diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 47704723..ec10212e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -63,9 +63,10 @@ jobs:
           path: dist/
       - name: Install wheel
         run: |
-          export path_to_file=$(find dist -type f -name "typing_extensions-*.whl")
+          path_to_file="$(find dist -type f -name "typing_extensions-*.whl")"
+          export path_to_file
           echo "::notice::Installing wheel: $path_to_file"
-          python -m pip install --user $path_to_file
+          python -m pip install --user "$path_to_file"
           python -m pip list
       - name: Run typing_extensions tests against installed package
         run: rm src/typing_extensions.py && python src/test_typing_extensions.py
@@ -89,10 +90,11 @@ jobs:
           path: dist/
       - name: Unpack and test source distribution
         run: |
-          export path_to_file=$(find dist -type f -name "typing_extensions-*.tar.gz")
+          path_to_file="$(find dist -type f -name "typing_extensions-*.tar.gz")"
+          export path_to_file
           echo "::notice::Unpacking source distribution: $path_to_file"
-          tar xzf $path_to_file -C dist/
-          cd ${path_to_file%.tar.gz}/src
+          tar xzf "$path_to_file" -C dist/
+          cd "${path_to_file%.tar.gz}/src"
           python test_typing_extensions.py
 
   test-sdist-installed:
@@ -114,9 +116,10 @@ jobs:
           path: dist/
       - name: Install source distribution
         run: |
-          export path_to_file=$(find dist -type f -name "typing_extensions-*.tar.gz")
+          path_to_file="$(find dist -type f -name "typing_extensions-*.tar.gz")"
+          export path_to_file
           echo "::notice::Installing source distribution: $path_to_file"
-          python -m pip install --user $path_to_file
+          python -m pip install --user "$path_to_file"
           python -m pip list
       - name: Run typing_extensions tests against installed package
         run: rm src/typing_extensions.py && python src/test_typing_extensions.py
@@ -144,6 +147,6 @@ jobs:
           name: python-package-distributions
           path: dist/
       - name: Ensure exactly one sdist and one wheel have been downloaded
-        run: test $(ls dist/*.tar.gz | wc -l) = 1 && test $(ls dist/*.whl | wc -l) = 1
+        run: test "$(find dist/*.tar.gz | wc -l | xargs)" = 1 && test "$(find dist/*.whl | wc -l | xargs)" = 1
       - name: Publish distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.github/workflows/third_party.yml b/.github/workflows/third_party.yml
index 2ac26a58..75e6f41b 100644
--- a/.github/workflows/third_party.yml
+++ b/.github/workflows/third_party.yml
@@ -98,7 +98,7 @@ jobs:
         run: |
           set -x
           cd typing_inspect
-          uv pip install --system -r test-requirements.txt --exclude-newer $(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)
+          uv pip install --system -r test-requirements.txt --exclude-newer "$(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)"
       - name: Install typing_extensions latest
         run: uv pip install --system "typing-extensions @ ./typing-extensions-latest"
       - name: List all installed dependencies
@@ -135,7 +135,7 @@ jobs:
         run: |
           set -x
           cd pycroscope
-          uv pip install --system 'pycroscope[tests] @ .' --exclude-newer $(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)
+          uv pip install --system 'pycroscope[tests] @ .' --exclude-newer "$(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)"
       - name: Install typing_extensions latest
         run: uv pip install --system "typing-extensions @ ./typing-extensions-latest"
       - name: List all installed dependencies
@@ -172,7 +172,7 @@ jobs:
         run: |
           set -x
           cd typeguard
-          uv pip install --system "typeguard @ ." --group test  --exclude-newer $(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)
+          uv pip install --system "typeguard @ ." --group test  --exclude-newer "$(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)"
       - name: Install typing_extensions latest
         run: uv pip install --system "typing-extensions @ ./typing-extensions-latest"
       - name: List all installed dependencies
@@ -215,8 +215,8 @@ jobs:
         run: |
           set -x
           cd typed-argument-parser
-          uv pip install --system "typed-argument-parser @ ."  --exclude-newer $(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)
-          uv pip install --system pytest  --exclude-newer $(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)
+          uv pip install --system "typed-argument-parser @ ."  --exclude-newer "$(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)"
+          uv pip install --system pytest  --exclude-newer "$(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)"
       - name: Install typing_extensions latest
         run: uv pip install --system "typing-extensions @ ./typing-extensions-latest"
       - name: List all installed dependencies
@@ -253,7 +253,7 @@ jobs:
         run: |
           set -x
           cd mypy
-          uv pip install --system -r test-requirements.txt  --exclude-newer $(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)
+          uv pip install --system -r test-requirements.txt  --exclude-newer "$(git show -s --date=format:'%Y-%m-%dT%H:%M:%SZ' --format=%cd HEAD)"
           uv pip install --system -e .
       - name: Install typing_extensions latest
         run: uv pip install --system "typing-extensions @ ./typing-extensions-latest"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 96e97c70..83a33480 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -30,6 +30,11 @@ repos:
     rev: v1.7.7
     hooks:
       - id: actionlint
+        additional_dependencies:
+          # actionlint has a shellcheck integration which extracts shell scripts in `run:` steps from GitHub Actions
+          # and checks these with shellcheck. This is arguably its most useful feature,
+          # but the integration only works if shellcheck is installed
+          - "github.com/wasilibs/go-shellcheck/cmd/shellcheck@v0.10.0"
   - repo: meta
     hooks:
       - id: check-hooks-apply