diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 81f5302..c9b2802 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -36,11 +36,16 @@ jobs:
         git diff --no-ext-diff --quiet --exit-code
         ./tests/completions/just.bash
 
-    - name: Check for Forbidden Words
+    - name: Install Dependencies
       run: |
         sudo apt-get update
-        sudo apt-get install ripgrep
-        ./bin/forbid
+        sudo apt-get install ripgrep shellcheck
+
+    - name: Check for Forbidden Words
+      run: ./bin/forbid
+
+    - name: Check Install Script
+      run: shellcheck www/install.sh
 
   pages:
     runs-on: ubuntu-latest
diff --git a/justfile b/justfile
index 2ce7833..882b8ed 100755
--- a/justfile
+++ b/justfile
@@ -39,6 +39,9 @@ build:
 fmt:
   cargo fmt --all
 
+shellcheck:
+  shellcheck www/install.sh
+
 man:
   cargo build --features help4help2man
   help2man \
diff --git a/www/install.sh b/www/install.sh
index 683cd78..69fad85 100755
--- a/www/install.sh
+++ b/www/install.sh
@@ -1,11 +1,15 @@
-#!/usr/bin/env bash
+#!/usr/bin/env sh
 
-set -euo pipefail
+set -eu
 
-if [ ! -z ${GITHUB_ACTIONS-} ]; then
+if [ -n "${GITHUB_ACTIONS-}" ]; then
   set -x
 fi
 
+# Check pipefail support in a subshell, ignore if unsupported
+# shellcheck disable=SC3040
+(set -o pipefail 2> /dev/null) && set -o pipefail
+
 help() {
   cat <<'EOF'
 Install a binary release of a just hosted on GitHub
@@ -24,26 +28,25 @@ OPTIONS:
 EOF
 }
 
-git=casey/just
 crate=just
 url=https://github.com/casey/just
 releases=$url/releases
 
 say() {
-  echo "install: $@" >&2
+  echo "install: $*" >&2
 }
 
 err() {
-  if [ ! -z ${td-} ]; then
+  if [ -n "${td-}" ]; then
     rm -rf "$td"
   fi
 
-  say "error: $@"
+  say "error: $*"
   exit 1
 }
 
 need() {
-  if ! command -v $1 > /dev/null 2>&1; then
+  if ! command -v "$1" > /dev/null 2>&1; then
     err "need $1 (command not found)"
   fi
 }
@@ -82,20 +85,20 @@ need mkdir
 need mktemp
 need tar
 
-if [ -z ${tag-} ]; then
+if [ -z "${tag-}" ]; then
   need grep
   need cut
 fi
 
-if [ -z ${target-} ]; then
+if [ -z "${target-}" ]; then
   need cut
 fi
 
-if [ -z ${dest-} ]; then
+if [ -z "${dest-}" ]; then
   dest="$HOME/bin"
 fi
 
-if [ -z ${tag-} ]; then
+if [ -z "${tag-}" ]; then
   tag=$(
     curl --proto =https --tlsv1.2 -sSf \
       https://api.github.com/repos/casey/just/releases/latest |
@@ -104,12 +107,12 @@ if [ -z ${tag-} ]; then
   )
 fi
 
-if [ -z ${target-} ]; then
+if [ -z "${target-}" ]; then
   # bash compiled with MINGW (e.g. git-bash, used in github windows runners),
   # unhelpfully includes a version suffix in `uname -s` output, so handle that.
   # e.g. MINGW64_NT-10-0.19044
   kernel=$(uname -s | cut -d- -f1)
-  uname_target="`uname -m`-$kernel"
+  uname_target="$(uname -m)-$kernel"
 
   case $uname_target in
     aarch64-Linux)     target=aarch64-unknown-linux-musl;;
@@ -119,7 +122,8 @@ if [ -z ${target-} ]; then
     x86_64-MINGW64_NT) target=x86_64-pc-windows-msvc;;
     x86_64-Windows_NT) target=x86_64-pc-windows-msvc;;
     *)
-      err 'Could not determine target from output of `uname -m`-`uname -s`, please use `--target`:' $uname_target
+      # shellcheck disable=SC2016
+      err 'Could not determine target from output of `uname -m`-`uname -s`, please use `--target`:' "$uname_target"
     ;;
   esac
 fi
@@ -141,17 +145,17 @@ say "Archive:     $archive"
 td=$(mktemp -d || mktemp -d -t tmp)
 
 if [ "$extension" = "zip" ]; then
-  curl --proto =https --tlsv1.2 -sSfL $archive > $td/just.zip
-  unzip -d $td $td/just.zip
+  curl --proto =https --tlsv1.2 -sSfL "$archive" > "$td/just.zip"
+  unzip -d "$td" "$td/just.zip"
 else
-  curl --proto =https --tlsv1.2 -sSfL $archive | tar -C $td -xz
+  curl --proto =https --tlsv1.2 -sSfL "$archive" | tar -C "$td" -xz
 fi
 
-if [ -e "$dest/just" ] && [ $force = false ]; then
+if [ -e "$dest/just" ] && [ "$force" = false ]; then
   err "\`$dest/just\` already exists"
 else
-  mkdir -p $dest
-  install -m 755 "$td/just" $dest
+  mkdir -p "$dest"
+  install -m 755 "$td/just" "$dest"
 fi
 
-rm -rf $td
+rm -rf "$td"