diff --git a/installation/CHANGELOG.md b/installation/CHANGELOG.md
index d05742996..a6143926c 100644
--- a/installation/CHANGELOG.md
+++ b/installation/CHANGELOG.md
@@ -18,6 +18,12 @@
   (`installerplan/components.tsv`, `tui/main.go`, `backend/lib/deploy.sh`).
 
 ### Fixed
+- **ISO installs finish the sign-in screen setup again.** mkarchiso copies the
+  baked payload without file modes, so the greeter helper that 1.0.6 added
+  (`sddm-host/install-greeter-theme`) reached the target as 0644 and every ISO
+  install stopped at the configure stage with "Permission denied". The
+  backend now restores its executable bit after copying the qylock bundle, as
+  it already does for the two installers it stages (`backend/lib/deploy.sh`).
 - **Fresh installs receive newer Ryoku package overrides.** After the Arch or
   CachyOS desktop transaction, the installer aligns every installed package
   that `[ryoku]` serves at a newer version. Both offline ISO repositories
diff --git a/installation/backend/lib/deploy.sh b/installation/backend/lib/deploy.sh
index f3492cf50..7ab5be234 100755
--- a/installation/backend/lib/deploy.sh
+++ b/installation/backend/lib/deploy.sh
@@ -516,10 +516,13 @@ ryoku_deploy_qylock() {
   log "deploying qylock bundle + SDDM clockwork theme"
   deploy_dir "$RYOKU_REPO/ryoku/lockscreen/qylock" /mnt/usr/share/ryoku/qylock
 
-  # stage the two installers in the chroot, run, drop.
+  # stage the two installers in the chroot, run, drop. mkarchiso copies the
+  # payload with --no-preserve=mode, so every script the bundle executes
+  # directly needs its bit back here.
   run cp "$RYOKU_REPO/ryoku/lockscreen/sddm/setup" /mnt/root/ryoku-sddm-setup
   run cp "$RYOKU_REPO/ryoku/lockscreen/install-qylock" /mnt/root/ryoku-install-qylock
-  run chmod 755 /mnt/root/ryoku-sddm-setup /mnt/root/ryoku-install-qylock
+  run chmod 755 /mnt/root/ryoku-sddm-setup /mnt/root/ryoku-install-qylock \
+    /mnt/usr/share/ryoku/qylock/sddm-host/install-greeter-theme
   local env="RYOKU_QYLOCK_BUNDLE=/usr/share/ryoku/qylock RYOKU_QYLOCK_MODE=live SUDO_USER=$RYOKU_USERNAME RYOKU_DRYRUN=${RYOKU_DRYRUN:-}"
   # shellcheck disable=SC2086  # env assignments are intentionally word-split
   run "$RYOKU_TARGET_CHROOT" /mnt env $env /root/ryoku-sddm-setup