diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 0a439cecee4..aeddb4a0d3e 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -79,3 +79,13 @@ jobs:
           DANGER_GITHUB_API_TOKEN: ${{ secrets.DANGER_GITHUB_API_TOKEN }}
           # Fallback for forks
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  shellcheck:
+    name: Check shell scripts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run shellcheck
+        uses: ludeeus/action-shellcheck@2.0.0
+        with:
+          scandir: ./tools
diff --git a/tools/check/check_code_quality.sh b/tools/check/check_code_quality.sh
index f37d6613796..a72d2f4a40a 100755
--- a/tools/check/check_code_quality.sh
+++ b/tools/check/check_code_quality.sh
@@ -41,9 +41,9 @@ echo
 echo "Search for forbidden patterns in Kotlin source files..."
 
 # list all Kotlin folders of the project.
-allKotlinDirs=`find . -type d |grep -v build |grep -v \.git |grep -v \.gradle |grep kotlin$`
+allKotlinDirs=$(find . -type d |grep -v build |grep -v \.git |grep -v \.gradle |grep kotlin$)
 
-${searchForbiddenStringsScript} ./tools/check/forbidden_strings_in_code.txt $allKotlinDirs
+${searchForbiddenStringsScript} ./tools/check/forbidden_strings_in_code.txt "$allKotlinDirs"
 
 resultForbiddenStringInCode=$?
 
@@ -51,9 +51,9 @@ echo
 echo "Search for forbidden patterns in XML resource files..."
 
 # list all res folders of the project.
-allResDirs=`find . -type d |grep -v build |grep -v \.git |grep -v \.gradle |grep /res$`
+allResDirs=$(find . -type d |grep -v build |grep -v \.git |grep -v \.gradle |grep /res$)
 
-${searchForbiddenStringsScript} ./tools/check/forbidden_strings_in_xml.txt $allResDirs
+${searchForbiddenStringsScript} ./tools/check/forbidden_strings_in_xml.txt "$allResDirs"
 
 resultForbiddenStringInXml=$?
 
diff --git a/tools/docs/generateModuleGraph.sh b/tools/docs/generateModuleGraph.sh
index 2ce7d5b26b4..099ec4cddb8 100755
--- a/tools/docs/generateModuleGraph.sh
+++ b/tools/docs/generateModuleGraph.sh
@@ -17,7 +17,7 @@
 #
 
 ## Dependency graph https://github.com/savvasdalkitsis/module-dependency-graph
-dotPath=`pwd`/docs/images/module_graph.dot
-pngPath=`pwd`/docs/images/module_graph.png
-./gradlew graphModules -PdotFilePath=${dotPath} -PgraphOutputFilePath=${pngPath} -PautoOpenGraph=false
-rm ${dotPath}
+dotPath=$(pwd)/docs/images/module_graph.dot
+pngPath=$(pwd)/docs/images/module_graph.png
+./gradlew graphModules -PdotFilePath="${dotPath}" -PgraphOutputFilePath="${pngPath}" -PautoOpenGraph=false
+rm "${dotPath}"
diff --git a/tools/release/release.sh b/tools/release/release.sh
index 7bc5ddc0a2d..2fcd948c643 100755
--- a/tools/release/release.sh
+++ b/tools/release/release.sh
@@ -83,7 +83,7 @@ if [[ ! -d ${buildToolsPath} ]]; then
 fi
 
 # Check if git flow is enabled
-gitFlowDevelop=`git config gitflow.branch.develop`
+gitFlowDevelop=$(git config gitflow.branch.develop)
 if [[ ${gitFlowDevelop} != "" ]]
 then
     printf "Git flow is initialized\n"
@@ -105,23 +105,23 @@ git pull
 printf "\n================================================================================\n"
 # Guessing version to propose a default version
 versionsFile="./plugins/src/main/kotlin/Versions.kt"
-versionMajorCandidate=`grep "val versionMajor" ${versionsFile} | cut  -d " " -f6`
-versionMinorCandidate=`grep "val versionMinor" ${versionsFile} | cut  -d " " -f6`
-versionPatchCandidate=`grep "val versionPatch" ${versionsFile} | cut  -d " " -f6`
+versionMajorCandidate=$(grep "val versionMajor" ${versionsFile} | cut  -d " " -f6)
+versionMinorCandidate=$(grep "val versionMinor" ${versionsFile} | cut  -d " " -f6)
+versionPatchCandidate=$(grep "val versionPatch" ${versionsFile} | cut  -d " " -f6)
 versionCandidate="${versionMajorCandidate}.${versionMinorCandidate}.${versionPatchCandidate}"
 
 read -p "Please enter the release version (example: ${versionCandidate}). Just press enter if ${versionCandidate} is correct. " version
 version=${version:-${versionCandidate}}
 
