diff --git a/.config/river/init b/.config/river/init
index 4c9999e..1f3d800 100755
--- a/.config/river/init
+++ b/.config/river/init
@@ -49,9 +49,11 @@ riverctl map normal Super F2 spawn "amixer -q set Master 5%+"
 riverctl map normal Super F3 spawn "amixer -q set Master toggle"  # Mute
 
 # Area screenshot with notification
+# shellcheck disable=SC2016
 riverctl map normal Super Print spawn 'grim -g "$(slurp)" ~/Pictures/screenshot-$(date +"%Y%m%d%H%M%S").png'
 
 # Area to clipboard with notification
+# shellcheck disable=SC2016
 riverctl map normal None Print spawn 'grim -g "$(slurp)" - | wl-copy'
 
 # Tiling layout control
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000..46a5dcb
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,21 @@
+name: ShellCheck CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  shellcheck:
+    name: ShellCheck
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v5
+
+    - name: Run ShellCheck
+      uses: ludeeus/action-shellcheck@master
+      env:
+        SHELLCHECK_OPTS: "-s sh -a -o all -f gcc -e SC3040"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..589d2bf
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,20 @@
+repos:
+  - repo: https://github.com/koalaman/shellcheck-precommit
+    rev: v0.11.0
+    hooks:
+      - id: shellcheck
+        entry: sh -c 'shellcheck -s sh -a -o all -f gcc -e SC3040 "${@}"' --
+        language: system
+        types: [shell]
+        pass_filenames: true
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-merge-conflict
+      - id: check-executables-have-shebangs
+      - id: check-shebang-scripts-are-executable
+      - id: detect-private-key
diff --git a/postinstall-neovim.sh b/postinstall-neovim.sh
old mode 100644
new mode 100755
index a7f0ddf..74d0c0f
--- a/postinstall-neovim.sh
+++ b/postinstall-neovim.sh
@@ -1,34 +1,34 @@
 #!/bin/bash
 set -euxo pipefail
 
-printf "🚀 Setting up Neovim plugins...\n"
+printf '🚀 Setting up Neovim plugins...\n'
 
 # Function to check command success
 check_success() {
     if [ $? -eq 0 ]; then
-        printf "✅ $1\n"
+        printf '✅ %s\n' "$1"
     else
-        printf "❌ $1 failed!\n"
+        printf '❌ %s failed!\n' "$1"
         exit 1
     fi
 }
 
 # Install vim-plug
 if [ ! -f ~/.local/share/nvim/site/autoload/plug.vim ]; then
-    printf "📥 Installing vim-plug...\n"
-    mkdir -vp '~/.local/share/nvim/site/autoload/'
+    printf '📥 Installing vim-plug...\n'
+    mkdir -vp -- ~/'.local/share/nvim/site/autoload/'
     wget -q --show-progress -O ~/.local/share/nvim/site/autoload/plug.vim \
         https://raw.githubusercontent.com/junegunn/vim-plug/master/plug.vim
     check_success "vim-plug installation"
 fi
 
 # Clean, install, and update plugins
-printf "🔧 Setting up plugins...\n"
+printf '🔧 Setting up plugins...\n'
 nvim --headless +PlugClean! +PlugInstall +PlugUpdate +qa
-check_success "Plugin installation"
+check_success 'Plugin installation'
 
 # Optional: Install coc.nvim extensions
-printf "📦 Setting up coc.nvim extensions...\n"
-nvim --headless "+CocInstall -sync coc-json coc-tsserver" +qa 2>/dev/null || true
+printf '📦 Setting up coc.nvim extensions...\n'
+nvim --headless '+CocInstall -sync coc-json coc-tsserver' +qa 2>/dev/null || true
 
