diff --git a/docker/main-wrapper.sh b/docker/main-wrapper.sh
index 3426c7a0953..a164b77eaa2 100755
--- a/docker/main-wrapper.sh
+++ b/docker/main-wrapper.sh
@@ -1,4 +1,5 @@
 #!/command/with-contenv sh
+# shellcheck shell=sh
 # /opt/hermes/docker/main-wrapper.sh — wraps the container's CMD with
 # the same argument-routing logic the pre-s6 entrypoint.sh used. Runs
 # as /init's "main program" (Docker CMD) so it inherits stdin/stdout/