diff --git a/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_email_deliverer_backlog b/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_email_deliverer_backlog
index 360ceb499d..03f2cb567e 100755
--- a/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_email_deliverer_backlog
+++ b/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_email_deliverer_backlog
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -eu
 
 #"OK": 0
diff --git a/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_email_deliverer_process b/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_email_deliverer_process
index 180183e5b3..ba9f2a9e78 100755
--- a/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_email_deliverer_process
+++ b/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_email_deliverer_process
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 #"OK": 0
 #"WARNING": 1
diff --git a/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_worker_memory b/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_worker_memory
index a3b863e80a..b7d0d22225 100755
--- a/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_worker_memory
+++ b/puppet/zulip/files/nagios_plugins/zulip_app_frontend/check_worker_memory
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Checks for any Zulip queue workers that are leaking memory and thus have a high vsize
 datafile=$(mktemp)
 
diff --git a/scripts/lib/build-pgroonga b/scripts/lib/build-pgroonga
index d6980000ff..483f797b8c 100755
--- a/scripts/lib/build-pgroonga
+++ b/scripts/lib/build-pgroonga
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -x
 set -e
 
diff --git a/scripts/lib/build-tsearch-extras b/scripts/lib/build-tsearch-extras
index f569104ea0..2db3f79543 100755
--- a/scripts/lib/build-tsearch-extras
+++ b/scripts/lib/build-tsearch-extras
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -x
 set -e
 
diff --git a/scripts/lib/certbot-maybe-renew b/scripts/lib/certbot-maybe-renew
index 28918a4e0f..c3d1c5acb8 100755
--- a/scripts/lib/certbot-maybe-renew
+++ b/scripts/lib/certbot-maybe-renew
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 zulip_conf_get_boolean() {
     # Get a boolean flag from zulip.conf, using the Python
diff --git a/scripts/lib/check-upstart b/scripts/lib/check-upstart
index 44d92930cd..c8d7b45cfb 100755
--- a/scripts/lib/check-upstart
+++ b/scripts/lib/check-upstart
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 release=$(lsb_release -sc)
 
 if [ "$release" = "xenial" ] && [ -x /sbin/start ] && [ -x /sbin/stop ] && [ -x /sbin/restart ] && [ -x /sbin/status ] && [ -x /sbin/initctl ]; then
diff --git a/scripts/lib/create-zulip-admin b/scripts/lib/create-zulip-admin
index 4f77d00704..07b5603f4c 100755
--- a/scripts/lib/create-zulip-admin
+++ b/scripts/lib/create-zulip-admin
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 if { [ "$ZULIP_USER_CREATION_ENABLED" == "True" ] || [ "$ZULIP_USER_CREATION_ENABLED" == "true" ]; } && \
    { [ -z "$ZULIP_USER_DOMAIN" ]   || \
diff --git a/scripts/lib/install-shellcheck b/scripts/lib/install-shellcheck
index 6aba3c452e..8769607f77 100755
--- a/scripts/lib/install-shellcheck
+++ b/scripts/lib/install-shellcheck
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -eu
 
 version=0.6.0
diff --git a/scripts/lib/setup-apt-repo b/scripts/lib/setup-apt-repo
index 775ec839fa..58e37ed6a2 100755
--- a/scripts/lib/setup-apt-repo
+++ b/scripts/lib/setup-apt-repo
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -x
 set -e
 
diff --git a/scripts/lib/setup-apt-repo-debathena b/scripts/lib/setup-apt-repo-debathena
index 0e603ce571..d0626a4acd 100755
--- a/scripts/lib/setup-apt-repo-debathena
+++ b/scripts/lib/setup-apt-repo-debathena
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -x
 set -e
 
diff --git a/scripts/lib/setup-yum-repo b/scripts/lib/setup-yum-repo
index 07d44e2d70..c68b797530 100755
--- a/scripts/lib/setup-yum-repo
+++ b/scripts/lib/setup-yum-repo
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -x
 set -e
 
diff --git a/scripts/setup/install b/scripts/setup/install
index 8eeae7fa5b..0a5b99338e 100755
--- a/scripts/setup/install
+++ b/scripts/setup/install
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # Thin wrapper around the actual install script (scripts/lib/install).
 # The purpose of this wrapper is to log the full install script output
diff --git a/scripts/setup/postgres-create-db b/scripts/setup/postgres-create-db
index 4d0c063b39..d24438ad32 100755
--- a/scripts/setup/postgres-create-db
+++ b/scripts/setup/postgres-create-db
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 set -x
 
