diff --git a/.github/workflows/install-script-check.yml b/.github/workflows/install-script-check.yml
new file mode 100644
index 000000000000..06409d8facf8
--- /dev/null
+++ b/.github/workflows/install-script-check.yml
@@ -0,0 +1,21 @@
+name: Check install script
+
+on:
+  pull_request:
+    paths:
+      - 'scripts/install.sh'
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install ShellCheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+
+      - name: Run ShellCheck on install script
+        run: |
+            shellcheck --shell=dash scripts/install.sh
diff --git a/scripts/install.sh b/scripts/install.sh
index 8174693f932f..2ae400d2d439 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -67,16 +67,16 @@ downloadBinary() {
     CHECKSUM_URL="https://${CDN}/rill/${VERSION}/checksums.txt"
 
     if [ "$NON_INTERACTIVE" = "true" ]; then
-        CURL_PROGRESS="--silent --show-error"
+        set -- "--silent" "--show-error"
     else
-        CURL_PROGRESS="--progress-bar"
+        set -- "--progress-bar"
     fi
 
     printf "Downloading binary: %s\n" "$BINARY_URL"
-    curl --location ${CURL_PROGRESS} "${BINARY_URL}" --output rill_${PLATFORM}.zip
+    curl --location "$@" "${BINARY_URL}" --output rill_${PLATFORM}.zip
 
     printf "\nDownloading checksum: %s\n" "$CHECKSUM_URL"
-    curl --location ${CURL_PROGRESS} "${CHECKSUM_URL}" --output checksums.txt
+    curl --location "$@" "${CHECKSUM_URL}" --output checksums.txt
 
     printf "\nVerifying the SHA256 checksum of the downloaded binary:\n"
     ${sha256_verify} checksums.txt