755
--- a/.github/workflows/cache-test.sh
+++ b/.github/workflows/cache-test.sh
@@ -5,26 +5,26 @@ set -ux
 
 seed=$(date)
 
-log=$MAGIC_NIX_CACHE_DAEMONDIR/daemon.log
+log="${MAGIC_NIX_CACHE_DAEMONDIR}/daemon.log"
 
 binary_cache=https://cache.flakehub.com
 
 # Check that the action initialized correctly.
-grep 'FlakeHub cache is enabled' $log
-grep 'Using cache' $log
-grep 'GitHub Action cache is enabled' $log
+grep 'FlakeHub cache is enabled' "${log}"
+grep 'Using cache' "${log}"
+grep 'GitHub Action cache is enabled' "${log}"
 
 # Build something.
 outpath=$(nix-build .github/workflows/cache-tester.nix --argstr seed "$seed")
 
 # Check that the path was enqueued to be pushed to the cache.
-grep "Enqueueing.*$outpath" $log
+grep "Enqueueing.*${outpath}" "${log}"
 
 # Wait until it has been pushed succesfully.
 found=
 for ((i = 0; i < 60; i++)); do
     sleep 1
-    if grep "✅ $(basename $outpath)" $log; then
+    if grep "✅ $(basename "${outpath}")" "${log}"; then
         found=1
         break
     fi
@@ -35,13 +35,13 @@ if [[ -z $found ]]; then
 fi
 
 # Check the FlakeHub binary cache to see if the path is really there.
-nix path-info --store "$binary_cache" $outpath
+nix path-info --store "${binary_cache}" "${outpath}"
 
 # FIXME: remove this once the daemon also uploads to GHA automatically.
-nix copy --to 'http://127.0.0.1:37515' "$outpath"
+nix copy --to 'http://127.0.0.1:37515' "${outpath}"
 
 rm ./result
-nix store delete "$outpath"
+nix store delete "${outpath}"
 if [ -f "$outpath" ]; then
     echo "$outpath still exists? can't test"
     exit 1
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2239b9e..9fdff01 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,9 +16,12 @@ jobs:
       - name: Record existing bundle hash
         run: |
           echo "BUNDLE_HASH=$(sha256sum <dist/index.js | sed 's/  -//')" >>$GITHUB_ENV
+      - name: Check shell scripts
+        run: |
+          nix develop --command shellcheck ./.github/workflows/cache-test.sh
       - name: Build action
         run: |
-          nix develop --command -- just build
+          nix develop --command just build
       - name: Check bundle consistency
         run: |
           NEW_BUNDLE_HASH=$(sha256sum <dist/index.js | sed 's/  -//')
diff --git a/flake.nix b/flake.nix
index 5d58dd9..736da47 100644
--- a/flake.nix
+++ b/flake.nix
@@ -19,10 +19,10 @@
         default = pkgs.mkShell {
           packages = with pkgs; [
             bun
-            nodejs
             jq
             act
             just
+            shellcheck
           ];
         };
       });