diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 883510da8db..1c8d4a32b4e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -68,9 +68,6 @@ jobs:
       - name: Run shellcheck
         uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
         # 1.1.0 => 94e0aab03ca135d11a35e5bfc14e6746dc56e7e9
-        env:
-          # keep in sync with tests/shellcheck-exclude
-          SHELLCHECK_OPTS: -e SC1001 -e SC1003 -e SC1090 -e SC1091 -e SC1117 -e SC2029 -e SC2030 -e SC2031 -e SC2034 -e SC2046 -e SC2064 -e SC2068 -e SC2086 -e SC2119 -e SC2120 -e SC2128 -e SC2148 -e SC2153 -e SC2154 -e SC2155 -e SC2162 -e SC2174 -e SC2179 -e SC2191 -e SC2199 -e SC2207 -e SC2219 -e SC2220 -e SC2230 -e SC2231 -e SC2235 -e SC2267 -e SC2295
 
   shfmt:
     name: shfmt
diff --git a/.shellcheckrc b/.shellcheckrc
index eed21d66245..dffeb4f39b3 100644
--- a/.shellcheckrc
+++ b/.shellcheckrc
@@ -1,9 +1,33 @@
+# SC1001 - This \/ will be a regular '/' in this context - https://github.com/koalaman/shellcheck/wiki/SC1001
+# SC1003 - Want to escape a single quote? echo 'This is how it'\''s done' - https://github.com/koalaman/shellcheck/wiki/SC1003
+# SC1090 - Can't follow non-constant source. Use a directive to specify location - https://github.com/koalaman/shellcheck/wiki/SC1090
 # SC1091 - Not following: FILE: does not exist (No such file or directory) - https://github.com/koalaman/shellcheck/wiki/SC1091
-#        - used for sourcing function files throughout the codebase
+# SC1117 - Backslash is literal in "\n". Prefer explicit escaping: "\\n" - https://github.com/koalaman/shellcheck/wiki/SC1117
+# SC2029 - Note that, unescaped, this expands on the client side - https://github.com/koalaman/shellcheck/wiki/SC2029
+# SC2030 - Modification of var is local (to subshell caused by pipeline). - https://github.com/koalaman/shellcheck/wiki/SC2030
+# SC2031 - var was modified in a subshell. That change might be lost. - https://github.com/koalaman/shellcheck/wiki/SC2031
 # SC2034 - VAR appears unused - https://github.com/koalaman/shellcheck/wiki/SC2034
-#        - used for declaring desc and deprecated function variables
+# SC2046 - Quote this to prevent word splitting - https://github.com/koalaman/shellcheck/wiki/SC2046
 # SC2064 - Use single quotes, otherwise this expands now rather than when signalled. - https://github.com/koalaman/shellcheck/wiki/SC2064
-#        - used for traps
+# SC2068 - Double quote array expansions to avoid re-splitting elements - https://github.com/koalaman/shellcheck/wiki/SC2068
+# SC2086 - Double quote to prevent globbing and word splitting - https://github.com/koalaman/shellcheck/wiki/SC2086
+# SC2119 - Use 'function "$@"' if function's $1 should mean script's $1 - https://github.com/koalaman/shellcheck/wiki/SC2119
+# SC2120 - Function references arguments, but none are ever passed - https://github.com/koalaman/shellcheck/wiki/SC2120
+# SC2128 - Expanding an array without an index only gives the first element - https://github.com/koalaman/shellcheck/wiki/SC2128
+# SC2148 - Tips depend on target shell and yours is unknown. Add a shebang - https://github.com/koalaman/shellcheck/wiki/SC2148
+# SC2153 - Possible misspelling: DOKKU_ROOT may not be assigned, but DOKKU_PORT is - https://github.com/koalaman/shellcheck/wiki/SC2153
+# SC2154 - Var is referenced but not assigned - https://github.com/koalaman/shellcheck/wiki/SC2154
 # SC2155 - Declare and assign separately to avoid masking return values - https://github.com/koalaman/shellcheck/wiki/SC2155
-#        - used throughout the codebase
-disable=SC1091,SC2034,SC2064,SC2155
+# SC2162 - read without -r will mangle backslashes - https://github.com/koalaman/shellcheck/wiki/SC2162
+# SC2174 - When used with -p, -m only applies to the deepest directory - https://github.com/koalaman/shellcheck/wiki/SC2174
+# SC2179 - Use array+=("item") to append items to an array - https://github.com/koalaman/shellcheck/wiki/SC2179
+# SC2191 - The = here is literal. To assign by index, use ( [index]=value ) with no spaces. To keep as literal, quote it - https://github.com/koalaman/shellcheck/wiki/SC2191
+# SC2199 - Arrays implicitly concatenate in [[ ]]. Use a loop (or explicit * instead of @) - https://github.com/koalaman/shellcheck/wiki/SC2199
+# SC2207 - Prefer mapfile or read -a to split command output (or quote to avoid splitting) - https://github.com/koalaman/shellcheck/wiki/SC2207
+# SC2219 - Instead of 'let expr', prefer (( expr ))  - https://github.com/koalaman/shellcheck/wiki/SC2219
+# SC2220 - Invalid flags are not handled. Add a *) case - https://github.com/koalaman/shellcheck/wiki/SC2220
+# SC2231 - Quote expansions in this for loop glob to prevent wordsplitting, e.g. "$dir"/*.txt  - https://github.com/koalaman/shellcheck/wiki/SC2231
+# SC2235 - Use { ..; } instead of (..) to avoid subshell overhead - https://github.com/koalaman/shellcheck/wiki/SC2235
+# SC2267 - GNU xargs -i is deprecated in favor of -I{} - https://github.com/koalaman/shellcheck/wiki/SC2267
+# SC2295 - Expansions inside ${..} need to be quoted separately, otherwise they match as patterns - https://github.com/koalaman/shellcheck/wiki/SC2295
+disable=SC1001,SC1003,SC1090,SC1091,SC1117,SC2029,SC2030,SC2031,SC2034,SC2046,SC2064,SC2068,SC2086,SC2119,SC2120,SC2128,SC2148,SC2153,SC2154,SC2155,SC2162,SC2174,SC2179,SC2191,SC2199,SC2207,SC2219,SC2220,SC2231,SC2235,SC2267,SC2295
diff --git a/bootstrap.sh b/bootstrap.sh
index d8deb684c6e..2988895841c 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -220,19 +220,15 @@ install-dokku-from-deb-package() {
   [[ -n $DOKKU_NGINX_ENABLE ]] && echo "dokku dokku/nginx_enable string $DOKKU_NGINX_ENABLE" | sudo debconf-set-selections
 
