diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 81dd58c..2267ed1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
           # tests on main-as-is (verified via a no-op canary PR) — CI was
           # testing a dependency set production never runs. Bump these pins
           # together with a production upgrade, not before.
-          pip install pytest fastmcp httpx requests pynput 'pydantic==2.11.10' ruff \
+          pip install pytest fastmcp httpx requests pynput 'pydantic==2.11.10' 'ruff>=0.15.22,<0.16' \
                       'fastapi==0.129.0' 'starlette==0.52.1' numpy pyotp 'qrcode[pil]'
       - name: Lint (ruff) — F-4 gate, config in ruff.toml
         run: ruff check .
diff --git a/codec.py b/codec.py
old mode 100644
new mode 100755
diff --git a/codec_dictate.py b/codec_dictate.py
old mode 100644
new mode 100755
diff --git a/codec_marketplace.py b/codec_marketplace.py
old mode 100644
new mode 100755
diff --git a/codec_watchdog.py b/codec_watchdog.py
old mode 100644
new mode 100755
diff --git a/codec_watcher.py b/codec_watcher.py
old mode 100644
new mode 100755
diff --git a/request_mic.py b/request_mic.py
old mode 100644
new mode 100755
diff --git a/requirements-dev.txt b/requirements-dev.txt
index f0f6c9f..b8385ec 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -12,4 +12,8 @@
 
 # Test + lint toolchain (matches CI)
 pytest>=9.1.1
-ruff>=0.15.22
+# Upper bound is deliberate: ruff 0.16 changed the default rule selection AND
+# stopped honouring this repo's ruff.toml in CI — `ruff check .` went from clean
+# to 3117 errors (E402 fired 535 times despite being in our ignore list), with
+# no code change. Unpinning again needs a real 0.16 migration, not a drift.
+ruff>=0.15.22,<0.16
diff --git a/scripts/feature_audit.py b/scripts/feature_audit.py
old mode 100644
new mode 100755
diff --git a/scripts/smoke.py b/scripts/smoke.py
old mode 100644
new mode 100755
diff --git a/scripts/stress_test_skills.py b/scripts/stress_test_skills.py
old mode 100644
new mode 100755
diff --git a/scripts/tag_releases.py b/scripts/tag_releases.py
old mode 100644
new mode 100755
diff --git a/setup_codec.py b/setup_codec.py
old mode 100644
new mode 100755
diff --git a/setup_hue.py b/setup_hue.py
old mode 100644
new mode 100755
diff --git a/tests/smoke_test.py b/tests/smoke_test.py
old mode 100644
new mode 100755
diff --git a/tools/generate_skill_manifest.py b/tools/generate_skill_manifest.py
old mode 100644
new mode 100755
diff --git a/tools/overlay_preview.py b/tools/overlay_preview.py
old mode 100644
new mode 100755
diff --git a/whisper_server.py b/whisper_server.py
old mode 100644
new mode 100755