diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 669d15a8..3a1d8e46 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -14,6 +14,13 @@ repos:
       - id: check-yaml
       - id: check-added-large-files
         args: ['--maxkb=2500']
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.10.0.1
+    hooks:
+      - id: shellcheck
+        name: shellcheck
+        exclude: '^(frontend/(coverage|dist|node_modules|\.vite)/|test-results|codeql-agent-results)/'
+        args: ['--severity=error']
   - repo: https://github.com/rhysd/actionlint
     rev: v1.7.10
     hooks:
diff --git a/scripts/prune-container-images.sh b/scripts/prune-container-images.sh
index eed2078c..cf2e4e3f 100755
--- a/scripts/prune-container-images.sh
+++ b/scripts/prune-container-images.sh
@@ -106,7 +106,7 @@ action_delete_ghcr() {
           manifest=$(curl -sS -H "Accept: application/vnd.docker.distribution.manifest.v2+json" -H "Authorization: Bearer $GITHUB_TOKEN" "$manifest_url" || true)
           if [[ -n "$manifest" ]]; then
             bytes=$(echo "$manifest" | jq -r '.layers // [] | map(.size) | add // 0')
-            if [[ "$bytes" != "null" && "$bytes" -gt 0 2>/dev/null ]]; then
+            if [[ "$bytes" != "null" ]] && (( bytes > 0 )) 2>/dev/null; then
               candidate_bytes=$((candidate_bytes + bytes))
             fi
           fi
diff --git a/scripts/qa-test-auth-certificates.sh b/scripts/qa-test-auth-certificates.sh
index fa5e63f3..a28cf229 100755
--- a/scripts/qa-test-auth-certificates.sh
+++ b/scripts/qa-test-auth-certificates.sh
@@ -19,8 +19,8 @@ REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
 TEST_RESULTS="$REPO_ROOT/test-results/qa-auth-test-results.log"
 
 # Clear previous results
-> "$TEST_RESULTS"
-> "$COOKIE_FILE"
+: > "$TEST_RESULTS"
+: > "$COOKIE_FILE"
 
 echo -e "${BLUE}=== QA Test: Certificate Page Authentication ===${NC}"
 echo "Testing authentication fixes for certificate endpoints"