diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0b83f0c..aa2ef1b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,13 @@ jobs:
       - uses: actions/checkout@v4
       - name: shellcheck
         # -x follows the `source=SCRIPTDIR/...` directives into commands/lib/.
-        # commands/*.sh does not glob into lib/, so list it explicitly.
-        run: shellcheck -x install.sh bin/rig commands/*.sh commands/lib/*.sh test/cli.sh
+        # globstar so a script in a new subdirectory is linted without anyone
+        # remembering to edit this list; bin/* covers the extensionless entrypoints.
+        # The file list is printed so under-coverage shows up in the log.
+        run: |
+          shopt -s globstar
+          files=(bin/* **/*.sh)
+          printf 'shellcheck: %s\n' "${files[@]}"
+          shellcheck -x "${files[@]}"
       - name: cli tests
         run: bash test/cli.sh