diff --git a/.editorconfig b/.editorconfig
index 8806648..ef4e49d 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -7,7 +7,9 @@ end_of_line = lf
 insert_final_newline = true
 trim_trailing_whitespace = true
 
+[*.sh]
+indent_size = 2
+
 [*.nix]
 indent_size = 2
-tab_width = 2
 
diff --git a/flake.nix b/flake.nix
index 36e54fa..588b7bc 100644
--- a/flake.nix
+++ b/flake.nix
@@ -14,6 +14,11 @@
         pkgs = nixpkgs.legacyPackages.${system};
       in
       {
+        packages.default = pkgs.writeShellApplication {
+          name = "git-check-assertions";
+          runtimeInputs = [ pkgs.git ];
+          text = builtins.readFile ./git-check-assertions.sh;
+        };
         devShells.default = pkgs.mkShell {
           packages = with pkgs; [ bats ];
         };
diff --git a/git-check-assertions.sh b/git-check-assertions.sh
index b0fe652..a023370 100755
--- a/git-check-assertions.sh
+++ b/git-check-assertions.sh
@@ -41,6 +41,7 @@ for commit_hash in "${commits[@]}"; do
   echo "Checking out $commit_hash"
   git -c advice.detachedHead=false checkout -q "$commit_hash"
   commit_msg="$(git log -1 --format=%B "$commit_hash")"
+  # shellcheck disable=SC2016
   block="$(printf '%s\n' "$commit_msg" \
     | sed -n '/^```git-check-assertions[[:space:]]*$/,/^```[[:space:]]*$/p' \
     | sed '1d;$d')"