diff --git a/apps/cistech-tunnel/shared/entrypoint.sh b/apps/cistech-tunnel/shared/entrypoint.sh
index c560f94..afec20c 100644
--- a/apps/cistech-tunnel/shared/entrypoint.sh
+++ b/apps/cistech-tunnel/shared/entrypoint.sh
@@ -13,6 +13,9 @@ export MESA_GL_VERSION_OVERRIDE=3.3
 export QTWEBENGINE_CHROMIUM_FLAGS="--no-sandbox --disable-gpu --use-gl=swiftshader"
 export QTWEBENGINE_DISABLE_SANDBOX=1
 
+# Ensure all shared scripts are executable (permissions may reset after git pull/appstore update)
+chmod +x /shared/*.sh /shared/openconnect-vpn /root/.vnc/xstartup 2>/dev/null || true
+
 # Setup TigerVNC password file from env var (passed by runtipi)
 if [ -n "${VNC_PASSWORD:-}" ]; then
     mkdir -p /root/.vnc