-printf "🎉 Neovim setup complete! All plugins installed.\n"
+printf '🎉 Neovim setup complete! All plugins installed.\n'
diff --git a/postinstall.sh b/postinstall.sh
index 37e02a5..0fb9788 100755
--- a/postinstall.sh
+++ b/postinstall.sh
@@ -4,16 +4,17 @@ set -euo pipefail
 
 set +u
 #Try to get effective user from: 1.env; 2.arg; 3.login
-if [[ -n "${SUDO_USER}" ]]; then
+if [ -n "${SUDO_USER}" ]; then
 	TARGET_USER="${SUDO_USER}"
-elif [[ -n "${1}" ]]; then
+elif [ -n "${1}" ]; then
 	TARGET_USER="${1}"
 else
 	TARGET_USER="$(logname 2> /dev/null || whoami)"
 fi
 
-if [[ "${TARGET_USER}" == "root" ]]; then
-	read -p "Enter username of primary nonroot user: " TARGET_USER
+if [ "${TARGET_USER}" = "root" ]; then
+	printf '%s\n' 'Enter username of primary nonroot user: '
+    IFS= read -r TARGET_USER
 fi
 set -u
 
@@ -21,6 +22,7 @@ set -u
 xbps-install vpm neovim opendoas keepassxc psmisc zsh nnn fff tlp git wget btop dejavu-fonts-ttf font-inconsolata-otf noto-fonts-ttf font-awesome6 nerd-fonts-symbols-ttf wqy-microhei alsa-utils cifs-utils rdesktop ffmpeg6 mpv mpd mpc tmux mesa-dri mesa-vaapi intel-video-accel mesa-vulkan-intel intel-media-driver libva-utils glxinfo river wlr-randr elogind seatd wlroots yambar fuzzel swaybg swayimg grim slurp foot alacritty textadept lite-xl pcmanfm firefox zathura zathura-pdf-poppler
 
 # Add river launcher to /etc/profile
+# shellcheck disable=SC2016
 printf '\nif [ "$(tty)" = "/dev/tty1" ]; then \n        export XDG_RUNTIME_DIR=/tmp/river-runtime\n        export MOZ_ENABLE_WAYLAND=1\n        export WINIT_UNIX_BACKEND=wayland\n        export TERM=xterm\n        mkdir -p "${XDG_RUNTIME_DIR}"\n        chmod 700 "${XDG_RUNTIME_DIR}"\n\n        exec dbus-run-session river\nfi\n' >> /etc/profile
 
 # Setup doas with no password for wheel
@@ -34,13 +36,14 @@ ln -s /etc/sv/elogind /var/service
 
 # Add seatd service and group
 ln -s /etc/sv/seatd /var/service
-usermod -a -G _seatd $TARGET_USER
+usermod -a -G _seatd "${TARGET_USER}"
 
 # Add autologin
 cp -va /etc/sv/agetty-tty1 /etc/sv/agetty-autologin
 ln -s /etc/sv/agetty-autologin /var/service
 sed -i 'N;/^[[:space:]]*exec.*\n.*/d' /etc/sv/agetty-autologin/run
-printf "\nif [ \"${tty}\" = 'tty1' ]; then\n        exec agetty --autologin ${TARGET_USER} --noclear \"${tty}\" \"${BAUD_RATE}\" linux\nelse\n        exec chpst -P ${GETTY} ${GETTY_ARGS} \"${tty}\" \"${BAUD_RATE}\" \"${TERM_NAME}\"\nfi\n" >> /etc/sv/agetty-autologin/run
+# shellcheck disable=SC2016
+printf '\nif [ "${tty}" = "tty1" ]; then\n        exec agetty --autologin "${TARGET_USER}" --noclear "${tty}" "${BAUD_RATE}" linux\nelse\n        exec chpst -P "${GETTY}" "${GETTY_ARGS}" "${tty}" "${BAUD_RATE}" "${TERM_NAME}"\nfi\n' >> /etc/sv/agetty-autologin/run
 
 # Add swapfile (btrfs)
 truncate -s 0 /swapfile
@@ -62,6 +65,7 @@ mkdir -vp /mnt/games
 printf '//truenas/games/ /mnt/games cifs credentials=/etc/smb-credentials,uid=1000,iocharset=utf8,file_mode=0644,dir_mode=0755 0 0\n' >> /etc/fstab
 
 # Install oh-my-zsh
+# shellcheck disable=SC2312
 sh -c "$(wget -O- https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
 
 # Install neovim plugins