diff --git a/scripts/setup/postgres-init-db b/scripts/setup/postgres-init-db
index 225e25c50b..9e5caad591 100755
--- a/scripts/setup/postgres-init-db
+++ b/scripts/setup/postgres-init-db
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 if [ "$EUID" -ne 0 ]; then
diff --git a/scripts/upgrade-zulip b/scripts/upgrade-zulip
index 42c0267f24..21088f15a2 100755
--- a/scripts/upgrade-zulip
+++ b/scripts/upgrade-zulip
@@ -1,2 +1,2 @@
-#!/bin/bash
+#!/usr/bin/env bash
 "$(dirname "$0")/lib/upgrade-zulip" "$@" 2>&1 | tee -a /var/log/zulip/upgrade.log
diff --git a/scripts/upgrade-zulip-from-git b/scripts/upgrade-zulip-from-git
index 92c790d87c..cc0b2ff01d 100755
--- a/scripts/upgrade-zulip-from-git
+++ b/scripts/upgrade-zulip-from-git
@@ -1,2 +1,2 @@
-#!/bin/bash
+#!/usr/bin/env bash
 "$(dirname "$0")/lib/upgrade-zulip-from-git" "$@" 2>&1 | tee -a /var/log/zulip/upgrade.log
diff --git a/tools/ci/activate-venv b/tools/ci/activate-venv
index 4fb4e8fe38..dcaff5ea72 100644
--- a/tools/ci/activate-venv
+++ b/tools/ci/activate-venv
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 source /srv/zulip-py3-venv/bin/activate
 echo "Using $VIRTUAL_ENV"
diff --git a/tools/ci/backend b/tools/ci/backend
index 477815f242..2841450b7c 100755
--- a/tools/ci/backend
+++ b/tools/ci/backend
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 source tools/ci/activate-venv
 echo "Test suite is running under $(python --version)."
diff --git a/tools/ci/frontend b/tools/ci/frontend
index b065111cb0..e78e4c5da8 100755
--- a/tools/ci/frontend
+++ b/tools/ci/frontend
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 source tools/ci/activate-venv
 
diff --git a/tools/ci/production b/tools/ci/production
index 08a688bfd1..dcf4cdfe27 100755
--- a/tools/ci/production
+++ b/tools/ci/production
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 set -x
 
diff --git a/tools/ci/production-helper b/tools/ci/production-helper
index 4bcd55bf94..a399b8ead4 100755
--- a/tools/ci/production-helper
+++ b/tools/ci/production-helper
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # This test installs a Zulip production environment (from the release
 # tarball from setup-production), and then runs some Nagios checks and
 # other tools to verify that everything is working properly.
diff --git a/tools/ci/setup-backend b/tools/ci/setup-backend
index 97dc43515e..1344102572 100755
--- a/tools/ci/setup-backend
+++ b/tools/ci/setup-backend
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 set -x
 
diff --git a/tools/ci/setup-production b/tools/ci/setup-production
index c595a2f248..e8b0e8719c 100755
--- a/tools/ci/setup-production
+++ b/tools/ci/setup-production
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # In short, this provisions a Zulip development environment and then
 # builds a Zulip release tarball (the same way we build them for an
 # actual release).  The actual test job will then install that.
diff --git a/tools/commit-message-lint b/tools/commit-message-lint
index fec3e0e3b6..425b69fd7f 100755
--- a/tools/commit-message-lint
+++ b/tools/commit-message-lint
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Lint all commit messages that are newer than upstream/master if running
 # locally or the commits in the push or PR if in Travis CI.
diff --git a/tools/commit-msg b/tools/commit-msg
index ad3549b52c..bdc85d7335 100755
--- a/tools/commit-msg
+++ b/tools/commit-msg
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # This hook runs gitlint on your commit message.
 
diff --git a/tools/deploy-branch b/tools/deploy-branch
index d4b7375cd1..6f00c7a26b 100755
--- a/tools/deploy-branch
+++ b/tools/deploy-branch
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 function error_out {
     echo -en '\e[0;31m'
diff --git a/tools/fetch-pull-request b/tools/fetch-pull-request
index c8e3531427..bd1b425ade 100755
--- a/tools/fetch-pull-request
+++ b/tools/fetch-pull-request
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 set -x
 
diff --git a/tools/fetch-rebase-pull-request b/tools/fetch-rebase-pull-request
index 34b6d79cf3..08ddbba6fa 100755
--- a/tools/fetch-rebase-pull-request
+++ b/tools/fetch-rebase-pull-request
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 set -x
 
diff --git a/tools/find-unused-css b/tools/find-unused-css
index d474922c03..d5e90e1c6c 100755
--- a/tools/find-unused-css
+++ b/tools/find-unused-css
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Hackish tool for attempting to find unused IDs / classes in our CSS
 
