diff --git a/circle.yml b/circle.yml
index a6fa36ada..b148c1ae9 100644
--- a/circle.yml
+++ b/circle.yml
@@ -215,6 +215,10 @@ jobs:
     executor: linux-clang-latest
     steps:
       - checkout
+      - run:
+          name: "Run shellcheck"
+          command: |
+            git ls-files '*.sh' | xargs shellcheck
       - run:
           name: "Check code format"
           command: |
diff --git a/cmake/apply_patches.sh b/cmake/apply_patches.sh
index 09d4887a7..c8c1665a4 100755
--- a/cmake/apply_patches.sh
+++ b/cmake/apply_patches.sh
@@ -1,13 +1,13 @@
 #!/usr/bin/env sh
 
-patches_dir=$(dirname $0)
+patches_dir=$(dirname "$0")
 
-for patch_file in $patches_dir/*.patch; do
-  echo $(basename $patch_file)
+for patch_file in "$patches_dir"/*.patch; do
+  echo "Applying patch: $(basename "$patch_file")"
 
   # Use git-apply to patch files.
   # The --git-dir forces the tool to work in "outside of git repo" mode.
-  git --git-dir=. apply -v $patch_file
+  git --git-dir=. apply -v "$patch_file"
   exit_code=$?
 
   # Exit code 1 is ignored as this happens when trying apply patches to already
diff --git a/test/ci-benchmark.sh b/test/ci-benchmark.sh
index 8733595e9..a768e93f2 100755
--- a/test/ci-benchmark.sh
+++ b/test/ci-benchmark.sh
@@ -12,14 +12,14 @@ fi
 branch=$(git rev-parse --abbrev-ref HEAD)
 
 pipeline_id=$(
-  curl -s -u $CIRCLECI_TOKEN: -X POST https://circleci.com/api/v2/project/gh/wasmx/fizzy/pipeline \
+  curl -s -u "$CIRCLECI_TOKEN:" -X POST https://circleci.com/api/v2/project/gh/wasmx/fizzy/pipeline \
     -H 'Content-Type: application/json' \
     -d "{\"branch\":\"$branch\", \"parameters\":{\"benchmark\":true}}" |
     jq -r '.id'
 )
 
 workflow_id=$(
-  curl -s -u $CIRCLECI_TOKEN: -X GET https://circleci.com/api/v2/pipeline/$pipeline_id/workflow |
+  curl -s -u "$CIRCLECI_TOKEN:" -X GET https://circleci.com/api/v2/pipeline/"$pipeline_id"/workflow |
     jq -r '.items[0].id'
 )