diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ce470928..a58352f8 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -28,3 +28,9 @@ repos:
     hooks:
       - id: gitlint
         stages: [commit-msg]
+
+  - repo: https://github.com/koalaman/shellcheck-precommit
+    rev: v0.9.0
+    hooks:
+    -   id: shellcheck
+#       args: ["--severity=warning"]  # Optionally only show errors and warnings
diff --git a/debian/frostfs-ir.postinst b/debian/frostfs-ir.postinst
index cb4a1031..eb9d381c 100755
--- a/debian/frostfs-ir.postinst
+++ b/debian/frostfs-ir.postinst
@@ -28,9 +28,9 @@ case "$1" in
             chmod -f 0640 /etc/frostfs/$USERNAME/config.yml || true
             chmod -f 0640 /etc/frostfs/$USERNAME/control.yml || true
         fi
-        USERDIR=$(getent passwd "frostfs-$USERNAME" | cut -d: -f6)
-        if ! dpkg-statoverride --list frostfs-$USERDIR >/dev/null; then
-            chown -f frostfs-$USERNAME: $USERDIR
+        USERDIR="$(getent passwd frostfs-$USERNAME | cut -d: -f6)"
+        if ! dpkg-statoverride --list frostfs-"$USERDIR" >/dev/null; then
+            chown -f frostfs-$USERNAME: "$USERDIR"
         fi
     ;;
 
diff --git a/debian/frostfs-storage.postinst b/debian/frostfs-storage.postinst
index 0ecce744..88fa53be 100755
--- a/debian/frostfs-storage.postinst
+++ b/debian/frostfs-storage.postinst
@@ -28,9 +28,9 @@ case "$1" in
             chmod -f 0640 /etc/frostfs/$USERNAME/config.yml || true
             chmod -f 0640 /etc/frostfs/$USERNAME/control.yml || true
         fi
-        USERDIR=$(getent passwd "frostfs-$USERNAME" | cut -d: -f6)
-        if ! dpkg-statoverride --list frostfs-$USERDIR >/dev/null; then
-            chown -f frostfs-$USERNAME: $USERDIR
+        USERDIR=$(getent passwd frostfs-$USERNAME | cut -d: -f6)
+        if ! dpkg-statoverride --list frostfs-"$USERDIR" >/dev/null; then
+            chown -f frostfs-$USERNAME: "$USERDIR"
         fi
         USERDIR=/srv/frostfs
         if ! dpkg-statoverride --list frostfs-$USERDIR >/dev/null; then