diff --git a/desktop-client/src-tauri/src/tunnel_manager.rs b/desktop-client/src-tauri/src/tunnel_manager.rs
index 5f768b3..3672cc5 100644
--- a/desktop-client/src-tauri/src/tunnel_manager.rs
+++ b/desktop-client/src-tauri/src/tunnel_manager.rs
@@ -3,6 +3,9 @@ use std::{
     process::Command,
 };
 
+#[cfg(unix)]
+use std::{fs, os::unix::fs::PermissionsExt};
+
 use serde::{Deserialize, Serialize};
 use tauri::{AppHandle, Manager};
 
@@ -123,6 +126,19 @@ fn bundled_backend(app: &AppHandle) -> Result<PathBuf, String> {
         return Err("Embedded NexaVPN tunnel backend is not bundled in this build yet.".into());
     }
 
+    #[cfg(unix)]
+    {
+        let meta = fs::metadata(&path)
+            .map_err(|err| format!("Unable to read tunnel backend metadata: {}", err))?;
+        let mut perms = meta.permissions();
+        let mode = perms.mode();
+        if mode & 0o111 == 0 {
+            perms.set_mode(mode | 0o755);
+            fs::set_permissions(&path, perms)
+                .map_err(|err| format!("Unable to set tunnel backend executable bit: {}", err))?;
+        }
+    }
+
     Ok(path)
 }