diff --git a/.github/scripts/check-script-modes.sh b/.github/scripts/check-script-modes.sh
new file mode 100755
index 0000000..8b4b41a
--- /dev/null
+++ b/.github/scripts/check-script-modes.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+# Fails when a script in .github/scripts is not committed as executable.
+# Workflows run these scripts directly. A script committed as 100644 only fails
+# when a workflow reaches it, with exit 126 ("Permission denied"). For Release,
+# that is after the merge.
+set -eu
+
+files=$(git ls-files -s .github/scripts)
+status=0
+while read -r mode _ _ path; do
+  [ -n "$path" ] || continue
+  [ "$mode" = 100755 ] && continue
+  printf '::error file=%s::%s has mode %s. Run: git update-index --chmod=+x %s\n' \
+    "$path" "$path" "$mode" "$path"
+  status=1
+done <<LIST
+$files
+LIST
+exit "$status"
diff --git a/.github/scripts/drop-failed-release.sh b/.github/scripts/drop-failed-release.sh
old mode 100644
new mode 100755
diff --git a/.github/scripts/release-preflight.sh b/.github/scripts/release-preflight.sh
old mode 100644
new mode 100755
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index afcc58e..2a9256d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,6 +24,11 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
+      # Workflows run .github/scripts/* directly, so each one must be executable.
+      - if: matrix.pack
+        name: Check workflow scripts are executable
+        run: .github/scripts/check-script-modes.sh
+
       - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4