diff --git a/BUILD b/BUILD
index 3a01152242..6472bed457 100644
--- a/BUILD
+++ b/BUILD
@@ -88,6 +88,7 @@ file(
 
 shell_sources(
     name="root",
+    skip_shfmt=True,
 )
 
 file(
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 422b322dbb..bdbbf0e572 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -79,7 +79,7 @@ Added
   to pants' use of PEX lockfiles. This is not a user-facing addition.
   #6118 #6141 #6133 #6120 #6181 #6183 #6200 #6237 #6229 #6240 #6241 #6244 #6251 #6253
   #6254 #6258 #6259 #6260 #6269 #6275 #6279 #6278 #6282 #6283 #6273 #6287 #6306 #6307
-  #6311 #6314 #6315
+  #6311 #6314 #6315 #6317
   Contributed by @cognifloyd
 * Build of ST2 EL9 packages #6153
   Contributed by @amanda11
diff --git a/contrib/core/actions/send_mail/BUILD b/contrib/core/actions/send_mail/BUILD
index 94280e6e49..0b6466d132 100644
--- a/contrib/core/actions/send_mail/BUILD
+++ b/contrib/core/actions/send_mail/BUILD
@@ -2,4 +2,5 @@ st2_shell_sources_and_resources(
     name="send_mail",
     sources=["send_mail"],
     skip_shellcheck=True,
+    skip_shfmt=True,
 )
diff --git a/contrib/examples/actions/BUILD b/contrib/examples/actions/BUILD
index 20fc0fa6ad..fcaae73220 100644
--- a/contrib/examples/actions/BUILD
+++ b/contrib/examples/actions/BUILD
@@ -3,4 +3,5 @@ python_sources()
 shell_sources(
     name="shell",
     skip_shellcheck=True,
+    skip_shfmt=True,
 )
diff --git a/contrib/examples/actions/bash_exit_code/BUILD b/contrib/examples/actions/bash_exit_code/BUILD
index 6c95f66377..25b4f5fd9d 100644
--- a/contrib/examples/actions/bash_exit_code/BUILD
+++ b/contrib/examples/actions/bash_exit_code/BUILD
@@ -1 +1 @@
-shell_sources()
+shell_sources(skip_shfmt=True)
diff --git a/contrib/examples/actions/bash_random/BUILD b/contrib/examples/actions/bash_random/BUILD
index 3acab1965b..ec688f1728 100644
--- a/contrib/examples/actions/bash_random/BUILD
+++ b/contrib/examples/actions/bash_random/BUILD
@@ -1,4 +1,5 @@
 shell_sources(
+    skip_shfmt=True,
     overrides={
         "random2.sh": dict(skip_shellcheck=True),
     },
diff --git a/contrib/linux/actions/BUILD b/contrib/linux/actions/BUILD
index 20fc0fa6ad..fcaae73220 100644
--- a/contrib/linux/actions/BUILD
+++ b/contrib/linux/actions/BUILD
@@ -3,4 +3,5 @@ python_sources()
 shell_sources(
     name="shell",
     skip_shellcheck=True,
+    skip_shfmt=True,
 )
diff --git a/packaging/deb/scripts/post-install.sh b/packaging/deb/scripts/post-install.sh
index 225ec93d4f..43b9cad25d 100644
--- a/packaging/deb/scripts/post-install.sh
+++ b/packaging/deb/scripts/post-install.sh
@@ -31,16 +31,15 @@ set -e
 
 case "$1" in
     configure)
-      # make sure that our socket generators run
-      systemctl daemon-reload >/dev/null 2>&1 || true
-    ;;
-    abort-upgrade|abort-remove|abort-deconfigure)
-    ;;
+        # make sure that our socket generators run
+        systemctl daemon-reload >/dev/null 2>&1 || true
+        ;;
+    abort-upgrade | abort-remove | abort-deconfigure) ;;
 
     *)
         echo "postinst called with unknown argument \`$1'" >&2
         exit 1
-    ;;
+        ;;
 esac
 