 # extract major, minor and patch for future use
-versionMajor=`echo ${version} | cut  -d "." -f1`
-versionMinor=`echo ${version} | cut  -d "." -f2`
-versionPatch=`echo ${version} | cut  -d "." -f3`
+versionMajor=$(echo "${version}" | cut  -d "." -f1)
+versionMinor=$(echo "${version}" | cut  -d "." -f2)
+versionPatch=$(echo "${version}" | cut  -d "." -f3)
 nextPatchVersion=$((versionPatch + 2))
 
 printf "\n================================================================================\n"
 printf "Starting the release ${version}\n"
-git flow release start ${version}
+git flow release start "${version}"
 
 # Note: in case the release is already started and the script is started again, checkout the release branch again.
 ret=$?
@@ -153,7 +153,7 @@ printf "\n======================================================================
 read -p "Check the file CHANGES.md consistency. It's possible to reorder items (most important changes first) or change their section if relevant. Also an opportunity to fix some typo, or rewrite things. Do not commit your change. Press enter to continue. "
 
 # Get the changes to use it to create the GitHub release
-changelogUrlEncoded=`git diff CHANGES.md | grep ^+ | tail -n +2 | cut -c2- | jq -sRr @uri | sed s/\(/%28/g | sed s/\)/%29/g`
+changelogUrlEncoded=$(git diff CHANGES.md | grep ^+ | tail -n +2 | cut -c2- | jq -sRr @uri | sed s/\(/%28/g | sed s/\)/%29/g)
 
 printf "\n================================================================================\n"
 printf "Committing...\n"
@@ -161,15 +161,15 @@ git commit -a -m "Changelog for version ${version}"
 
 printf "\n================================================================================\n"
 printf "Creating fastlane file...\n"
-printf -v versionMajor2Digits "%02d" ${versionMajor}
-printf -v versionMinor2Digits "%02d" ${versionMinor}
-printf -v versionPatch2Digits "%02d" ${versionPatch}
+printf -v versionMajor2Digits "%02d" "${versionMajor}"
+printf -v versionMinor2Digits "%02d" "${versionMinor}"
+printf -v versionPatch2Digits "%02d" "${versionPatch}"
 fastlaneFile="4${versionMajor2Digits}${versionMinor2Digits}${versionPatch2Digits}0.txt"
 fastlanePathFile="./fastlane/metadata/android/en-US/changelogs/${fastlaneFile}"
-printf "Main changes in this version: TODO.\nFull changelog: https://github.com/element-hq/element-x-android/releases" > ${fastlanePathFile}
+printf "Main changes in this version: TODO.\nFull changelog: https://github.com/element-hq/element-x-android/releases" > "${fastlanePathFile}"
 
 read -p "I have created the file ${fastlanePathFile}, please edit it and press enter to continue. "
-git add ${fastlanePathFile}
+git add "${fastlanePathFile}"
 git commit -a -m "Adding fastlane file for version ${version}"
 
 printf "\n================================================================================\n"
@@ -180,7 +180,7 @@ printf "\n======================================================================
 read -p "Done, push the branch 'main' and the new tag (yes/no) default to yes? " doPush
 doPush=${doPush:-yes}
 
-if [ ${doPush} == "yes" ]; then
+if [ "${doPush}" == "yes" ]; then
   printf "Pushing branch 'main' and tag 'v${version}'...\n"
   git push origin main
   git push origin "v${version}"
@@ -209,7 +209,7 @@ printf "\n======================================================================
 read -p "Done, push the branch 'develop' (yes/no) default to yes? (A rebase may be necessary in case develop got new commits) " doPush
 doPush=${doPush:-yes}
 
-if [ ${doPush} == "yes" ]; then
+if [ "${doPush}" == "yes" ]; then
   printf "Pushing branch 'develop'...\n"
   git push origin develop
 else
@@ -227,15 +227,15 @@ printf "Downloading the artifact...\n"
 targetPath="./tmp/Element/${version}"
 
 python3 ./tools/github/download_github_artifacts.py \
-     --token ${gitHubToken} \
-     --artifactUrl ${artifactUrl} \
-     --directory ${targetPath} \
+     --token "${gitHubToken}" \
+     --artifactUrl "${artifactUrl}" \
+     --directory "${targetPath}" \
      --ignoreErrors
 
 printf "\n================================================================================\n"
 printf "Unzipping the artifact...\n"
 