   if [[ -n $DOKKU_CHECKOUT ]]; then
-    # shellcheck disable=SC2086
     apt-get -qq -y $NO_INSTALL_RECOMMENDS install "dokku=$DOKKU_CHECKOUT"
   else
-    # shellcheck disable=SC2086
     apt-get -qq -y $NO_INSTALL_RECOMMENDS install dokku
   fi
 }
 
 main() {
   export DOKKU_DISTRO DOKKU_DISTRO_VERSION
-  # shellcheck disable=SC1091
   DOKKU_DISTRO=$(. /etc/os-release && echo "$ID")
-  # shellcheck disable=SC1091
   DOKKU_DISTRO_VERSION=$(. /etc/os-release && echo "$VERSION_ID")
 
   export DEBIAN_FRONTEND=noninteractive
diff --git a/contrib/dokku-docker-bin.sh b/contrib/dokku-docker-bin.sh
index 3bc36232294..9619f465164 100755
--- a/contrib/dokku-docker-bin.sh
+++ b/contrib/dokku-docker-bin.sh
@@ -4,5 +4,4 @@ set -eo pipefail
 DOKKU_DOCKER_CONTAINER_NAME=${DOKKU_DOCKER_CONTAINER_NAME:=dokku}
 
 # TODO: handle cases where we need a tty
-# shellcheck disable=SC2086
 docker exec $DOKKU_DOCKER_ENV -i "$DOKKU_DOCKER_CONTAINER_NAME" dokku "$@"
diff --git a/contrib/dokku_client.sh b/contrib/dokku_client.sh
index 32a3dde63a7..e0b3ffd4c4e 100755
--- a/contrib/dokku_client.sh
+++ b/contrib/dokku_client.sh
@@ -190,7 +190,6 @@ main() {
   [[ -n "$APP_ARG" ]] && [[ "$APP_ARG" == "--global" ]] && unset APP
   [[ -n "$@" ]] && [[ -n "$APP" ]] && app_arg="--app $APP"
   # echo "ssh -o LogLevel=QUIET -p $DOKKU_PORT -t dokku@$DOKKU_REMOTE_HOST -- $app_arg $@"
-  # shellcheck disable=SC2068,SC2086
   ssh -o LogLevel=QUIET -p $DOKKU_PORT -t dokku@$DOKKU_REMOTE_HOST -- $app_arg $@ || {
     ssh_exit_code="$?"
     echo " !     Failed to execute dokku command over ssh: exit code $?" 1>&2
diff --git a/contrib/images/digitalocean/in_parts/100-image-check b/contrib/images/digitalocean/in_parts/100-image-check
index a14bb87c121..fde0fede7c4 100755
--- a/contrib/images/digitalocean/in_parts/100-image-check
+++ b/contrib/images/digitalocean/in_parts/100-image-check
@@ -31,7 +31,6 @@ cmdExists() {
 function getDistro {
   if [ -f /etc/os-release ]; then
     # freedesktop.org and systemd
-    # shellcheck disable=SC1091
     . /etc/os-release
     OS=$NAME
     VER=$VERSION_ID
@@ -41,7 +40,6 @@ function getDistro {
     VER=$(lsb_release -sr)
   elif [ -f /etc/lsb-release ]; then
     # For some versions of Debian/Ubuntu without lsb_release command
-    # shellcheck disable=SC1091
     . /etc/lsb-release
     OS=$DISTRIB_ID
     VER=$DISTRIB_RELEASE
@@ -255,11 +253,9 @@ function checkUsers {
         if [[ "${u[0]}" == "${user}" ]]; then
           if [[ ${u[1]} == "!" ]] || [[ ${u[1]} == "!!" ]] || [[ ${u[1]} == "*" ]]; then
             echo -en "\e[32m[PASS]\e[0m User ${user} has no password set.\n"
-            # shellcheck disable=SC2030
             ((PASS++))
           else
             echo -en "\e[41m[FAIL]\e[0m User ${user} has a password set on their account. Only system users are allowed on the image.\n"
-            # shellcheck disable=SC2030
             ((FAIL++))
             STATUS=2
           fi
@@ -292,7 +288,6 @@ function checkUsers {
                   STATUS=2
                 else
                   echo -en "\e[93m[WARN]\e[0m User \e[1m${user}\e[0m has empty private key file in \e[93m${key}\e[0m\n"
-                  # shellcheck disable=SC2030
                   ((WARN++))
                   if [[ $STATUS != 2 ]]; then
                     STATUS=1
@@ -352,11 +347,9 @@ function checkFirewall {
     ufwa=$(ufw status | head -1 | sed -e "s/^Status:\ //")
     if [[ $ufwa == "active" ]]; then
       FW_VER="\e[32m[PASS]\e[0m Firewall service (${fw}) is active\n"
-      # shellcheck disable=SC2031
       ((PASS++))
     else
       FW_VER="\e[93m[WARN]\e[0m No firewall is configured. Ensure ${fw} is installed and configured\n"
-      # shellcheck disable=SC2031
       ((WARN++))
     fi
   elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]]; then
@@ -451,7 +444,6 @@ function checkUpdates {
       sleep 2
       apt-get --just-print upgrade | grep -i security | awk '{print $2}' | awk '!seen[$0]++'
       echo -en
-      # shellcheck disable=SC2031
       ((FAIL++))
       STATUS=2
     else
diff --git a/contrib/release-dokku b/contrib/release-dokku
index 5cff7f81a0c..26de8e1b62a 100755
--- a/contrib/release-dokku
+++ b/contrib/release-dokku
@@ -9,19 +9,16 @@ readonly DOKKU_GIT_REV="$(git rev-parse HEAD)"
 trap "rm -rf '$TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT
 
