diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml
new file mode 100644
index 0000000..a903146
--- /dev/null
+++ b/.gitea/workflows/lint.yml
@@ -0,0 +1,20 @@
+name: Lint
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+jobs:
+  shell-lint:
+    name: Shell (shellcheck)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install shellcheck
+        run: apt-get update -qq && apt-get install -y -qq shellcheck
+
+      - name: Run shellcheck
+        run: find . -name "*.sh" -exec shellcheck {} +
diff --git a/freshStart.sh b/freshStart.sh
index d123a9b..44396e1 100644
--- a/freshStart.sh
+++ b/freshStart.sh
@@ -52,12 +52,15 @@ COMMON_PKGS="python3-pip smartmontools python3-psutil python3-requests lm-sensor
 
 if [[ "$PLATFORM" == "pve" ]]; then
     echo "Installing PVE-specific packages..."
+    # shellcheck disable=SC2086  # intentional word splitting for package list
     apt-get install -y $COMMON_PKGS iperf3 fio nvme-cli
 elif [[ "$PLATFORM" == "pbs" ]]; then
     echo "Installing PBS-specific packages..."
+    # shellcheck disable=SC2086  # intentional word splitting for package list
     apt-get install -y $COMMON_PKGS zfsutils-linux nvme-cli
 else
     echo "Installing common packages..."
+    # shellcheck disable=SC2086  # intentional word splitting for package list
     apt-get install -y $COMMON_PKGS nvme-cli
 fi
 
@@ -320,7 +323,7 @@ else
     echo "You can enter it now or configure it later by editing:"
     echo "  /etc/hwmonDaemon/.env"
     echo ""
-    read -p "Enter API key (or press Enter to skip): " API_KEY
+    read -rp "Enter API key (or press Enter to skip): " API_KEY
 fi
 
 # Determine platform-specific defaults