diff --git a/CHANGELOG.md b/CHANGELOG.md
index b84e29892..dc8b99dcc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ We use [semantic versioning](http://semver.org/):
 - [breaking] _agent_: Log lines now show the simple class name (`INFO Agent - ...`) instead of the fully qualified one.
 - [breaking] _agent_: In testwise coverage mode, the test result is now mandatory in the body of `/test/end` requests. Requests without a result (or without a body at all) are rejected with "400 Bad Request" instead of silently producing a report entry without a result. The duration remains optional: if it is omitted, the profiler derives it from the time between the `/test/start` and `/test/end` requests. The profiler additionally logs a warning if no `/test/start` request was received, since the duration cannot be derived reliably in that case.
 - [breaking] _tia-client_: Removed the `ITestwiseCoverageAgentApi.testFinished(testUniformPath)` overload, which sent a `/test/end` request without a body. Since the agent now rejects such requests, use `testFinished(testUniformPath, testExecution)` instead.
+- [fix] _agent_: The files in `teamscale-jacoco-agent.zip` are packaged with their executable flag again. Since version 36.0.0 `installer.sh` and the binaries of the bundled installer runtime were extracted without it, so installing the profiler on Linux required a `chmod +x` first.
 - [fix] _agent_: A test whose result the profiler does not know is now reported as `INCONCLUSIVE` instead of `SKIPPED`. This affects tests that are ended implicitly because the next `/test/start` arrived before their `/test/end`, or because the test run ended while the tests were still running.
 - [fix] _agent_: Requests to the profiler's REST API that are rejected as invalid (e.g. a `/test/start` without a test name or an empty `PUT /partition` body) now respond with the appropriate HTTP status code, e.g. "400 Bad Request".
 
diff --git a/agent/build.gradle.kts b/agent/build.gradle.kts
index 3cf24b7db..c1334a8d9 100644
--- a/agent/build.gradle.kts
+++ b/agent/build.gradle.kts
@@ -134,6 +134,7 @@ verifyShadowedLoggingConfigs(tasks.shadowJar, tasks.shadowDistZip)
 
 tasks.shadowDistZip {
 	archiveFileName = "teamscale-jacoco-agent.zip"
+	useFileSystemPermissions()
 }
 
 oci {