 log-info() {
-  # shellcheck disable=SC2034
   declare desc="Log info formatter"
   echo "$*"
 }
 
 log-error() {
-  # shellcheck disable=SC2034
   declare desc="Log error formatter"
   echo "!   $*" 1>&2
 }
 
 log-fail() {
-  # shellcheck disable=SC2034
   declare desc="Log fail formatter"
   log-error "$*"
   exit 1
diff --git a/contrib/release-plugin b/contrib/release-plugin
index e0cbc55f20d..f034414b2c4 100755
--- a/contrib/release-plugin
+++ b/contrib/release-plugin
@@ -7,19 +7,16 @@ readonly TMP_WORK_DIR="$(mktemp -d "/tmp/dokku-plugin-release.XXXXXX")"
 trap "rm -rf '$TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT
 
 log-info() {
-  # shellcheck disable=SC2034
   declare desc="Log info formatter"
   echo "$*"
 }
 
 log-error() {
-  # shellcheck disable=SC2034
   declare desc="Log error formatter"
   echo "!   $*" 1>&2
 }
 
 log-fail() {
-  # shellcheck disable=SC2034
   declare desc="Log fail formatter"
   log-error "$*"
   exit 1
diff --git a/debian/config b/debian/config
index e4bcc25be12..99bba1b2374 100755
--- a/debian/config
+++ b/debian/config
@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 
diff --git a/debian/postinst b/debian/postinst
index 0663ca6510b..1b755a173a9 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -3,12 +3,10 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 
 if [[ -r /etc/default/dokku ]]; then
-  # shellcheck disable=SC1091
   source /etc/default/dokku
 fi
 
diff --git a/debian/postrm b/debian/postrm
index 6c15a4d0940..78f3b83de4a 100755
--- a/debian/postrm
+++ b/debian/postrm
@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 
diff --git a/debian/preinst b/debian/preinst
index e4dfdef5ed6..fb7104341dd 100755
--- a/debian/preinst
+++ b/debian/preinst
@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 
diff --git a/dokku b/dokku
index 23570f28d90..7e37af297a0 100755
--- a/dokku
+++ b/dokku
@@ -4,7 +4,6 @@ shopt -s nullglob
 
 export DOCKER_BIN=docker
 if [[ -r /etc/default/dokku ]]; then
-  # shellcheck disable=SC1091
   source /etc/default/dokku
 fi
 
@@ -31,7 +30,6 @@ fi
 export DOKKU_HOST_ROOT=${DOKKU_HOST_ROOT:=$DOKKU_ROOT}
 
 export DOKKU_DISTRO
-# shellcheck disable=SC1091
 DOKKU_DISTRO=$(
   . /etc/os-release >/dev/null 2>&1 || true
   echo "$ID"
@@ -109,12 +107,10 @@ fi
 if [[ -n "$SSH_ORIGINAL_COMMAND" ]]; then
   export -n SSH_ORIGINAL_COMMAND
   if [[ $1 =~ config-* ]] || [[ $1 =~ docker-options* ]]; then
-    # shellcheck disable=SC2086
     xargs $0 <<<$SSH_ORIGINAL_COMMAND
     exit $?
   else
     set -f
-    # shellcheck disable=SC2086
     $0 $SSH_ORIGINAL_COMMAND
     set +f
     exit $?
diff --git a/plugins/20_events/install b/plugins/20_events/install
index d1eea51986a..003a1e89dc5 100755
--- a/plugins/20_events/install
+++ b/plugins/20_events/install
@@ -14,7 +14,6 @@ trigger-events-install() {
 
