diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ca79ca5
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000..501df4d
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,14 @@
+name: shellcheck
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Run shellcheck
+        run: shellcheck cc.sh
diff --git a/cc.sh b/cc.sh
index ba2b867..6eb11dd 100755
--- a/cc.sh
+++ b/cc.sh
@@ -196,6 +196,7 @@ execute() {
         output_log="$SPACK_DEBUG_LOG_DIR/spack-cc-$SPACK_DEBUG_LOG_ID.out.log"
         echo "[$mode] $command $input_command" >> "$input_log"
         IFS="$lsep"
+        # shellcheck disable=SC2086
         echo "[$mode] "$full_command_list >> "$output_log"
         unset IFS
     fi
@@ -437,9 +438,10 @@ export PATH="$new_dirs"
 
 if [ "$mode" = vcheck ]; then
     full_command_list="$command"
-    args="$@"
     extend full_command_list vcheck_flags
-    extend full_command_list args
+    for arg in "$@"; do
+        append full_command_list "$arg"
+    done
     execute
 fi
 
@@ -580,6 +582,7 @@ categorize_arguments() {
                 eval "\
                 stripped=\"\${1##$before}\"
                 "
+                # shellcheck disable=SC2154  # shellcheck doesn't see eval
                 if [ "$stripped" = "$1" ] ; then
                     continue
                 fi
@@ -633,6 +636,7 @@ categorize_arguments() {
                 ;;
             -Wl,*)
                 IFS=,
+                # shellcheck disable=SC2086  # intentional splitting
                 if ! parse_Wl ${1#-Wl,}; then
                     append return_other_args_list "$1"
                 fi
@@ -803,7 +807,8 @@ case "$mode" in
 esac
 
 IFS="$lsep"
-    categorize_arguments $spack_flags_list
+# shellcheck disable=SC2086  # intentional splitting
+categorize_arguments $spack_flags_list
 unset IFS
 
 assign_path_lists spack_flags_isystem_include_dirs_list return_isystem_include_dirs_list