diff --git a/default.nix b/default.nix
index 3b4295a..d381e7b 100644
--- a/default.nix
+++ b/default.nix
@@ -41,6 +41,8 @@ let
 
     programs.rustfmt.enable = true;
     programs.nixfmt-rfc-style.enable = true;
+    programs.shfmt.enable = true;
+    settings.formatter.shfmt.options = [ "--space-redirects" ];
   };
 
   results = {
diff --git a/scripts/release.sh b/scripts/release.sh
index b512e07..af6813d 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -32,7 +32,7 @@ fi
 
 echo "Building release artifact for system $system"
 
-nix-build "$root" -A build -o "$tmp/build" >/dev/null
+nix-build "$root" -A build -o "$tmp/build" > /dev/null
 readarray -t closure < <(nix-store -qR "$tmp/build")
 nix-store --export "${closure[@]}" > "$tmp/$system.nar"
 gzip "$tmp/$system.nar"
diff --git a/scripts/update-github-actions.sh b/scripts/update-github-actions.sh
index 5e8d4b5..ced0898 100755
--- a/scripts/update-github-actions.sh
+++ b/scripts/update-github-actions.sh
@@ -22,7 +22,7 @@ trap 'rm -rf "$tmp"' exit
 
 # Use dependency groups to update all dependencies together
 # Note that repo is not used because we pass `--local` on the CLI
-cat <<EOF > "$tmp/input.yml"
+cat << EOF > "$tmp/input.yml"
 job:
   package-manager: "github_actions"
   allowed-updates:
@@ -39,13 +39,13 @@ job:
 EOF
 
 if create_pull_request=$(LOCAL_GITHUB_ACCESS_TOKEN="$githubToken" \
-  dependabot update --file "$tmp/input.yml" --local "$REPO_ROOT" \
-  | jq --exit-status 'select(.type == "create_pull_request").data'); then
+  dependabot update --file "$tmp/input.yml" --local "$REPO_ROOT" |
+  jq --exit-status 'select(.type == "create_pull_request").data'); then
 
   jq --exit-status --raw-output '."pr-body"' <<< "$create_pull_request"
 
-  jq --compact-output '."updated-dependency-files"[]' <<< "$create_pull_request" \
-    | while read -r fileUpdate; do
+  jq --compact-output '."updated-dependency-files"[]' <<< "$create_pull_request" |
+    while read -r fileUpdate; do
       file=$(jq --exit-status --raw-output '.name' <<< "$fileUpdate")
       # --join-output makes sure to not output a trailing newline
       jq --exit-status --raw-output --join-output '.content' <<< "$fileUpdate" > "$REPO_ROOT/$file"