diff --git a/hw/dixie/analysis.nix b/hw/dixie/analysis.nix
index 3af15f9..e158998 100644
--- a/hw/dixie/analysis.nix
+++ b/hw/dixie/analysis.nix
@@ -102,10 +102,11 @@ in
       "d /srv/cold/dropsonde2 0755 dropsonde dropsonde"
       "d /srv/analysis/dropsonde2 0755 dropsonde dropsonde"
       # rsync created these trees 0700 (dropsonde-only) before --chmod was
-      # added; Z relabels mode+ownership recursively at activation to fix
-      # the existing dirs and files.
-      "Z /srv/cold/dropsonde2 0755 dropsonde dropsonde - -"
-      "Z /srv/analysis/dropsonde2 0755 dropsonde dropsonde - -"
+      # added; Z relabels mode+ownership recursively at activation. ~0755
+      # masks the mode against existing bits: dirs become 0755, files stay
+      # 0644 (exec dropped since none were set).
+      "Z /srv/cold/dropsonde2 ~0755 dropsonde dropsonde - -"
+      "Z /srv/analysis/dropsonde2 ~0755 dropsonde dropsonde - -"
     ];
 
     # --- analysis.slice: bounded, best-effort, below llama-server -------------