 # dh_installdeb will replace this with shell code automatically
diff --git a/packaging/deb/scripts/post-remove.sh b/packaging/deb/scripts/post-remove.sh
index bdc758ad74..0347af5c40 100644
--- a/packaging/deb/scripts/post-remove.sh
+++ b/packaging/deb/scripts/post-remove.sh
@@ -38,13 +38,12 @@ purge_files() {
 case "$1" in
     purge)
         purge_files
-    ;;
-    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
-    ;;
+        ;;
+    remove | upgrade | failed-upgrade | abort-install | abort-upgrade | disappear) ;;
     *)
         echo "postrm called with unknown argument \`$1'" >&2
         exit 1
-    ;;
+        ;;
 esac
 
 # dh_installdeb will replace this with shell code automatically
diff --git a/packaging/deb/scripts/pre-install.sh b/packaging/deb/scripts/pre-install.sh
index 9e5f935c8e..a19994f80a 100644
--- a/packaging/deb/scripts/pre-install.sh
+++ b/packaging/deb/scripts/pre-install.sh
@@ -22,35 +22,34 @@ ST2_USER=st2
 
 ## Create stackstorm users and groups
 create_users() {
-  # create st2 user (services user)
-  (id $ST2_USER 1>/dev/null 2>&1) ||
-    adduser --group --disabled-password --no-create-home --system $ST2_USER
-
-  # make st2 member of st2packs group
-  (getent group $PACKS_GROUP 1>/dev/null 2>&1) || groupadd -r $PACKS_GROUP
-  (groups $ST2_USER 2>/dev/null | grep -q "\b${PACKS_GROUP}\b") ||
-    usermod -a -G $PACKS_GROUP $ST2_USER
-
-  # create stanley user (for actionrunner service)
-  if (! id $SYS_USER 1>/dev/null 2>&1); then
-    adduser --group $SYS_USER
-    adduser --disabled-password --gecos "" --ingroup $SYS_USER $SYS_USER
-  fi
+    # create st2 user (services user)
+    (id $ST2_USER 1>/dev/null 2>&1) ||
+        adduser --group --disabled-password --no-create-home --system $ST2_USER
+
+    # make st2 member of st2packs group
+    (getent group $PACKS_GROUP 1>/dev/null 2>&1) || groupadd -r $PACKS_GROUP
+    (groups $ST2_USER 2>/dev/null | grep -q "\b${PACKS_GROUP}\b") ||
+        usermod -a -G $PACKS_GROUP $ST2_USER
+
+    # create stanley user (for actionrunner service)
+    if (! id $SYS_USER 1>/dev/null 2>&1); then
+        adduser --group $SYS_USER
+        adduser --disabled-password --gecos "" --ingroup $SYS_USER $SYS_USER
+    fi
 }
 
 case "$1" in
     install)
-      create_users
-    ;;
+        create_users
+        ;;
     upgrade)
-      create_users
-    ;;
-    abort-upgrade)
-    ;;
+        create_users
+        ;;
+    abort-upgrade) ;;
     *)
         echo "preinst called with unknown argument \`$1'" >&2
         exit 1
-    ;;
+        ;;
 esac
 
 # dh_installdeb will replace this with shell code automatically
diff --git a/packaging/rpm/scripts/pre-install.sh b/packaging/rpm/scripts/pre-install.sh
index e12dd26590..36d7325661 100644
--- a/packaging/rpm/scripts/pre-install.sh
+++ b/packaging/rpm/scripts/pre-install.sh
@@ -12,18 +12,18 @@ ST2_USER=%{svc_user}
 
 ## Create stackstorm users and groups (differs from debian)
 create_users() {
-  # create st2 user (services user)
-  (id $ST2_USER 1>/dev/null 2>&1) ||
-    adduser --no-create-home --system --user-group $ST2_USER
+    # create st2 user (services user)
+    (id $ST2_USER 1>/dev/null 2>&1) ||
+        adduser --no-create-home --system --user-group $ST2_USER
 
