diff --git a/.build.yml b/.build.yml
index c581ddb..8f65a03 100644
--- a/.build.yml
+++ b/.build.yml
@@ -3,6 +3,7 @@ packages:
   - go
   - git
   - make
+  - shellcheck
 sources:
   - https://git.sr.ht/~motiejus/undocker
 tasks:
@@ -12,6 +13,7 @@ tasks:
       make -C undocker coverage.html
   - lint: |
       make -C undocker -O -j$(nproc) lint
+      shellcheck undocker/release
   - binaries: |
       make -C undocker -O -j$(nproc) sha256sum.txt
       cat undocker/sha256sum.txt
diff --git a/release b/release
index d444c63..5a750f4 100755
--- a/release
+++ b/release
@@ -6,24 +6,24 @@ err() {
     exit 1
 }
 
-[[ -n "$(git status --porcelain)" ]] && \
+git status --porcelain | grep -q "" &&
     err "working tree is dirty, commit your changes first."
 
 [[ ! "$1" =~ ^v([0-9]+)\.([0-9]+)(\.([0-9]+))?$ ]] && \
     err "arg1 accepts the following formats: v1.0 v1.0.0"
 
-[[ -n "$(git tag | grep "^$1$")" ]] && \
+git tag | grep -q "^$1$" &&
     err "tag $1 already exists"
 
 last_tag=$(git tag | tail -1)
 
-make -B -j$(nproc) VSN=$1 sha256sum.txt.asc
+make -B -j"$(nproc)" VSN="$1" sha256sum.txt.asc
 
 {
-    echo undocker $1
+    echo undocker "$1"
     echo
-    echo Changelog since $last_tag:
-    git log --pretty=format:"- [%cn] %s" $last_tag..HEAD
+    echo Changelog since "$last_tag":
+    git log --pretty=format:"- [%cn] %s" "$last_tag"..HEAD
     echo
     echo
     echo sha256sums of released binaries: