diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 0000000..e30caea
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,14 @@
+# shellcheck config for the diskless build scripts.
+#
+# The 95dot1x-macsec dracut module runs inside the initramfs, where some
+# constructs are idiomatic but trip shellcheck's static analysis:
+#
+#   SC1091 - sourced files (e.g. /lib/dracut-lib.sh) exist only at runtime in
+#            the initramfs and cannot be followed at lint time.
+#   SC2154 - `moddir` (and friends) are injected by dracut's module framework,
+#            not assigned in the script.
+#
+# These are not bugs; suppress them so the CI shellcheck gate stays green
+# while still catching real issues (style nits like SC2010 are handled with
+# scoped inline directives, not disabled globally).
+disable=SC1091,SC2154