   # This can be done unconditionally as mkdir -p
   # exits gracefully if the path already exists
-  # shellcheck disable=SC2174
   mkdir -m 775 -p "$DOKKU_LOGS_DIR"
   case "$DOKKU_DISTRO" in
     arch | debian | raspbian)
diff --git a/plugins/builder-lambda/builder-build b/plugins/builder-lambda/builder-build
index eb13cd21b33..2c1b7a1072a 100755
--- a/plugins/builder-lambda/builder-build
+++ b/plugins/builder-lambda/builder-build
@@ -20,7 +20,6 @@ trigger-builder-lambda-builder-build() {
 
   plugn trigger pre-build-lambda "$APP"
 
-  # shellcheck disable=SC2086
   lambda-builder build --generate-image --write-procfile --image-env=DOCKER_LAMBDA_STAY_OPEN=1 --label=org.label-schema.schema-version=1.0 --label=org.label-schema.vendor=dokku --label=com.dokku.image-stage=build --label=com.dokku.builder-type=lambda "--label=com.dokku.app-name=$APP" $DOKKU_GLOBAL_BUILD_ARGS --port 5000 --tag "$IMAGE" --working-directory "$SOURCECODE_WORK_DIR"
   if [[ ! -f "$SOURCECODE_WORK_DIR/lambda.zip" ]]; then
     dokku_log_warn "Compressed lambda.zip not detected, failed to build lambda function"
diff --git a/plugins/docker-options/docker-args-deploy b/plugins/docker-options/docker-args-deploy
index 9bc2ec673e2..9c4d8c2ec5f 100755
--- a/plugins/docker-options/docker-args-deploy
+++ b/plugins/docker-options/docker-args-deploy
@@ -33,7 +33,6 @@ trigger-docker-options-docker-args() {
 
       [[ -z "$line" ]] && continue
 
-      # shellcheck disable=SC1001
       case "$line" in
         \#*)
           continue
diff --git a/plugins/docker-options/subcommands/remove b/plugins/docker-options/subcommands/remove
index f258a0b3412..bddbbcdbd52 100755
--- a/plugins/docker-options/subcommands/remove
+++ b/plugins/docker-options/subcommands/remove
@@ -13,7 +13,6 @@ cmd-docker-options-remove() {
   verify_app_name "$APP"
   read -ra passed_phases <<<"$(get_phases "$2")"
   shift 2 # everything else passed is the docker option
-  # shellcheck disable=SC2154
   [[ -z ${passed_docker_option="$@"} ]] && dokku_log_fail "Please specify docker options to remove from the phase"
   remove_passed_docker_option passed_phases[@] "${passed_docker_option[@]}"
 }
diff --git a/plugins/domains/functions b/plugins/domains/functions
index 17c59c7aa50..9b6e481ee46 100755
--- a/plugins/domains/functions
+++ b/plugins/domains/functions
@@ -16,7 +16,6 @@ disable_app_vhost() {
   fi
 
   [[ "$RESTART_APP" == "--no-restart" ]] && local CONFIG_SET_ARGS=$RESTART_APP
-  # shellcheck disable=SC2086
   DOKKU_QUIET_OUTPUT=1 config_set $CONFIG_SET_ARGS $APP NO_VHOST=1
 }
 
@@ -196,7 +195,6 @@ enable_app_vhost() {
 
   plugn trigger pre-enable-vhost "$APP"
   [[ "$RESTART_APP" == "--no-restart" ]] && local CONFIG_SET_ARGS=$RESTART_APP
-  # shellcheck disable=SC2086
   DOKKU_QUIET_OUTPUT=1 config_set $CONFIG_SET_ARGS "$APP" NO_VHOST=0
 }
 
diff --git a/plugins/git/git-from-directory b/plugins/git/git-from-directory
index 9f94568c5ae..03e7058de00 100755
--- a/plugins/git/git-from-directory
+++ b/plugins/git/git-from-directory
@@ -15,7 +15,6 @@ trigger-git-git-from-directory() {
   local REV
   local TMP_WORK_DIR=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
   local TMP_WORK_DIR_2=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
-  # shellcheck disable=SC2086
   trap "rm -rf '$TMP_WORK_DIR' '$TMP_WORK_DIR_2' >/dev/null" RETURN INT TERM EXIT
 
   local has_code=true
diff --git a/plugins/nginx-vhosts/functions b/plugins/nginx-vhosts/functions
index 25ccdd4e78e..299e84aabca 100755
--- a/plugins/nginx-vhosts/functions
+++ b/plugins/nginx-vhosts/functions
@@ -406,7 +406,6 @@ nginx_build_config() {
       local NGINX_BUILD_CONFIG_TMP_WORK_DIR=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
       local NGINX_CONF=$(mktemp --tmpdir="${NGINX_BUILD_CONFIG_TMP_WORK_DIR}" "nginx.conf.XXXXXX")
       local CUSTOM_NGINX_TEMPLATE="$NGINX_BUILD_CONFIG_TMP_WORK_DIR/$NGINX_TEMPLATE_NAME"
-      # shellcheck disable=SC2086
       trap "rm -rf '$NGINX_CONF' '$NGINX_BUILD_CONFIG_TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT
 
