diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9b6fae29..42a7c660 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -67,15 +67,36 @@ jobs:
         run: |
           result=0
           podman pull docker.io/koalaman/shellcheck:stable
-          for file in $(find . -type f -not -path "*.git*"); do
+          for file in $(find . -type f -name ".*" -prune -o -print | grep -v '.git'); do
             if file "$file" | grep -qi shell; then
               echo "### Checking file $file..."
-              podman run --rm -v "$PWD:/mnt" docker.io/koalaman/shellcheck:stable -s sh -a -o all -Sstyle -Calways -x -e SC2310,SC2311,SC2312  $file
+              # Should read the .shellcheckrc file to behave like  -s sh -a -o all -Sstyle -Calways -x -e SC2310,SC2311,SC2312
+              podman run --rm -v "$PWD:/mnt" docker.io/koalaman/shellcheck:stable -a -Sstyle -Calways $file
               result=$(( result + $? ))
             fi
           done
           exit $result
 
+  differential-shellcheck:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Run Differential ShellCheck
+        uses: redhat-plumbers-in-action/differential-shellcheck@v3
+        with:
+          severity: style
+          token: ${{ secrets.GITHUB_TOKEN }}
+
   bashate:
     runs-on: ubuntu-latest
 
diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 00000000..0eba7ab6
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,20 @@
+# Overrides the shell detected from the shebang. This is useful for files meant to be included (and thus lacking a shebang), or possibly as a more targeted alternative to 'disable=SC2039'.
+shell=sh
+
+# Always allow ShellCheck to open arbitrary files from 'source' statements.
+external-sources=true
+
+# Enable all optional checks
+enable=all
+
+# This function is invoked in an 'if' condition so set -e will be disabled. Invoke separately if failures should cause the script to exit.
+# - We don't want to exit if errors happen inside a check, that's why we have a check...
+disable=SC2310
+
+# Bash implicitly disabled set -e for this function invocation because it's inside a command substitution. Add set -e; before it or enable inherit_errexit.
+# - Don't care if we inherit errexit inside substitutions, we do checks for that.
+disable=SC2311
+
+# Consider invoking this command separately to avoid masking its return value (or use '|| true' to ignore).
+# - We already check errors and adding "|| true" everywhere hinders readability.
+disable=SC2312