diff --git a/quality/BUILD.bazel b/quality/BUILD.bazel
index 19ef92dd7c4866..261338db9ec41d 100644
--- a/quality/BUILD.bazel
+++ b/quality/BUILD.bazel
@@ -211,6 +211,9 @@ sh_test(
     srcs = ["//util/sh/scripts:run-shellcheck.sh"],
     data = [
         "//:WORKSPACE",
-        "@shellcheck",
+        "@shellcheck//:shellcheck",
     ],
+    env = {
+        "SHELLCHECK": "$(location @shellcheck//:shellcheck)",
+    },
 )
diff --git a/util/sh/scripts/run-shellcheck.sh b/util/sh/scripts/run-shellcheck.sh
index 33aea0c89e38db..b9c764f814fd9e 100755
--- a/util/sh/scripts/run-shellcheck.sh
+++ b/util/sh/scripts/run-shellcheck.sh
@@ -10,7 +10,7 @@ set -e
 # This assumption enables us to infer that we're running in the sandbox when we
 # see a symlink named "WORKSPACE".
 if [[ -L WORKSPACE ]]; then
-    SHELLCHECK="$(realpath external/shellcheck/shellcheck)"
+    SHELLCHECK="$(realpath "${SHELLCHECK}")"
     REPO_TOP="$(dirname "$(realpath WORKSPACE)")"
     cd "${REPO_TOP}"
 else