diff --git a/desktop/packaging/appimage/debundle-graphics.sh b/desktop/packaging/appimage/debundle-graphics.sh
index 84fc657..73e45c8 100755
--- a/desktop/packaging/appimage/debundle-graphics.sh
+++ b/desktop/packaging/appimage/debundle-graphics.sh
@@ -109,6 +109,11 @@ chmod +x "$APPIMAGETOOL"
 
 echo "==> Repackaging AppImage (overwriting original)"
 rm -f "$APPIMAGE"
+# appimagetool refuses a tree it can't be sure everyone can read and run: the
+# AppImage runs as whichever user launches it, and extraction keeps the build's
+# restrictive modes.
+chmod -R a+rX "$WORK/squashfs-root"
+chmod a+rx "$WORK/squashfs-root/AppRun"
 # APPIMAGE_EXTRACT_AND_RUN lets appimagetool (itself an AppImage) run without
 # FUSE in the CI container; ARCH is required by the embedded runtime.
 export APPIMAGE_EXTRACT_AND_RUN=1