diff --git a/desktop-client/scripts/build-tunnel-helper.sh b/desktop-client/scripts/build-tunnel-helper.sh
index ad36fa1..14fb9a2 100644
--- a/desktop-client/scripts/build-tunnel-helper.sh
+++ b/desktop-client/scripts/build-tunnel-helper.sh
@@ -70,12 +70,13 @@ if ! rustup target list --installed | grep -qx "${TARGET}"; then
 fi
 
 mkdir -p "${OUTPUT_DIR}"
+rm -f "${OUTPUT_DIR}/${OUTPUT_NAME}"
 if [ "${HOST_OS}" = "Linux" ] && [ "${TARGET}" = "x86_64-pc-windows-msvc" ]; then
   cargo xwin build --manifest-path "${HELPER_DIR}/Cargo.toml" --release --target "${TARGET}" --xwin-arch x86_64
 else
   cargo build --manifest-path "${HELPER_DIR}/Cargo.toml" --release --target "${TARGET}"
 fi
-cp "${HELPER_DIR}/target/${TARGET}/release/${OUTPUT_NAME}" "${OUTPUT_DIR}/${OUTPUT_NAME}"
+install -m 755 "${HELPER_DIR}/target/${TARGET}/release/${OUTPUT_NAME}" "${OUTPUT_DIR}/${OUTPUT_NAME}"
 
 if [ "${TARGET}" = "aarch64-apple-darwin" ]; then
   WG_BIN="$(command -v wg || true)"
@@ -88,9 +89,10 @@ if [ "${TARGET}" = "aarch64-apple-darwin" ]; then
     exit 1
   fi
 
-  cp -L "${WG_BIN}" "${OUTPUT_DIR}/wg"
-  cp -L "${WG_QUICK_BIN}" "${OUTPUT_DIR}/wg-quick"
-  chmod +x "${OUTPUT_DIR}/wg" "${OUTPUT_DIR}/wg-quick"
+  rm -f "${OUTPUT_DIR}/wg" "${OUTPUT_DIR}/wg-quick"
+  install -m 755 "$(realpath "${WG_BIN}")" "${OUTPUT_DIR}/wg"
+  install -m 755 "$(realpath "${WG_QUICK_BIN}")" "${OUTPUT_DIR}/wg-quick"
+  chmod -R u+rwX,go+rX "${OUTPUT_DIR}"
 fi
 
 echo "Bundled ${OUTPUT_NAME} into ${OUTPUT_DIR}"