diff --git a/deploy/auto-deploy.sh b/deploy/auto-deploy.sh
index 9b07c60..d0f531a 100755
--- a/deploy/auto-deploy.sh
+++ b/deploy/auto-deploy.sh
@@ -78,6 +78,9 @@ rsync $RSYNC_FLAGS diagnostics/ "$DIAGNOSTICS_DIR/"
 rsync $RSYNC_FLAGS agent-state/ "$AGENT_STATE_DIR/"
 [ -f research/research-session.sh ] && rsync $RSYNC_FLAGS research/research-session.sh /opt/teleo-eval/research-session.sh
 
+# Safety net: ensure all .sh files are executable after rsync
+find /opt/teleo-eval -maxdepth 3 -name '*.sh' -not -perm -u+x -exec chmod +x {} +
+
 log "Files synced"
 
 # Restart services only if Python files changed