       get_custom_nginx_template "$APP" "$CUSTOM_NGINX_TEMPLATE" 2>/dev/null
diff --git a/plugins/scheduler-docker-local/bin/scheduler-deploy-process b/plugins/scheduler-docker-local/bin/scheduler-deploy-process
index 27d59889e51..a088ee9dfa4 100755
--- a/plugins/scheduler-docker-local/bin/scheduler-deploy-process
+++ b/plugins/scheduler-docker-local/bin/scheduler-deploy-process
@@ -24,7 +24,6 @@ main() {
       # Disable the container restart policy
       "$DOCKER_BIN" container update --restart=no "$cid" &>/dev/null || true
 
-      # shellcheck disable=SC2086
       "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$cid" &>/dev/null
     done
   fi
diff --git a/plugins/scheduler-docker-local/check-deploy b/plugins/scheduler-docker-local/check-deploy
index 310b5c9a355..363b0c16883 100755
--- a/plugins/scheduler-docker-local/check-deploy
+++ b/plugins/scheduler-docker-local/check-deploy
@@ -147,10 +147,8 @@ trigger-scheduler-docker-local-check-deploy() {
   local FAILEDCHECKS=0
   while read -r CHECK_URL EXPECTED; do
     # Ignore empty lines and lines starting with #
-    # shellcheck disable=SC1001
     [[ -z "$CHECK_URL" || "$CHECK_URL" =~ ^\# ]] && continue
     # Ignore if it's not a URL in a supported format
-    # shellcheck disable=SC1001
     ! [[ "$CHECK_URL" =~ ^(http(s)?:)?\/.* ]] && continue
 
     if [[ "$CHECK_URL" =~ ^https?: ]]; then
@@ -204,7 +202,6 @@ trigger-scheduler-docker-local-check-deploy() {
       sleep "$WAIT"
 
       # Capture HTTP response or CURL error message
-      # shellcheck disable=SC2086
       if OUTPUT=$(curl -# $CURL_ARGS 2>&1); then
         # OUTPUT contains the HTTP response
         # shellcheck disable=SC2076
diff --git a/plugins/scheduler-docker-local/internal-functions b/plugins/scheduler-docker-local/internal-functions
index 1a44deae9ad..de854b4f971 100755
--- a/plugins/scheduler-docker-local/internal-functions
+++ b/plugins/scheduler-docker-local/internal-functions
@@ -88,7 +88,6 @@ fn-scheduler-docker-local-retire-container() {
     # Attempt to stop, if that fails, then force a kill as docker seems
     # to not send SIGKILL as the docs would indicate. If that fails, move
     # on to the next.
-    # shellcheck disable=SC2086
     "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$CID" \
       || "$DOCKER_BIN" container kill "$CID" \
       || dokku_log_warn "Unable to kill container ${CID}"
diff --git a/plugins/scheduler-docker-local/post-delete b/plugins/scheduler-docker-local/post-delete
index 26c631ec14a..109b0774857 100755
--- a/plugins/scheduler-docker-local/post-delete
+++ b/plugins/scheduler-docker-local/post-delete
@@ -13,7 +13,6 @@ trigger-scheduler-docker-local-post-delete() {
   rm -rf "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP"
 
   # remove all application containers
-  # shellcheck disable=SC2046
   "$DOCKER_BIN" container ls --filter "label=com.dokku.app-name=${APP}" -q | xargs -n1 -I {} "$DOCKER_BIN" container rm --force {} &>/dev/null || true
 }
 
diff --git a/plugins/scheduler-docker-local/pre-deploy b/plugins/scheduler-docker-local/pre-deploy
index 6dcd94faeba..b6d1bb1973b 100755
--- a/plugins/scheduler-docker-local/pre-deploy
+++ b/plugins/scheduler-docker-local/pre-deploy
@@ -58,7 +58,6 @@ scheduler-docker-local-pre-deploy-chown-app() {
     return
   fi
 
-  # shellcheck disable=SC2086
   "$DOCKER_BIN" container run --rm "${DOCKER_RUN_LABEL_ARGS[@]}" $DOKKU_GLOBAL_RUN_ARGS "${ARG_ARRAY[@]}" $IMAGE /bin/bash -c "find $CONTAINER_PATHS -not -user $DOKKU_APP_USER -print0 | xargs -0 -r chown -R $DOKKU_APP_USER" || true
 }
 
