diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d73538a..0f2e5c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,6 +57,7 @@ jobs:
         working-directory: api/src
         run: |
           gcc -O2 -static -Wall -Wextra -Werror -o /tmp/spec-guard spec-guard.c
+          chmod 0555 /tmp/spec-guard
           # Smoke: spec-guard must execvp its argument cleanly. Use a
           # parent process with a known FD population so we also assert
           # the close-inherited-FDs path runs (child must see only the
diff --git a/api/Dockerfile b/api/Dockerfile
index ff4e848..04599e3 100644
--- a/api/Dockerfile
+++ b/api/Dockerfile
@@ -29,8 +29,9 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \
 RUN make -j$(nproc)
 
 COPY api/src/spec-guard.c /tmp/spec-guard.c
+# KVM/nsjail execution may need read permission on virtiofs-backed rootfs.
 RUN gcc -O2 -static -o /usr/local/bin/spec-guard /tmp/spec-guard.c \
-    && chmod 0111 /usr/local/bin/spec-guard
+    && chmod 0555 /usr/local/bin/spec-guard
 
 # ============================================================================
 # Stage 1b: Build language runtime packages (only consumed by sandbox-runner-baked)
diff --git a/docker/Dockerfile.worker-sandbox b/docker/Dockerfile.worker-sandbox
index 5e0c97d..db95fd5 100644
--- a/docker/Dockerfile.worker-sandbox
+++ b/docker/Dockerfile.worker-sandbox
@@ -42,8 +42,9 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \
 RUN make -j$(nproc)
 
 COPY api/src/spec-guard.c /tmp/spec-guard.c
+# KVM/nsjail execution may need read permission on virtiofs-backed rootfs.
 RUN gcc -O2 -static -o /usr/local/bin/spec-guard /tmp/spec-guard.c \
-    && chmod 0111 /usr/local/bin/spec-guard
+    && chmod 0555 /usr/local/bin/spec-guard
 
 # ============================================================================
 # Stage 2: Build worker
diff --git a/launcher/Dockerfile b/launcher/Dockerfile
index 0d252c2..c04b98c 100644
--- a/launcher/Dockerfile
+++ b/launcher/Dockerfile
@@ -33,8 +33,9 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \
 RUN make -j$(nproc)
 
 COPY api/src/spec-guard.c /tmp/spec-guard.c
+# KVM/nsjail execution may need read permission on virtiofs-backed rootfs.
 RUN gcc -O2 -static -o /usr/local/bin/spec-guard /tmp/spec-guard.c \
-    && chmod 0111 /usr/local/bin/spec-guard
+    && chmod 0555 /usr/local/bin/spec-guard
 
 FROM oven/bun:1.3.14-debian AS sandbox-build