diff --git a/Makefile b/Makefile
index 1b29fc663f..81700e2c01 100644
--- a/Makefile
+++ b/Makefile
@@ -606,7 +606,7 @@ endif
 # GitHub Actions linters are run in a separate CI job (lint-actions) that only
 # triggers when workflow files change, so we skip them here when CI=true.
 LINT_ACTIONS_TARGETS := $(if $(CI),,lint/actions/actionlint)
-lint: lint/shellcheck lint/go lint/ts lint/examples lint/helm lint/site-icons lint/markdown lint/check-scopes lint/migrations $(LINT_ACTIONS_TARGETS)
+lint: lint/shellcheck lint/go lint/ts lint/examples lint/helm lint/site-icons lint/markdown lint/check-scopes lint/migrations lint/bootstrap $(LINT_ACTIONS_TARGETS)
 .PHONY: lint
 
 lint/site-icons:
@@ -636,6 +636,11 @@ lint/shellcheck: $(SHELL_SRC_FILES)
 	shellcheck --external-sources $(SHELL_SRC_FILES)
 .PHONY: lint/shellcheck
 
+lint/bootstrap:
+	bash scripts/check_bootstrap_quotes.sh
+.PHONY: lint/bootstrap
+
+
 lint/helm:
 	cd helm/
 	make lint
diff --git a/scripts/check_bootstrap_quotes.sh b/scripts/check_bootstrap_quotes.sh
new file mode 100755
index 0000000000..bd44d41626
--- /dev/null
+++ b/scripts/check_bootstrap_quotes.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# shellcheck source=scripts/lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+cdroot
+
+echo "--- check bootstrap scripts for single quotes"
+
+files=$(find provisionersdk/scripts -type f -name '*.sh')
+found=0
+for f in $files; do
+	if grep -n "'" "$f"; then
+		echo "ERROR: $f contains single quotes (apostrophes)."
+		echo "       Bootstrap scripts are inlined via sh -c '...' in templates."
+		echo "       Single quotes break this quoting. Use alternative phrasing."
+		found=1
+	fi
+done
+
+if [ "$found" -ne 0 ]; then
+	exit 1
+fi
+
+echo "OK: no single quotes found in bootstrap scripts."