diff --git a/plugins/scheduler-docker-local/scheduler-deploy b/plugins/scheduler-docker-local/scheduler-deploy
index b9fbdae7beb..3f742a01b31 100755
--- a/plugins/scheduler-docker-local/scheduler-deploy
+++ b/plugins/scheduler-docker-local/scheduler-deploy
@@ -88,7 +88,6 @@ trigger-scheduler-docker-local-scheduler-deploy() {
         # Attempt to stop, if that fails, then force a kill as docker seems
         # to not send SIGKILL as the docs would indicate. If that fails, move
         # on to the next.
-        # shellcheck disable=SC2086
         "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$oldid" \
           || "$DOCKER_BIN" container kill "$oldid" \
           || plugn trigger retire-container-failed "$APP" "$oldid" # plugin trigger for event logging
diff --git a/plugins/scheduler-docker-local/scheduler-enter b/plugins/scheduler-docker-local/scheduler-enter
index b6b2a024dc6..35cc65ff7dd 100755
--- a/plugins/scheduler-docker-local/scheduler-enter
+++ b/plugins/scheduler-docker-local/scheduler-enter
@@ -74,7 +74,6 @@ trigger-scheduler-docker-local-scheduler-enter() {
   local IMAGE="$("$DOCKER_BIN" container inspect --format '{{ .Config.Image }}' "$CONTAINER_ID")"
   is_image_herokuish_based "$IMAGE" "$APP" && EXEC_CMD="/exec"
   is_image_cnb_based "$IMAGE" && EXEC_CMD="" && DOKKU_RUN_OPTS+=" -w /workspace"
-  # shellcheck disable=SC2086
   "$DOCKER_BIN" container exec $DOKKU_RUN_OPTS "$CONTAINER_ID" $EXEC_CMD "${@:-$DOKKU_APP_SHELL}"
 }
 
diff --git a/plugins/scheduler-docker-local/scheduler-run-stop b/plugins/scheduler-docker-local/scheduler-run-stop
index 3b9f730d41d..d46f9ad72da 100755
--- a/plugins/scheduler-docker-local/scheduler-run-stop
+++ b/plugins/scheduler-docker-local/scheduler-run-stop
@@ -13,7 +13,6 @@ fn-scheduler-docker-local-stop-container() {
   fi
 
   [[ $DOKKU_DOCKER_STOP_TIMEOUT ]] && DOCKER_STOP_TIME_ARG="--time=${DOKKU_DOCKER_STOP_TIMEOUT}"
-  # shellcheck disable=SC2086
   if "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$CONTAINER_ID_OR_NAME"; then
     return
   fi
diff --git a/plugins/scheduler-docker-local/scheduler-stop b/plugins/scheduler-docker-local/scheduler-stop
index 32ab1e5ed73..a6f2bafd939 100755
--- a/plugins/scheduler-docker-local/scheduler-stop
+++ b/plugins/scheduler-docker-local/scheduler-stop
@@ -20,10 +20,8 @@ trigger-scheduler-docker-local-scheduler-stop() {
 
   if [[ -n "$DOKKU_APP_RUNNING_CONTAINER_IDS" ]]; then
     # Disable the container restart policy
-    # shellcheck disable=SC2086
     "$DOCKER_BIN" container update --restart=no $DOKKU_APP_RUNNING_CONTAINER_IDS &>/dev/null || true
 
-    # shellcheck disable=SC2086
     "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG $DOKKU_APP_RUNNING_CONTAINER_IDS >/dev/null || true
   fi
 
@@ -35,7 +33,6 @@ trigger-scheduler-docker-local-scheduler-stop() {
         plugn trigger scheduler-register-retired "$APP" "$CID"
       done
 
-      # shellcheck disable=SC2086
       "$DOCKER_BIN" container rm --force $DOKKU_APP_CIDS >/dev/null 2>&1 || true
     fi
   fi
diff --git a/plugins/shell/subcommands/default b/plugins/shell/subcommands/default
index 2a8b13abfd0..00602e160ca 100755
--- a/plugins/shell/subcommands/default
+++ b/plugins/shell/subcommands/default
@@ -44,7 +44,6 @@ cmd-shell-default() {
 
       # Not a built-in, run as regular dokku command
       *)
-        # shellcheck disable=SC2086
         dokku $line || true
         ;;
     esac
diff --git a/tests.mk b/tests.mk
index 495d5c80f6c..a1cd915d387 100644
--- a/tests.mk
+++ b/tests.mk
@@ -113,13 +113,13 @@ prime-ssh-known-hosts:
 lint-setup:
 	@mkdir -p test-results/shellcheck tmp/shellcheck
 	@find . -not -path '*/\.*' -not -path './debian/*' -not -path './docs/*' -not -path './tests/*' -not -path './vendor/*' -type f | xargs file | grep text | awk -F ':' '{ print $$1 }' | xargs head -n1 | grep -B1 "bash" | grep "==>" | awk '{ print $$2 }' > tmp/shellcheck/test-files
-	@cat tests/shellcheck-exclude | sed -n -e '/^# SC/p' | cut -d' ' -f2 | paste -d, -s > tmp/shellcheck/exclude
+	@cat .shellcheckrc | sed -n -e '/^# SC/p' | cut -d' ' -f2 | paste -d, -s > tmp/shellcheck/exclude
 