-  # make st2 member of st2packs group
-  (getent group $PACKS_GROUP 1>/dev/null 2>&1) || groupadd -r $PACKS_GROUP
-  (groups $ST2_USER 2>/dev/null | grep -q "\b${PACKS_GROUP}\b") ||
-    usermod -a -G $PACKS_GROUP $ST2_USER
+    # make st2 member of st2packs group
+    (getent group $PACKS_GROUP 1>/dev/null 2>&1) || groupadd -r $PACKS_GROUP
+    (groups $ST2_USER 2>/dev/null | grep -q "\b${PACKS_GROUP}\b") ||
+        usermod -a -G $PACKS_GROUP $ST2_USER
 
-  # create stanley user (unprivileged action user, we don't ship sudoers.d config)
-  (id $SYS_USER 1>/dev/null 2>&1) ||
-    adduser --user-group $SYS_USER
+    # create stanley user (unprivileged action user, we don't ship sudoers.d config)
+    (id $SYS_USER 1>/dev/null 2>&1) ||
+        adduser --user-group $SYS_USER
 }
 
 create_users
diff --git a/pants-plugins/macros.py b/pants-plugins/macros.py
index 0279408d08..a8fd2021da 100644
--- a/pants-plugins/macros.py
+++ b/pants-plugins/macros.py
@@ -181,6 +181,7 @@ def st2_shell_sources_and_resources(**kwargs):
     shell_sources(**kwargs)  # noqa: F821
 
     kwargs.pop("skip_shellcheck", None)
+    kwargs.pop("skip_shfmt", None)
 
     kwargs["name"] += "_resources"
     resources(**kwargs)  # noqa: F821
diff --git a/pants.toml b/pants.toml
index 092dc72028..d406775006 100644
--- a/pants.toml
+++ b/pants.toml
@@ -26,6 +26,7 @@ backend_packages = [
   # shell
   "pants.backend.shell",
   "pants.backend.shell.lint.shellcheck",
+  "pants.backend.shell.lint.shfmt",
 
   # packaging
   "pants.backend.experimental.makeself",
@@ -236,6 +237,13 @@ config = "@lint-configs/regex-lint.yaml"
 [setuptools]
 install_from_resolve = "st2"
 
+[shfmt]
+args = [
+  # https://github.com/mvdan/sh/blob/master/cmd/shfmt/shfmt.1.scd#printer-flags
+  "--indent=4", # default is 0 (use tabs)
+  "--case-indent",
+]
+
 [test]
 extra_env_vars = [
   # Use this so that the test system does not require the stanley user.
diff --git a/scripts/BUILD b/scripts/BUILD
index 3ba6abf422..c4eddad01b 100644
--- a/scripts/BUILD
+++ b/scripts/BUILD
@@ -2,4 +2,5 @@ python_sources()
 
 shell_sources(
     name="shell",
+    skip_shfmt=True,
 )
diff --git a/scripts/ci/BUILD b/scripts/ci/BUILD
index 6c95f66377..25b4f5fd9d 100644
--- a/scripts/ci/BUILD
+++ b/scripts/ci/BUILD
@@ -1 +1 @@
-shell_sources()
+shell_sources(skip_shfmt=True)
diff --git a/scripts/github/BUILD b/scripts/github/BUILD
index 714f976026..de6f858cd9 100644
--- a/scripts/github/BUILD
+++ b/scripts/github/BUILD
@@ -8,4 +8,5 @@ files(
 
