diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e2208a0..e7c0a81 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,6 +35,10 @@ jobs:
             commit-branch.sh tests/*.sh
 
       - name: Lint the action metadata and its inline shell
+        env:
+          SHELLCHECK: >-
+            docker run --rm --volume ${{ github.workspace }}:/repo --workdir /repo
+            koalaman/shellcheck@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d
         run: tests/lint-action.sh
 
       - name: Test
diff --git a/tests/lint-action.sh b/tests/lint-action.sh
index 1e94af8..6956c04 100755
--- a/tests/lint-action.sh
+++ b/tests/lint-action.sh
@@ -17,7 +17,9 @@ shopt -s inherit_errexit
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$ROOT"
 
-body="$(mktemp)"
+# Inside the checkout, so the containerised checker CI uses can see it;
+# prefixed, so a killed run's leftover names itself in git status.
+body="$(mktemp -p . .lint-action-body.XXXXXX)"
 trap 'rm -f "$body"' EXIT
 
 python3 - "$body" <<'PY'
@@ -85,6 +87,9 @@ with open(sys.argv[1], "w") as out:
 print("  ok   action.yml parses, one bash step, every input piped, no inline expressions")
 PY
 
+# $SHELLCHECK selects the checker. CI points it at the digest-pinned container
+# the .sh files go through, so one version judges every line of shell here.
+read -ra shellcheck <<< "${SHELLCHECK:-shellcheck}"
 # SC2154: the variables come from the step's env:, which shellcheck cannot see.
-shellcheck -S style -e SC2154 "$body"
+"${shellcheck[@]}" -S style -e SC2154 "$body"
 echo "  ok   the run body is shellcheck-clean"