diff --git a/Brewfile b/Brewfile
index da41e76..2355825 100644
--- a/Brewfile
+++ b/Brewfile
@@ -1,4 +1,5 @@
 brew "markdownlint-cli"
+brew "shellcheck"
 brew "shfmt"
 brew "swiftformat"
 
diff --git a/Brewfile.lock.json b/Brewfile.lock.json
index ce8273f..ffe0ec7 100644
--- a/Brewfile.lock.json
+++ b/Brewfile.lock.json
@@ -30,6 +30,35 @@
           }
         }
       },
+      "shellcheck": {
+        "version": "0.7.2",
+        "bottle": {
+          "rebuild": 0,
+          "root_url": "https://ghcr.io/v2/homebrew/core",
+          "files": {
+            "arm64_big_sur": {
+              "cellar": ":any_skip_relocation",
+              "url": "https://ghcr.io/v2/homebrew/core/shellcheck/blobs/sha256:8844cd2a84bd07f8697463d9af3cc41cc4356edfa11d1171255884dc732ee9cd",
+              "sha256": "8844cd2a84bd07f8697463d9af3cc41cc4356edfa11d1171255884dc732ee9cd"
+            },
+            "big_sur": {
+              "cellar": ":any_skip_relocation",
+              "url": "https://ghcr.io/v2/homebrew/core/shellcheck/blobs/sha256:516df7bcc8d5b1e7e4b989b472e89d9e3cf5e4dfc977aa45f06c0335c697b77a",
+              "sha256": "516df7bcc8d5b1e7e4b989b472e89d9e3cf5e4dfc977aa45f06c0335c697b77a"
+            },
+            "catalina": {
+              "cellar": ":any_skip_relocation",
+              "url": "https://ghcr.io/v2/homebrew/core/shellcheck/blobs/sha256:d4ffbfe9cb1fc1c888c7b6805a6c224810e4137c0bac0aac3041733bb36b7d79",
+              "sha256": "d4ffbfe9cb1fc1c888c7b6805a6c224810e4137c0bac0aac3041733bb36b7d79"
+            },
+            "mojave": {
+              "cellar": ":any_skip_relocation",
+              "url": "https://ghcr.io/v2/homebrew/core/shellcheck/blobs/sha256:a810166fde56298431a942ec439d5359e871a0727b989788040608876b519b07",
+              "sha256": "a810166fde56298431a942ec439d5359e871a0727b989788040608876b519b07"
+            }
+          }
+        }
+      },
       "shfmt": {
         "version": "3.3.0",
         "bottle": {
@@ -98,12 +127,12 @@
         "revision": "00757e80d6861651d3dc18bbc978edf9a5d0a8a9"
       },
       "peripheryapp/periphery": {
-        "revision": "9a2339d2bcd07846d2ca580e88082f97b8a66095"
+        "revision": "22ad61496f90c8b6e8b2af34f371eab6c1cb1f1a"
       }
     },
     "cask": {
       "periphery": {
-        "version": "2.5.2",
+        "version": "2.6.0",
         "options": {
           "full_name": "periphery"
         }
@@ -113,9 +142,9 @@
   "system": {
     "macos": {
       "big_sur": {
-        "HOMEBREW_VERSION": "3.1.9-121-g654c78c",
+        "HOMEBREW_VERSION": "3.1.11-14-g76cda75",
         "HOMEBREW_PREFIX": "/opt/homebrew",
-        "Homebrew/homebrew-core": "b68a20a099cc511ee6df038b3ef46bd4793b3cf7",
+        "Homebrew/homebrew-core": "112feba9af1ddb9870c7584f8b1d04d4b62827d8",
         "CLT": "12.5.0.22.9",
         "Xcode": "12.5",
         "macOS": "11.4"
diff --git a/script/bootstrap b/script/bootstrap
index 5fdfa8b..017e54a 100755
--- a/script/bootstrap
+++ b/script/bootstrap
@@ -18,11 +18,9 @@ main() {
   rm -f Brewfile.lock.json
   brew bundle install --no-upgrade --verbose
 
-  if [[ "CI" != "true" ]]; then
-    # Already installed on GitHub Actions runner.
-    if ! command -v swiftlint >/dev/null; then
-      brew install swiftlint
-    fi
+  # Already installed on GitHub Actions runner.
+  if [[ ! -x "$(command -v swiftlint)" ]]; then
+    brew install swiftlint
   fi
 
   # Generate Package.swift
diff --git a/script/bottle b/script/bottle
index 44a66d7..fb8822f 100755
--- a/script/bottle
+++ b/script/bottle
@@ -74,7 +74,7 @@ echo "==> 🍼 Bottling mas ${VERSION} for: ${OS_NAMES[*]}"
 brew install --build-bottle mas
 
 # Generate bottle do block, dropping last 2 lines
-brew bottle --verbose --no-rebuild --root-url=$ROOT_URL mas
+brew bottle --verbose --no-rebuild --root-url="$ROOT_URL" mas
 SHA256=$(shasum --algorithm 256 "${OLD_FILENAME}" | cut -f 1 -d ' ' -)
 
 mkdir -p "$BOTTLE_DIR"
diff --git a/script/build b/script/build
index 46d4dd5..8f0d1ae 100755
--- a/script/build
+++ b/script/build
@@ -7,20 +7,20 @@
 #
 
 # Build for the host architecture by default.
-ARCH=
+ARCH=()
 if [[ "$1" == '--universal' ]]; then
-  ARCH='--arch arm64 --arch x86_64'
+  ARCH=(--arch arm64 --arch x86_64)
 fi
 
 # Disable the manifest cache on Xcode 12.5 and later.
-CACHE=
+CACHE=()
 if [[ "$(swift build --help)" =~ manifest-cache ]]; then
-  CACHE='--manifest-cache none'
+  CACHE=(--manifest-cache none)
 fi
 
 echo "==> 🏗️ Building mas ($(script/version))"
 swift build \
   --configuration release \
-  ${ARCH} \
+  "${ARCH[@]}" \
   --disable-sandbox \
-  ${CACHE}
+  "${CACHE[@]}"
diff --git a/script/lint b/script/lint
index d69ec53..5744796 100755
--- a/script/lint
+++ b/script/lint
@@ -37,4 +37,5 @@ periphery scan --retain-public --strict
 
 echo
 echo "--> 📜 Bash"
+shellcheck --shell=bash script/*
 shfmt -d -i 2 -l contrib/ script/
diff --git a/script/version b/script/version
index f61a9f2..9bce7a8 100755
--- a/script/version
+++ b/script/version
@@ -12,7 +12,7 @@
 VERSION=$(git describe --abbrev=0 --tags)
 VERSION=${VERSION#v}
 
-SCRIPT_PATH=$(dirname $(which $0))
+SCRIPT_PATH=$(dirname "$(which "$0")")
 
 cat <<EOF >"${SCRIPT_PATH}/../Sources/MasKit/Package.swift"
 // Generated by: script/version
@@ -21,4 +21,4 @@ enum Package {
 }
 EOF
 
-echo ${VERSION}
+echo "${VERSION}"