diff --git a/.drone/drone.jsonnet b/.drone/drone.jsonnet
index 773a015bbf5f..65884bdbd229 100644
--- a/.drone/drone.jsonnet
+++ b/.drone/drone.jsonnet
@@ -279,6 +279,11 @@ local manifest(apps) = pipeline('manifest') {
       make('lint', container=false) { depends_on: ['clone'] },
       make('check-generated-files', container=false) { depends_on: ['clone'] },
       make('check-mod', container=false) { depends_on: ['clone', 'test', 'lint'] },
+      {
+        name: 'shellcheck',
+        image: 'koalaman/shellcheck-alpine:stable',
+        commands: ['apk add make bash && make lint-scripts'],
+      },
     ],
   },
 ] + [
diff --git a/.drone/drone.yml b/.drone/drone.yml
index 0b480fe27399..920ecc1d8d3d 100644
--- a/.drone/drone.yml
+++ b/.drone/drone.yml
@@ -971,4 +971,8 @@ get:
   path: infra/data/ci/loki/deploy
   name: config.json
 
+---
+kind: signature
+hmac: b9ca51f266b7895bd1ea53ca40721d65915472fde3dc25fb662968282bc8acd5
+
 ...
diff --git a/Makefile b/Makefile
index e3aae976a73a..0cddb1721c87 100644
--- a/Makefile
+++ b/Makefile
@@ -564,12 +564,15 @@ ifeq ($(BUILD_IN_CONTAINER),true)
 	@mkdir -p $(shell pwd)/.pkg
 	@mkdir -p $(shell pwd)/.cache
 	$(SUDO) docker run $(RM) $(TTY) -i \
+		-e DRONE_SERVER -e DRONE_TOKEN \
 		-v $(shell pwd)/.cache:/go/cache$(MOUNT_FLAGS) \
 		-v $(shell pwd)/.pkg:/go/pkg$(MOUNT_FLAGS) \
 		-v $(shell pwd):/src/loki$(MOUNT_FLAGS) \
 		$(IMAGE_PREFIX)/loki-build-image:$(BUILD_IMAGE_VERSION) $@;
 else
 	drone jsonnet --stream --format -V __build-image-version=$(BUILD_IMAGE_VERSION) --source .drone/drone.jsonnet --target .drone/drone.yml
+	drone lint .drone/drone.yml
+	drone sign --save grafana/loki .drone/drone.yml
 endif