diff --git a/.ci/grep.sh b/.ci/grep.sh
new file mode 100755
index 000000000..94e95f177
--- /dev/null
+++ b/.ci/grep.sh
@@ -0,0 +1,16 @@
+#!/bin/sh -e
+# Description: check various bad patterns with grep
+# https://postmarktos.org/pmb-ci
+
+if [ "$(id -u)" = 0 ]; then
+	set -x
+	apk -q add grep
+	exec su "${TESTUSER:-build}" -c "sh -e $0"
+fi
+
+# Find CHANGEMEs in APKBUILDs
+if grep -qr '(CHANGEME!)' *; then
+	echo "ERROR: Please replace '(CHANGEME!)' in the following files:"
+	grep --color=always -r '(CHANGEME!)' *
+	exit 1
+fi
diff --git a/.ci/shellcheck.sh b/.ci/shellcheck.sh
index b58e69902..5317b5512 100755
--- a/.ci/shellcheck.sh
+++ b/.ci/shellcheck.sh
@@ -1,16 +1,15 @@
 #!/bin/sh -e
-# Copyright 2021 Oliver Smith
+# Copyright 2022 Oliver Smith
 # SPDX-License-Identifier: GPL-3.0-or-later
+# Description: lint all shell scripts
+# https://postmarktos.org/pmb-ci
 
-set -e
-DIR="$(cd "$(dirname "$0")" && pwd -P)"
-cd "$DIR/.."
+DIR="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Find CHANGEMEs in APKBUILDs
-if grep -qr '(CHANGEME!)' *; then
-	echo "ERROR: Please replace '(CHANGEME!)' in the following files:"
-	grep --color=always -r '(CHANGEME!)' *
-	exit 1
+if [ "$(id -u)" = 0 ]; then
+	set -x
+	apk -q add shellcheck
+	exec su "${TESTUSER:-build}" -c "sh -e $0"
 fi
 
 # Shell: shellcheck
@@ -42,8 +41,9 @@ sh_files="
 
 	$(find . -path '.ci/*.sh')
 "
+
 for file in $sh_files; do
 	echo "Test with shellcheck: $file"
-	cd "$DIR/../$(dirname "$file")"
+	cd "$DIR/$(dirname "$file")"
 	shellcheck -e SC1008 -x "$(basename "$file")"
 done
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f65233ac3..f4b566cc3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -51,15 +51,15 @@ flake8:
     - .ci/lib/gitlab_prepare_ci.sh
     - .ci/flake8.sh
 
-# shellcheck
-shellcheck:
+# shellcheck and various grep checks
+shellcheck-grep:
   stage: lint
   <<: *only-default
   image: alpine:edge
-  before_script:
-    - apk -q add shellcheck
   script:
+    - .ci/lib/gitlab_prepare_ci.sh
     - .ci/shellcheck.sh
+    - .ci/grep.sh
 
 editor-config:
   stage: lint