diff --git a/.editorconfig b/.editorconfig
index 0753e51f7e..7009d2232c 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -3,15 +3,15 @@ root = true
 [*]
 end_of_line = lf
 charset = utf-8
+indent_size = 4
 indent_style = space
 insert_final_newline = true
 trim_trailing_whitespace = true
 
-[*.{sh,py,pyi,xml,css,hbs,html}]
-indent_size = 4
+binary_next_line = true  # for shfmt
+switch_case_indent = true  # for shfmt
 
 [{*.{js,json,ts},check-openapi}]
-indent_size = 4
 max_line_length = 100
 
 [*.{py,pyi}]
diff --git a/tools/lib/provision.py b/tools/lib/provision.py
index cd8c06918c..e9431be385 100755
--- a/tools/lib/provision.py
+++ b/tools/lib/provision.py
@@ -381,6 +381,8 @@ def main(options: argparse.Namespace) -> "NoReturn":
 
     # Install shellcheck.
     run_as_root(["tools/setup/install-shellcheck"])
+    # Install shfmt.
+    run_as_root(["tools/setup/install-shfmt"])
 
     setup_venvs.main()
 
diff --git a/tools/lint b/tools/lint
index a2fcc86fc9..db14f42454 100755
--- a/tools/lint
+++ b/tools/lint
@@ -75,6 +75,9 @@ def run() -> None:
                                   "(zerver/openapi/zulip.yaml) ")
     linter_config.external_linter('shellcheck', ['shellcheck', '-x', '-P', 'SCRIPTDIR'], ['sh'],
                                   description="Standard shell script linter")
+    linter_config.external_linter('shfmt', ['shfmt'], ['sh'],
+                                  check_arg='-d', fix_arg='-w',
+                                  description="Formats shell scripts")
     command = ['tools/run-mypy', '--quiet']
     if args.force:
         command.append('--force')
diff --git a/tools/setup/install-shfmt b/tools/setup/install-shfmt
new file mode 100755
index 0000000000..e8da0ad67c
--- /dev/null
+++ b/tools/setup/install-shfmt
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -eu
+
+version=3.1.2
+binary="shfmt_v${version}_linux_amd64"
+sha256=c5794c1ac081f0028d60317454fe388068ab5af7740a83e393515170a7157dce
+
+check_version() {
+    out="$(shfmt --version 2>/dev/null)" && [ "$out" = "v$version" ]
+}
+
+if ! check_version; then
+    tmpdir="$(mktemp -d)"
+    trap 'rm -r "$tmpdir"' EXIT
+    cd "$tmpdir"
+    wget -nv "https://github.com/mvdan/sh/releases/download/v3.1.2/$binary"
+    sha256sum -c <<<"$sha256 $binary"
+    chmod +x "$binary"
+    mv "$binary" /usr/local/bin/shfmt
+    check_version
+fi