 for n in $(perl -lne 'print $1 while /[#.]([a-zA-Z0-9_-]+)/g' static/styles/zulip.css | sort -u); do
diff --git a/tools/linter_lib/custom_check.py b/tools/linter_lib/custom_check.py
index defdc1bbbe..d30ace2e9f 100644
--- a/tools/linter_lib/custom_check.py
+++ b/tools/linter_lib/custom_check.py
@@ -179,10 +179,15 @@ def custom_check_file(fn: str,
             shebang_rules = [{'pattern': '^#!',
                               'description': "zerver library code shouldn't have a shebang line."}]
         else:
-            shebang_rules = [{'pattern': '#!/usr/bin/python',
-                              'description': "Use `#!/usr/bin/env python3` instead of `#!/usr/bin/python`"},
-                             {'pattern': '#!/usr/bin/env python$',
-                              'description': "Use `#!/usr/bin/env python3` instead of `#!/usr/bin/env python`."}]
+            shebang_rules = [
+                # /bin/sh and /usr/bin/env are the only two binaries
+                # that NixOS provides at a fixed path (outside a
+                # buildFHSUserEnv sandbox).
+                {'pattern': '^#!(?! *(?:/usr/bin/env|/bin/sh)(?: |$))',
+                 'description': "Use `#!/usr/bin/env foo` instead of `#!/path/foo` for interpreters other than sh."},
+                {'pattern': '^#!/usr/bin/env python$',
+                 'description': "Use `#!/usr/bin/env python3` instead of `#!/usr/bin/env python`."}
+            ]
         for rule in shebang_rules:
             if re.search(rule['pattern'], firstline):
                 print_err(identifier, color,
diff --git a/tools/pre-commit b/tools/pre-commit
index 9807744859..a2f25d927c 100755
--- a/tools/pre-commit
+++ b/tools/pre-commit
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # This hook runs the Zulip code linter ./tools/lint and returns true
 # regardless of linter results so that your commit may continue.
diff --git a/tools/provision b/tools/provision
index cafe4d7e42..215320a598 100755
--- a/tools/provision
+++ b/tools/provision
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Use this script to provision dependencies for your Zulip installation.
 # This script is idempotent, so it can be restarted at any time, and it
diff --git a/tools/push-to-pull-request b/tools/push-to-pull-request
index 27f95a8a81..a07eb12633 100755
--- a/tools/push-to-pull-request
+++ b/tools/push-to-pull-request
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 usage () {
diff --git a/tools/reset-to-pull-request b/tools/reset-to-pull-request
index e70ae020bf..6ee874f6c7 100755
--- a/tools/reset-to-pull-request
+++ b/tools/reset-to-pull-request
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 if ! git diff-index --quiet HEAD; then
diff --git a/tools/setup-git-repo b/tools/setup-git-repo
index 6035cee220..c38dedd158 100755
--- a/tools/setup-git-repo
+++ b/tools/setup-git-repo
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 if ! [ -d ".git/hooks/" ]; then
     echo "Error: Could not find .git/hooks directory"
diff --git a/tools/setup/optimize-svg b/tools/setup/optimize-svg
index f4615c13d3..ddfe492b40 100755
--- a/tools/setup/optimize-svg
+++ b/tools/setup/optimize-svg
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 if [ "$(node_modules/.bin/svgo -f static/images/integrations/logos | grep -o '\.[0-9]% = ' | wc -l)" -ge 1 ]
  then
diff --git a/tools/start-dockers b/tools/start-dockers
index ec31cb54e8..80480be51c 100755
--- a/tools/start-dockers
+++ b/tools/start-dockers
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 sudo service rabbitmq-server restart
 sudo service postgresql restart
diff --git a/tools/test-all-docker b/tools/test-all-docker
index 15912dee61..2b3b3f33c3 100755
--- a/tools/test-all-docker
+++ b/tools/test-all-docker
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 sudo service rabbitmq-server restart
 sudo service postgresql restart
diff --git a/tools/test-install/destroy-all b/tools/test-install/destroy-all
index cfb6cf950d..df30fd9d6b 100755
--- a/tools/test-install/destroy-all
+++ b/tools/test-install/destroy-all
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 usage() {
diff --git a/tools/test-install/install b/tools/test-install/install
index 187633eea2..d091a90e2c 100755
--- a/tools/test-install/install
+++ b/tools/test-install/install
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 usage() {
diff --git a/tools/test-install/lxc-wait b/tools/test-install/lxc-wait
index b03e300c9d..09c3338baa 100755
--- a/tools/test-install/lxc-wait
+++ b/tools/test-install/lxc-wait
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 usage() {
diff --git a/tools/test-install/prepare-base b/tools/test-install/prepare-base
index d0fd8af576..a4ce11d8b7 100755
--- a/tools/test-install/prepare-base
+++ b/tools/test-install/prepare-base
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 if [ "$EUID" -ne 0 ]; then
diff --git a/tools/test-migrations b/tools/test-migrations
index ed55610b7a..7f16a32a67 100755
--- a/tools/test-migrations
+++ b/tools/test-migrations
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 echo 'Testing whether migrations are consistent with models'