diff --git a/build.sh b/build.sh
index bb77a0a..02e9a5f 100755
--- a/build.sh
+++ b/build.sh
@@ -35,6 +35,9 @@ cat <<- EOF > mkosi.conf.d/00-outputdirectory.conf
 OutputDirectory=${PWD}
 EOF
 
+# Make sure permissions are sound
+./permission-fix.py
+
 mkosi \
     --distribution arch \
     --image-id "$NAME" \
diff --git a/permission-fix.py b/permission-fix.py
new file mode 100755
index 0000000..9eabbdd
--- /dev/null
+++ b/permission-fix.py
@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+
+# SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only OR LicenseRef-KDE-Accepted-GPL
+# SPDX-FileCopyrightText: 2024 Harald Sitter <sitter@kde.org>
+
+import glob
+import os
+
+# Something in gitlab causes bogus permissions to be set, reset them to something sane.
+
+files = glob.glob('mkosi.*/**/*', recursive=True, include_hidden=True)
+for file in files:
+    if os.path.islink(file):
+        continue
+
+    if os.access(file, os.X_OK):
+        os.chmod(file, 0o755)
+    else:
+        os.chmod(file, 0o644)