 lint-ci: lint-setup
 	# these are disabled due to their expansive existence in the codebase. we should clean it up though
-	@cat tests/shellcheck-exclude | sed -n -e '/^# SC/p'
+	@cat .shellcheckrc | sed -n -e '/^# SC/p'
 	@echo linting...
-	@cat tmp/shellcheck/test-files | xargs shellcheck -e $(shell cat tmp/shellcheck/exclude) | tests/shellcheck-to-junit --output test-results/shellcheck/results.xml --files tmp/shellcheck/test-files --exclude $(shell cat tmp/shellcheck/exclude)
+	@cat tmp/shellcheck/test-files | xargs shellcheck | tests/shellcheck-to-junit --output test-results/shellcheck/results.xml --files tmp/shellcheck/test-files --exclude $(shell cat tmp/shellcheck/exclude)
 
 lint-shfmt: shfmt
 	# verifying via shfmt
diff --git a/tests/ci/setup.sh b/tests/ci/setup.sh
index cfed768b934..b99abf9fc20 100755
--- a/tests/ci/setup.sh
+++ b/tests/ci/setup.sh
@@ -158,7 +158,6 @@ create_package() {
   build_dokku
 }
 
-# shellcheck disable=SC2120
 setup_circle() {
   install_dependencies
   install_dokku
@@ -187,12 +186,10 @@ case "$1" in
     run_dokku_container
     ;;
   build)
-    # shellcheck disable=SC2119
     create_package
     exit $?
     ;;
   *)
-    # shellcheck disable=SC2119
     setup_circle
     exit $?
     ;;
diff --git a/tests/ci/unit_test_runner.sh b/tests/ci/unit_test_runner.sh
index 53f18d6d27c..4d39c10c89c 100755
--- a/tests/ci/unit_test_runner.sh
+++ b/tests/ci/unit_test_runner.sh
@@ -21,7 +21,6 @@ is_number "$BATCH_NUM" || usage
 TESTS=$(find "$(dirname "$0")/../unit" -maxdepth 1 -name "${BATCH_NUM}0*.bats" | sort -n | xargs)
 echo "running the following tests $TESTS"
 
-# shellcheck disable=SC2086
 for test in $TESTS; do
   echo $test
   starttest=$(date +%s)
diff --git a/tests/shellcheck-exclude b/tests/shellcheck-exclude
deleted file mode 100644
index 2049f4b80e6..00000000000
--- a/tests/shellcheck-exclude
+++ /dev/null
@@ -1,32 +0,0 @@
-# SC1001 - This \/ will be a regular '/' in this context - https://github.com/koalaman/shellcheck/wiki/SC1001
-# SC1003 - Want to escape a single quote? echo 'This is how it'\''s done' - https://github.com/koalaman/shellcheck/wiki/SC1003
-# SC1090 - Can't follow non-constant source. Use a directive to specify location - https://github.com/koalaman/shellcheck/wiki/SC1090
-# SC1091 - Not following: FILE: does not exist (No such file or directory) - https://github.com/koalaman/shellcheck/wiki/SC1091
-# SC1117 - Backslash is literal in "\n". Prefer explicit escaping: "\\n" - https://github.com/koalaman/shellcheck/wiki/SC1117
-# SC2029 - Note that, unescaped, this expands on the client side - https://github.com/koalaman/shellcheck/wiki/SC2029
-# SC2030 - Modification of var is local (to subshell caused by pipeline). - https://github.com/koalaman/shellcheck/wiki/SC2030
-# SC2031 - var was modified in a subshell. That change might be lost. - https://github.com/koalaman/shellcheck/wiki/SC2031
-# SC2034 - VAR appears unused - https://github.com/koalaman/shellcheck/wiki/SC2034
-# SC2046 - Quote this to prevent word splitting - https://github.com/koalaman/shellcheck/wiki/SC2046
-# SC2064 - Use single quotes, otherwise this expands now rather than when signalled. - https://github.com/koalaman/shellcheck/wiki/SC2064
-# SC2068 - Double quote array expansions to avoid re-splitting elements - https://github.com/koalaman/shellcheck/wiki/SC2068
-# SC2086 - Double quote to prevent globbing and word splitting - https://github.com/koalaman/shellcheck/wiki/SC2086
-# SC2119 - Use 'function "$@"' if function's $1 should mean script's $1 - https://github.com/koalaman/shellcheck/wiki/SC2119
-# SC2120 - Function references arguments, but none are ever passed - https://github.com/koalaman/shellcheck/wiki/SC2120
-# SC2128 - Expanding an array without an index only gives the first element - https://github.com/koalaman/shellcheck/wiki/SC2128
-# SC2148 - Tips depend on target shell and yours is unknown. Add a shebang - https://github.com/koalaman/shellcheck/wiki/SC2148
-# SC2153 - Possible misspelling: DOKKU_ROOT may not be assigned, but DOKKU_PORT is - https://github.com/koalaman/shellcheck/wiki/SC2153
-# SC2154 - passed_docker_option is referenced but not assigned - https://github.com/koalaman/shellcheck/wiki/SC2154
-# SC2155 - Declare and assign separately to avoid masking return values - https://github.com/koalaman/shellcheck/wiki/SC2155
-# SC2162 - read without -r will mangle backslashes - https://github.com/koalaman/shellcheck/wiki/SC2162
-# SC2174 - When used with -p, -m only applies to the deepest directory - https://github.com/koalaman/shellcheck/wiki/SC2174
-# SC2179 - Use array+=("item") to append items to an array - https://github.com/koalaman/shellcheck/wiki/SC2179
-# SC2191 - The = here is literal. To assign by index, use ( [index]=value ) with no spaces. To keep as literal, quote it - https://github.com/koalaman/shellcheck/wiki/SC2191
-# SC2199 - Arrays implicitly concatenate in [[ ]]. Use a loop (or explicit * instead of @) - https://github.com/koalaman/shellcheck/wiki/SC2199
-# SC2207 - Prefer mapfile or read -a to split command output (or quote to avoid splitting) - https://github.com/koalaman/shellcheck/wiki/SC2207
-# SC2219 - Instead of 'let expr', prefer (( expr ))  - https://github.com/koalaman/shellcheck/wiki/SC2219
-# SC2220 - Invalid flags are not handled. Add a *) case - https://github.com/koalaman/shellcheck/wiki/SC2220
-# SC2231 - Quote expansions in this for loop glob to prevent wordsplitting, e.g. "$dir"/*.txt  - https://github.com/koalaman/shellcheck/wiki/SC2231
-# SC2235 - Use { ..; } instead of (..) to avoid subshell overhead - https://github.com/koalaman/shellcheck/wiki/SC2235
-# SC2267 - GNU xargs -i is deprecated in favor of -I{} - https://github.com/koalaman/shellcheck/wiki/SC2267
-# SC2295 - Expansions inside ${..} need to be quoted separately, otherwise they match as patterns - https://github.com/koalaman/shellcheck/wiki/SC2295
diff --git a/tests/test_deploy b/tests/test_deploy
index fdc67866d59..01ecbda1807 100755
--- a/tests/test_deploy
+++ b/tests/test_deploy
@@ -13,7 +13,6 @@ REPO="test-$(basename "$APP")-$RANDOM"
 ssh "$REMOTE" events:on
 
