diff --git a/panda/SConscript b/panda/SConscript
index 408080198f..2aa077158d 100644
--- a/panda/SConscript
+++ b/panda/SConscript
@@ -121,7 +121,9 @@ def build_project(project_name, project, main, extra_flags):
     "./board/crypto/sha.c",
     "./board/bootstub.c",
   ])
-  bs_env.Objcopy(f"./board/obj/bootstub.{project_name}.bin", bs_elf)
+  bs_bin = bs_env.Objcopy(f"./board/obj/bootstub.{project_name}.bin", bs_elf)
+  # Bootstubs are data images; objcopy must not inherit the ELF executable mode.
+  bs_env.AddPostAction(bs_bin, Chmod("$TARGET", 0o644))
 
   # Build + sign main (aka app)
   main_elf = env.Program(f"{project_dir}/main.elf", [
diff --git a/prebuilt.json b/prebuilt.json
index 02ffd5ea1e..3b950925e0 100644
--- a/prebuilt.json
+++ b/prebuilt.json
@@ -1 +1 @@
-{"protected_inventory_sha256": "9607cce41ddb63ad2b675c814ab30f35221db575ea8dfa5cffb1ccad06774efb", "schema_version": 1}
+{"protected_inventory_sha256": "3f3d31e4154b23c5b9591d61b3cf9799c485a830cfd6ab9ddd33a7a5028a4c0d", "schema_version": 1}