diff --git a/deploy/compose/nex-speech/piper/Dockerfile b/deploy/compose/nex-speech/piper/Dockerfile
index aa6868a..ee35150 100644
--- a/deploy/compose/nex-speech/piper/Dockerfile
+++ b/deploy/compose/nex-speech/piper/Dockerfile
@@ -4,9 +4,9 @@ FROM python:3.12-slim-bookworm@sha256:34386ef0cb081344d7ec1c103ba398e6e9f64e9ab3
 RUN apt-get update \
  && apt-get install -y --no-install-recommends ffmpeg \
  && rm -rf /var/lib/apt/lists/*
-COPY requirements.txt /app/requirements.txt
+COPY --chmod=0644 requirements.txt /app/requirements.txt
 RUN pip install --no-cache-dir --disable-pip-version-check -r /app/requirements.txt
-COPY app.py /app/app.py
+COPY --chmod=0644 app.py /app/app.py
 ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
 USER nobody
 WORKDIR /app
diff --git a/deploy/compose/nex-speech/whisper/Dockerfile b/deploy/compose/nex-speech/whisper/Dockerfile
index 7cdd419..c6b7eca 100644
--- a/deploy/compose/nex-speech/whisper/Dockerfile
+++ b/deploy/compose/nex-speech/whisper/Dockerfile
@@ -33,7 +33,6 @@ RUN apt-get update \
 COPY --from=build /src/build/bin/whisper-server /usr/local/bin/whisper-server
 # ffmpeg-Hülle: whisper-server ruft "ffmpeg … 2>&1" auf und schriebe sonst Banner und
 # Container-Metadaten des Uploads ins Log. Die Hülle liegt vor /usr/bin im PATH.
-COPY ffmpeg-quiet.sh /usr/local/bin/ffmpeg
-COPY entrypoint.sh /usr/local/bin/entrypoint.sh
-RUN chmod 0755 /usr/local/bin/ffmpeg /usr/local/bin/entrypoint.sh
+COPY --chmod=0755 ffmpeg-quiet.sh /usr/local/bin/ffmpeg
+COPY --chmod=0755 entrypoint.sh /usr/local/bin/entrypoint.sh
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
diff --git a/platform/proxmox/ansible/roles/nex-speech/tasks/main.yml b/platform/proxmox/ansible/roles/nex-speech/tasks/main.yml
index af81870..aa7afa7 100644
--- a/platform/proxmox/ansible/roles/nex-speech/tasks/main.yml
+++ b/platform/proxmox/ansible/roles/nex-speech/tasks/main.yml
@@ -66,7 +66,7 @@
   ansible.builtin.copy:
     src: "{{ playbook_dir }}/../../../../deploy/compose/nex-speech/"
     dest: "{{ nex_speech_dir }}/"
-    mode: preserve
+    mode: u=rwX,g=rX,o=rX   # Clone auf ops ist 0600; der Piper-Container läuft als nobody
     directory_mode: "0755"
   register: nex_speech_files