 shell_sources(
     dependencies=[":assets"],
+    skip_shfmt=True,
 )
diff --git a/st2actions/bin/BUILD b/st2actions/bin/BUILD
index 5a138aad51..18fbabe001 100644
--- a/st2actions/bin/BUILD
+++ b/st2actions/bin/BUILD
@@ -9,4 +9,5 @@ st2_shell_sources_and_resources(
     name="shell",
     sources=["*.sh"],
     skip_shellcheck=True,
+    skip_shfmt=True,
 )
diff --git a/st2common/bin/BUILD b/st2common/bin/BUILD
index 18dea00811..f8626901e5 100644
--- a/st2common/bin/BUILD
+++ b/st2common/bin/BUILD
@@ -15,6 +15,7 @@ st2_shell_sources_and_resources(
     name="shell",
     sources=["st2ctl", "st2-self-check", "st2-run-pack-tests"],
     skip_shellcheck=True,
+    skip_shfmt=True,
     overrides={
         "st2ctl": dict(
             dependencies=[
diff --git a/st2common/bin/migrations/v2.1/BUILD b/st2common/bin/migrations/v2.1/BUILD
index 20fc0fa6ad..fcaae73220 100644
--- a/st2common/bin/migrations/v2.1/BUILD
+++ b/st2common/bin/migrations/v2.1/BUILD
@@ -3,4 +3,5 @@ python_sources()
 shell_sources(
     name="shell",
     skip_shellcheck=True,
+    skip_shfmt=True,
 )
diff --git a/st2common/tests/fixtures/BUILD b/st2common/tests/fixtures/BUILD
index 01dbde214a..2056d6ae37 100644
--- a/st2common/tests/fixtures/BUILD
+++ b/st2common/tests/fixtures/BUILD
@@ -3,4 +3,5 @@ python_sources()
 st2_shell_sources_and_resources(
     name="shell",
     sources=["*.sh"],
+    skip_shfmt=True,
 )
diff --git a/st2tests/integration/BUILD b/st2tests/integration/BUILD
index afb7d1e65e..d02566f56f 100644
--- a/st2tests/integration/BUILD
+++ b/st2tests/integration/BUILD
@@ -12,4 +12,5 @@ shell_sources(
         "st2tests/conf:vagrant_ssh_key",
     ],
     skip_shellcheck=True,
+    skip_shfmt=True,
 )
diff --git a/st2tests/st2tests/fixtures/generic/actions/BUILD b/st2tests/st2tests/fixtures/generic/actions/BUILD
index de6d193a62..3a6dfb8011 100644
--- a/st2tests/st2tests/fixtures/generic/actions/BUILD
+++ b/st2tests/st2tests/fixtures/generic/actions/BUILD
@@ -1,4 +1,5 @@
 st2_shell_sources_and_resources(
     name="shell",
     sources=["*.sh"],
+    skip_shfmt=True,
 )
diff --git a/st2tests/st2tests/fixtures/packs/BUILD b/st2tests/st2tests/fixtures/packs/BUILD
index a5006ef9d1..1eadbc643c 100644
--- a/st2tests/st2tests/fixtures/packs/BUILD
+++ b/st2tests/st2tests/fixtures/packs/BUILD
@@ -18,6 +18,7 @@ st2_shell_sources_and_resources(
     name="test_content_version_shell",
     # do not check across git submodule boundary
     skip_shellcheck=True,
+    skip_shfmt=True,
     sources=[
         "test_content_version/**/*.sh",
     ],
diff --git a/st2tests/st2tests/fixtures/ssl_certs/BUILD b/st2tests/st2tests/fixtures/ssl_certs/BUILD
index d8eca2c8a2..b7fc938b0a 100644
--- a/st2tests/st2tests/fixtures/ssl_certs/BUILD
+++ b/st2tests/st2tests/fixtures/ssl_certs/BUILD
@@ -17,4 +17,5 @@ python_sources(
 
 shell_sources(
     name="util",
+    skip_shfmt=True,
 )
diff --git a/st2tests/testpacks/errorcheck/actions/BUILD b/st2tests/testpacks/errorcheck/actions/BUILD
index 31c2d6bc4c..ae5641e5d7 100644
--- a/st2tests/testpacks/errorcheck/actions/BUILD
+++ b/st2tests/testpacks/errorcheck/actions/BUILD
@@ -1 +1 @@
-shell_sources(skip_shellcheck=True)
+shell_sources(skip_shellcheck=True, skip_shfmt=True)
diff --git a/tools/BUILD b/tools/BUILD
index 249de0b775..ba86840017 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -48,6 +48,7 @@ shell_sources(
         "st2-setup-*",
     ],
     skip_shellcheck=True,
+    skip_shfmt=True,
     dependencies=[
         "conf:st2_dev_conf",
     ],