diff --git a/deploy/auto-deploy.sh b/deploy/auto-deploy.sh
index cfb79a4..c20d1e4 100755
--- a/deploy/auto-deploy.sh
+++ b/deploy/auto-deploy.sh
@@ -95,8 +95,14 @@ rsync "${RSYNC_OPTS[@]}" agent-state/ "$AGENT_STATE_DIR/"
 rsync "${RSYNC_OPTS[@]}" tests/ "$PIPELINE_DIR/tests/"
 [ -f research/research-session.sh ] && rsync "${RSYNC_OPTS[@]}" research/research-session.sh /opt/teleo-eval/research-session.sh
 
-# Safety net: ensure all .sh files are executable after rsync
-find /opt/teleo-eval -maxdepth 3 -name '*.sh' -not -perm -u+x -exec chmod +x {} +
+# Safety net: ensure synced .sh files are executable after rsync.
+# Keep this bounded to deploy-owned paths: /opt/teleo-eval also contains
+# backups and generated state that may be unreadable by the deploy user.
+for dir in "$PIPELINE_DIR" "$TELEGRAM_DIR" "$DIAGNOSTICS_DIR" "$AGENT_STATE_DIR"; do
+  [ -d "$dir" ] || continue
+  find "$dir" -maxdepth 3 -name '*.sh' -not -perm -u+x -exec chmod +x {} +
+done
+[ -f /opt/teleo-eval/research-session.sh ] && chmod u+x /opt/teleo-eval/research-session.sh
 
 log "Files synced"
 
diff --git a/tests/test_teleo_agent_systemd.py b/tests/test_teleo_agent_systemd.py
index d64dd63..64b8c2c 100644
--- a/tests/test_teleo_agent_systemd.py
+++ b/tests/test_teleo_agent_systemd.py
@@ -47,6 +47,14 @@ def test_auto_deploy_prefers_github_remote_when_present():
     assert 'git merge --ff-only "$DEPLOY_REMOTE/main"' in auto_deploy
 
 
+def test_auto_deploy_executable_safety_net_stays_inside_synced_dirs():
+    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()
+
+    assert "for dir in \"$PIPELINE_DIR\" \"$TELEGRAM_DIR\" \"$DIAGNOSTICS_DIR\" \"$AGENT_STATE_DIR\"" in auto_deploy
+    assert "find /opt/teleo-eval -maxdepth 3 -name '*.sh'" not in auto_deploy
+    assert "backups" in auto_deploy
+
+
 def test_agent_healthcheck_timer_runs_both_live_telegram_agents():
     service = (REPO_ROOT / "systemd" / "teleo-agent-healthcheck.service").read_text()
     timer = (REPO_ROOT / "systemd" / "teleo-agent-healthcheck.timer").read_text()