-unzip ${targetPath}/elementx-app-gplay-bundle-unsigned.zip -d ${targetPath}
+unzip "${targetPath}"/elementx-app-gplay-bundle-unsigned.zip -d "${targetPath}"
 
 unsignedBundlePath="${targetPath}/app-gplay-release.aab"
 signedBundlePath="${targetPath}/app-gplay-release-signed.aab"
@@ -243,24 +243,24 @@ signedBundlePath="${targetPath}/app-gplay-release-signed.aab"
 printf "\n================================================================================\n"
 printf "Signing file ${unsignedBundlePath} with build-tools version ${buildToolsVersion} for min SDK version ${minSdkVersion}...\n"
 
-cp ${unsignedBundlePath} ${signedBundlePath}
+cp "${unsignedBundlePath}" "${signedBundlePath}"
 
-${buildToolsPath}/apksigner sign \
+"${buildToolsPath}"/apksigner sign \
     -v \
-    --ks ${keyStorePath} \
-    --ks-pass pass:${keyStorePassword} \
+    --ks "${keyStorePath}" \
+    --ks-pass pass:"${keyStorePassword}" \
     --ks-key-alias elementx \
-    --key-pass pass:${keyPassword} \
+    --key-pass pass:"${keyPassword}" \
     --min-sdk-version ${minSdkVersion} \
-    ${signedBundlePath}
+    "${signedBundlePath}"
 
 printf "\n================================================================================\n"
 printf "Please check the information below:\n"
 
 printf "Version code: "
-bundletool dump manifest --bundle=${signedBundlePath} --xpath=/manifest/@android:versionCode
+bundletool dump manifest --bundle="${signedBundlePath}" --xpath=/manifest/@android:versionCode
 printf "Version name: "
-bundletool dump manifest --bundle=${signedBundlePath} --xpath=/manifest/@android:versionName
+bundletool dump manifest --bundle="${signedBundlePath}" --xpath=/manifest/@android:versionName
 
 printf "\n"
 read -p "Does it look correct? Press enter to continue. "
@@ -272,17 +272,17 @@ printf "\n======================================================================
 read -p "Do you want to build the APKs from the app bundle? You need to do this step if you want to install the application to your device. (yes/no) default to yes " doBuildApks
 doBuildApks=${doBuildApks:-yes}
 
-if [ ${doBuildApks} == "yes" ]; then
+if [ "${doBuildApks}" == "yes" ]; then
   printf "Building apks...\n"
-  bundletool build-apks --bundle=${signedBundlePath} --output=${targetPath}/elementx.apks \
+  bundletool build-apks --bundle="${signedBundlePath}" --output="${targetPath}"/elementx.apks \
       --ks=./app/signature/debug.keystore --ks-pass=pass:android --ks-key-alias=androiddebugkey --key-pass=pass:android \
       --overwrite
 
   read -p "Do you want to install the application to your device? Make sure there is one (and only one!) connected device first. (yes/no) default to yes " doDeploy
   doDeploy=${doDeploy:-yes}
-  if [ ${doDeploy} == "yes" ]; then
+  if [ "${doDeploy}" == "yes" ]; then
     printf "Installing apk for your device...\n"
-    bundletool install-apks --apks=${targetPath}/elementx.apks
+    bundletool install-apks --apks="${targetPath}"/elementx.apks
     read -p "Please run the application on your phone to check that the upgrade went well. Press enter to continue. "
   else
     printf "APK will not be deployed!\n"
@@ -307,7 +307,7 @@ read -p "Press enter to continue. "
 printf "\n================================================================================\n"
 githubCreateReleaseLink="https://github.com/element-hq/element-x-android/releases/new?tag=v${version}&title=Element%20X%20Android%20v${version}&body=${changelogUrlEncoded}"
 printf "Creating the release on gitHub.\n"
-printf -- "Open this link: %s\n" ${githubCreateReleaseLink}
+printf -- "Open this link: %s\n" "${githubCreateReleaseLink}"
 printf "Then\n"
 printf " - copy paste the section of the file CHANGES.md for this release (if not there yet)\n"
 printf " - click on the 'Generate releases notes' button\n"
@@ -325,12 +325,12 @@ if [[ -z "${elementBotToken}" ]]; then
 else
   read -p "Send this message to the room (yes/no) default to yes? " doSend
   doSend=${doSend:-yes}
-  if [ ${doSend} == "yes" ]; then
+  if [ "${doSend}" == "yes" ]; then
     printf "Sending message...\n"
-    transactionId=`openssl rand -hex 16`
+    transactionId=$(openssl rand -hex 16)
     # Element Android internal
     matrixRoomId="!LiSLXinTDCsepePiYW:matrix.org"
-    curl -X PUT --data $"{\"msgtype\":\"m.text\",\"body\":\"${message}\"}" -H "Authorization: Bearer ${elementBotToken}" https://matrix-client.matrix.org/_matrix/client/r0/rooms/${matrixRoomId}/send/m.room.message/\$local.${transactionId}
+    curl -X PUT --data "${\"msgtype\":\"m.text\",\"body\":\"${message}\"}" -H "Authorization: Bearer ${elementBotToken}" https://matrix-client.matrix.org/_matrix/client/r0/rooms/${matrixRoomId}/send/m.room.message/\$local."${transactionId}"
   else
     printf "Message not sent, please send it manually!\n"
   fi
diff --git a/tools/rte/build_rte.sh b/tools/rte/build_rte.sh
index 7dda29fa3cb..9ad52fce56d 100755
--- a/tools/rte/build_rte.sh
+++ b/tools/rte/build_rte.sh
@@ -8,11 +8,11 @@ read -p "Do you want to build the RTE from local source (yes/no) default to yes?
 buildLocal=${buildLocal:-yes}
 
