diff --git a/.github/workflows/byond.yml b/.github/workflows/byond.yml
index ff62e8bb0bc..1e89d02d09a 100644
--- a/.github/workflows/byond.yml
+++ b/.github/workflows/byond.yml
@@ -69,6 +69,7 @@ jobs:
           bash tools/ci/check_filedirs.sh aurorastation.dme
           bash tools/ci/check_changelogs.sh
           bash tools/ci/check_grep.sh $PWD
+          bash tools/ci/check_shell_scripts.sh
           awk -f tools/indentation.awk **/*.dm
 
       - name: "Check if running CI"
diff --git a/html/changelogs/llywelwyn-sh.yml b/html/changelogs/llywelwyn-sh.yml
new file mode 100644
index 00000000000..26da84c3535
--- /dev/null
+++ b/html/changelogs/llywelwyn-sh.yml
@@ -0,0 +1,5 @@
+author: Llywelwyn
+delete-after: True
+changes:
+  - code_imp: "Shellcheck shell scripts in CI/CD."
+  - code_imp: "Fixes shellcheck warns in existing scripts."
diff --git a/tools/ci/check_shell_scripts.sh b/tools/ci/check_shell_scripts.sh
new file mode 100755
index 00000000000..bb28a2c49e9
--- /dev/null
+++ b/tools/ci/check_shell_scripts.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+# Enforces an executable bit and static analysis on shell scripts.
+
+set -uo pipefail
+
+severity="${SHELLCHECK_SEVERITY:-error}"
+status=0
+ok() { printf   '  OK   %s\n' "$1"; }
+fail() { printf '  FAIL %s\n' "$1"; status=1; }
+
+mapfile -t scripts < <(git ls-files '*.sh')
+
+echo "Checking executable bit"
+for f in "${scripts[@]}"; do
+    mode="$(git ls-files -s -- "$f" | awk '{print $1; exit}')"
+    if [ "$mode" = "100755" ]; then ok "$f"; else fail "$f: not executable -> git update-index --chmod=+x '$f'"; fi
+done
+
+if command -v shellcheck >/dev/null 2>&1; then
+    echo "shellcheck (severity=$severity)"
+    for f in "${scripts[@]}"; do
+        if shellcheck --severity="$severity" -- "$f"; then ok "$f"; else status=1; fi
+    done
+else
+    echo "shellcheck not available"
+fi
+
+if [ "$status" -ne 0 ]; then echo "FAIL"; else echo "PASS"; fi
+exit "$status"
diff --git a/tools/ci/install_byond.sh b/tools/ci/install_byond.sh
old mode 100644
new mode 100755
diff --git a/tools/requirements-install.sh b/tools/requirements-install.sh
old mode 100644
new mode 100755
index c866c09d822..463060696ed
--- a/tools/requirements-install.sh
+++ b/tools/requirements-install.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 if python3 python_version_check.py
 then
     read -p "Press [Enter] to continue..."
diff --git a/tools/tgs_scripts/InstallDeps.sh b/tools/tgs_scripts/InstallDeps.sh
index 751e248e5d2..76ab26b40ac 100755
--- a/tools/tgs_scripts/InstallDeps.sh
+++ b/tools/tgs_scripts/InstallDeps.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 
 #find out what we have (+e is important for this)
 set +e