 destroy_app() {
-  # shellcheck disable=SC2029
   ssh "$REMOTE" apps:destroy "$REPO" --force
   ssh "$REMOTE" events:off
 }
@@ -63,7 +62,6 @@ fi
 
 ssh "$REMOTE" events
 ssh "$REMOTE" apps:list
-# shellcheck disable=SC2029
 URL=$(ssh "$REMOTE" url "$REPO")$FORWARDED_PORT
 sleep 2
 if (./check_deploy "$URL"); then
diff --git a/tests/unit/test_helper.bash b/tests/unit/test_helper.bash
index 7d39ec012d0..c3c242807b3 100644
--- a/tests/unit/test_helper.bash
+++ b/tests/unit/test_helper.bash
@@ -57,8 +57,6 @@ flunk() {
 }
 
 # ShellCheck doesn't know about $status from Bats
-# shellcheck disable=SC2154
-# shellcheck disable=SC2120
 assert_success() {
   if [[ "$status" -ne 0 ]]; then
     flunk "command failed with exit status $status"
@@ -68,8 +66,6 @@ assert_success() {
 }
 
 # ShellCheck doesn't know about $status from Bats
-# shellcheck disable=SC2154
-# shellcheck disable=SC2120
 assert_failure() {
   if [[ "$status" -eq 0 ]]; then
     flunk "expected failed exit status"
@@ -97,7 +93,6 @@ assert_not_equal() {
 }
 
 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output() {
   local expected
   if [[ $# -eq 0 ]]; then
@@ -109,7 +104,6 @@ assert_output() {
 }
 
 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_not_output() {
   local expected
   if [[ $# -eq 0 ]]; then
@@ -121,19 +115,16 @@ assert_not_output() {
 }
 
 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output_exists() {
   [[ -n "$output" ]] || flunk "expected output, found none"
 }
 
 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output_not_exists() {
   [[ -z "$output" ]] || flunk "expected no output, found some"
 }
 
 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output_contains() {
   local input="$output"
   local expected="$1"
@@ -147,7 +138,6 @@ assert_output_contains() {
 }
 
 # ShellCheck doesn't know about $lines from Bats
-# shellcheck disable=SC2154
 assert_line() {
   if [[ "$1" -ge 0 ]] 2>/dev/null; then
     assert_equal "$2" "${lines[$1]}"
@@ -161,7 +151,6 @@ assert_line() {
 }
 
 # ShellCheck doesn't know about $lines from Bats
-# shellcheck disable=SC2154
 assert_line_count() {
   declare EXPECTED="$1"
   local num_lines="${#lines[@]}"
@@ -218,7 +207,6 @@ destroy_key() {
   rm -f /tmp/testkey* &>/dev/null || true
 }
 
-# shellcheck disable=SC2119
 check_urls() {
   local PATTERN="$1"
   run /bin/bash -c "dokku urls $TEST_APP | grep -E \"${PATTERN}\""
@@ -320,7 +308,6 @@ deploy_app() {
 
   rmdir "$TMP" && cp -r "${BATS_TEST_DIRNAME}/../../tests/apps/$APP_TYPE" "$TMP"
 
-  # shellcheck disable=SC2086
   [[ -n "$CUSTOM_TEMPLATE" ]] && $CUSTOM_TEMPLATE $TEST_APP $TMP/$CUSTOM_PATH
 
   pushd "$TMP" &>/dev/null || exit 1