 date=$(gdate +%Y%m%d%H%M%S)
-elementPwd=`pwd`
+elementPwd=$(pwd)
 
 # Ask for the RTE local source path
 # if folder rte/ exists, use it as default
-if [ ${buildLocal} == "yes" ]; then
+if [ "${buildLocal}" == "yes" ]; then
     read -p "Please enter the path to the Rust SDK local source, default to ../matrix-rich-text-editor: " rtePath
     rtePath=${rtePath:-../matrix-rich-text-editor/}
     if [ ! -d "${rtePath}" ]; then
@@ -25,21 +25,21 @@ else
     read -p "Please enter the Rust SDK branch, default to main " rteBranch
     rteBranch=${rteBranch:-main}
     cd ..
-    git clone ${rteUrl} matrix-rich-text-editor-$date
-    cd matrix-rich-text-editor-$date
-    git checkout ${rteBranch}
+    git clone "${rteUrl}" matrix-rich-text-editor-"$date"
+    cd matrix-rich-text-editor-"$date"
+    git checkout "${rteBranch}"
     rtePath=$(pwd)
-    cd ${elementPwd}
+    cd "${elementPwd}"
 fi
 
 
-cd ${rtePath}
+cd "${rtePath}"
 git status
 
 read -p "Will build with this version of the RTE ^. Is it correct (yes/no) default to yes? " rteCorrect
 rteCorrect=${rteCorrect:-yes}
 
-if [ ${rteCorrect} != "yes" ]; then
+if [ "${rteCorrect}" != "yes" ]; then
     exit 0
 fi
 
@@ -47,31 +47,31 @@ fi
 read -p "Do you want to build the app after (yes/no) default to yes? " buildApp
 buildApp=${buildApp:-yes}
 
-cd ${elementPwd}
+cd "${elementPwd}"
 
-cd $rtePath
+cd "$rtePath"
 
 printf "\nBuilding the RTE for aarch64...\n\n"
 make android-bindings-aarch64
 cd platforms/android
 ./gradlew clean :library:assembleRelease :library-compose:assembleRelease
-cp ./library/build/outputs/aar/library-release.aar $elementPwd/libraries/textcomposer/lib/library.aar
-cp ./library-compose/build/outputs/aar/library-compose-release.aar $elementPwd/libraries/textcomposer/lib/library-compose.aar
+cp ./library/build/outputs/aar/library-release.aar "$elementPwd"/libraries/textcomposer/lib/library.aar
+cp ./library-compose/build/outputs/aar/library-compose-release.aar "$elementPwd"/libraries/textcomposer/lib/library-compose.aar
 
-cd ${elementPwd}
+cd "${elementPwd}"
 mkdir -p ./libraries/textcomposer/lib/versions
-cp ./libraries/textcomposer/lib/library.aar ./libraries/textcomposer/lib/versions/library-${date}.aar
-cp ./libraries/textcomposer/lib/library-compose.aar ./libraries/textcomposer/lib/versions/library-compose-${date}.aar
+cp ./libraries/textcomposer/lib/library.aar ./libraries/textcomposer/lib/versions/library-"${date}".aar
+cp ./libraries/textcomposer/lib/library-compose.aar ./libraries/textcomposer/lib/versions/library-compose-"${date}".aar
 
 
-if [ ${buildApp} == "yes" ]; then
+if [ "${buildApp}" == "yes" ]; then
     printf "\nBuilding the application...\n\n"
     ./gradlew assembleDebug
 fi
 
