diff --git a/packaging/assemble.mjs b/packaging/assemble.mjs
index 7462d33..852b41a 100644
--- a/packaging/assemble.mjs
+++ b/packaging/assemble.mjs
@@ -37,6 +37,7 @@ async function copyBinary(source, destination, executable = true) {
   await mkdir(resolve(destination, ".."), { recursive: true });
   await cp(source, destination);
   if (executable && !destination.endsWith(".exe")) await chmod(destination, 0o755);
+  if (!executable) await chmod(destination, 0o644);
 }
 
 async function validateBinaries(directory) {
diff --git a/packaging/assemble.test.mjs b/packaging/assemble.test.mjs
index 4ecbec1..f588f9e 100644
--- a/packaging/assemble.test.mjs
+++ b/packaging/assemble.test.mjs
@@ -1,6 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { assemble, isPackageVersion } from "./assemble.mjs";
@@ -84,6 +84,8 @@ test("assembles one public npm package and six matching npm and Python runtimes"
     assert.doesNotMatch(rustManifest, /registry\s*=/);
     assert.match(await readFile(join(rustRoot, "README.md"), "utf8"), /installed automatically by `yieldskill`/);
     assert.match(await readFile(join(rustRoot, "LICENSE"), "utf8"), /MIT License/);
+    const rustRuntime = target.goos === "windows" ? "yskill.exe" : "yskill";
+    assert.equal((await stat(join(rustRoot, "runtime", rustRuntime))).mode & 0o111, 0);
   }
 
   const rustMain = join(output, "rust/yieldskill");