diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 5b989d1..d125939 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -51,9 +51,9 @@ validate:
 
 shellcheck:
   stage: lint
-  script: |-
-    shellcheck --version
-    shellcheck -e SC2239 $(find . -name '*.sh')
+  tags:
+    - nix
+  script: nix run ".#shellcheck"
 
 # Downloads all the ISO files so that we have a single cache with all
 # of them present. This prevents a race condition where some of the
diff --git a/flake.nix b/flake.nix
index e31c605..a04ec48 100644
--- a/flake.nix
+++ b/flake.nix
@@ -39,6 +39,10 @@
 					package = self'.packages.cache;
 					category = "utils";
 					help = "Downloads ISO files and adds them to the S3 bucket";
+				} {
+					package = self'.packages.shellcheck;
+					category = "utils";
+					help = "Run shellchecks";
 				} ];
 			};
 
@@ -62,6 +66,20 @@
 					];
 					text = builtins.readFile ./cache-restore.sh;
 				};
+				shellcheck = pkgs.writeShellApplication {
+					name = "shellcheck";
+					runtimeInputs = with pkgs; [
+						shellcheck
+					];
+					text = ''
+						scripts=()
+						shopt -s globstar
+						for f in **/*.sh; do
+							scripts+=("$f")
+						done
+						shellcheck -e SC2239 "''${scripts[@]}"
+					'';
+				};
 			};
 
 			# https://numtide.github.io/treefmt/