diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index e17472611f8..ee2d7e7964f 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -89,6 +89,3 @@
 ./test/images/volume/gluster/run_gluster.sh
 ./test/images/volume/iscsi/create_block.sh
 ./test/images/volume/nfs/run_nfs.sh
-./third_party/intemp/intemp.sh
-./third_party/multiarch/qemu-user-static/register/qemu-binfmt-conf.sh
-./third_party/multiarch/qemu-user-static/register/register.sh
diff --git a/hack/verify-shellcheck.sh b/hack/verify-shellcheck.sh
index bd1483d4441..7b2e4372fce 100755
--- a/hack/verify-shellcheck.sh
+++ b/hack/verify-shellcheck.sh
@@ -66,8 +66,13 @@ remove_container () {
 # ensure we're linting the k8s source tree
 cd "${KUBE_ROOT}"
 
-# find all shell scripts excluding ./_*, ./.git/*, ./vendor*,
-# and anything git-ignored
+# Find all shell scripts excluding:
+# - Anything git-ignored - No need to lint untracked files.
+# - ./_* - No need to lint output directories.
+# - ./.git/* - Ignore anything in the git object store.
+# - ./vendor* - Vendored code should be fixed upstream instead.
+# - ./third_party/*, but re-include ./third_party/forked/*  - only code we
+#    forked should be linted and fixed.
 all_shell_scripts=()
 while IFS=$'\n' read -r script;
   do git check-ignore -q "$script" || all_shell_scripts+=("$script");
@@ -75,7 +80,8 @@ done < <(find . -name "*.sh" \
   -not \( \
     -path ./_\*      -o \
     -path ./.git\*   -o \
-    -path ./vendor\*    \
+    -path ./vendor\* -o \
+    \( -path ./third_party\* -a -not -path ./third_party/forked\* \) \
   \))
 
 # make sure known failures are sorted