-if [ ${buildLocal} == "no" ]; then
+if [ "${buildLocal}" == "no" ]; then
     printf "\nCleaning up...\n\n"
-    rm -rf ../matrix-rich-text-editor-$date
+    rm -rf ../matrix-rich-text-editor-"$date"
 fi
 
 printf "\nDone!\n"
diff --git a/tools/sdk/build_rust_sdk.sh b/tools/sdk/build_rust_sdk.sh
index dc2a74e1ff3..384674f48fc 100755
--- a/tools/sdk/build_rust_sdk.sh
+++ b/tools/sdk/build_rust_sdk.sh
@@ -8,11 +8,11 @@ read -p "Do you want to build the Rust SDK from local source (yes/no) default to
 buildLocal=${buildLocal:-yes}
 
 date=$(gdate +%Y%m%d%H%M%S)
-elementPwd=`pwd`
+elementPwd=$(pwd)
 
 # Ask for the Rust SDK local source path
 # if folder rustSdk/ exists, use it as default
-if [ ${buildLocal} == "yes" ]; then
+if [ "${buildLocal}" == "yes" ]; then
     read -p "Please enter the path to the Rust SDK local source, default to ../matrix-rust-sdk" rustSdkPath
     rustSdkPath=${rustSdkPath:-../matrix-rust-sdk/}
     if [ ! -d "${rustSdkPath}" ]; then
@@ -25,9 +25,9 @@ else
     read -p "Please enter the Rust SDK branch, default to main " rustSdkBranch
     rustSdkBranch=${rustSdkBranch:-main}
     cd ..
-    git clone ${rustSdkUrl} matrix-rust-sdk-$date
-    cd matrix-rust-sdk-$date
-    git checkout ${rustSdkBranch}
+    git clone "${rustSdkUrl}" matrix-rust-sdk-"$date"
+    cd matrix-rust-sdk-"$date"
+    git checkout "${rustSdkBranch}"
     rustSdkPath=$(pwd)
     cd "${elementPwd}"
 fi
@@ -39,7 +39,7 @@ git status
 read -p "Will build with this version of the Rust SDK ^. Is it correct (yes/no) default to yes? " sdkCorrect
 sdkCorrect=${sdkCorrect:-yes}
 
-if [ ${sdkCorrect} != "yes" ]; then
+if [ "${sdkCorrect}" != "yes" ]; then
     exit 0
 fi
 
@@ -62,22 +62,22 @@ git checkout main
 git pull
 
 printf "\nBuilding the SDK for aarch64-linux-android...\n\n"
-./scripts/build.sh -p "${rustSdkPath}" -m sdk -t aarch64-linux-android -o "${elementPwd}/libraries/rustsdk"
+./scripts/build.sh -p "${rustSdkPath}" -m sdk -t aarch64-linux-android -o "${elementPwd}"/libraries/rustsdk
 
 cd "${elementPwd}"
 mv ./libraries/rustsdk/sdk-android-debug.aar ./libraries/rustsdk/matrix-rust-sdk.aar
 mkdir -p ./libraries/rustsdk/sdks
-cp ./libraries/rustsdk/matrix-rust-sdk.aar ./libraries/rustsdk/sdks/matrix-rust-sdk-${date}.aar
+cp ./libraries/rustsdk/matrix-rust-sdk.aar ./libraries/rustsdk/sdks/matrix-rust-sdk-"${date}".aar
 
 
-if [ ${buildApp} == "yes" ]; then
+if [ "${buildApp}" == "yes" ]; then
     printf "\nBuilding the application...\n\n"
     ./gradlew assembleDebug
 fi
 
-if [ ${buildLocal} == "no" ]; then
+if [ "${buildLocal}" == "no" ]; then
     printf "\nCleaning up...\n\n"
-    rm -rf ../matrix-rust-sdk-$date
+    rm -rf ../matrix-rust-sdk-"$date"
 fi
 
 printf "\nDone!\n"
diff --git a/tools/templates/generate_templates.sh b/tools/templates/generate_templates.sh
index 9b59ea69f80..1c9334446c9 100755
--- a/tools/templates/generate_templates.sh
+++ b/tools/templates/generate_templates.sh
@@ -22,6 +22,6 @@ echo "Zipping the contents of the 'files' directory..."
 mkdir -p tmp
 
 rm -f ./tmp/file_templates.zip
-pushd ./tools/templates/files
+pushd ./tools/templates/files || exit
 zip -r ../../../tmp/file_templates.zip .
-popd
+popd || exit