diff --git a/BUILD.bazel b/BUILD.bazel
index 6b18eba..97b5986 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -26,6 +26,11 @@ pkg_tar(
         ":configs/linux/logind.conf": "/etc/systemd/logind.conf.d/bb_clientd.conf",
         ":configs/linux/systemd.service": "/usr/lib/systemd/user/bb_clientd.service",
     },
+    mode = "444",
+    modes = {
+        "/usr/bin/bb_clientd": "555",
+        "/usr/lib/bb_clientd/launch_bb_clientd_linux.sh": "555",
+    },
 )
 
 # When built with --stamp, creates a non-deterministic output file for pushing images to a remote registry.