diff --git a/Cargo.lock b/Cargo.lock
index 90f14402..b77e924a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2348,7 +2348,7 @@ dependencies = [
 
 [[package]]
 name = "localdesktop"
-version = "3.1.0"
+version = "3.1.1"
 dependencies = [
  "android-sdkmanager-rs",
  "android_logger",
diff --git a/Cargo.toml b/Cargo.toml
index 61847e32..3c4a40f3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "localdesktop"
-version = "3.1.0"
+version = "3.1.1"
 edition = "2021"
 build = "build.rs"
 default-run = "build_apk"
diff --git a/assets/libs/arm64-v8a/libproot.so b/assets/libs/arm64-v8a/libproot.so
index aab2aa37..3e312469 100755
Binary files a/assets/libs/arm64-v8a/libproot.so and b/assets/libs/arm64-v8a/libproot.so differ
diff --git a/patches/build-proot-android/README.md b/patches/build-proot-android/README.md
index 1a274f6d..145f4979 100644
--- a/patches/build-proot-android/README.md
+++ b/patches/build-proot-android/README.md
@@ -25,4 +25,12 @@ One of them is in `src/syscall/seccomp.c`: the seccomp filter traps only the
 instead of every `ioctl`, so GPU drivers in the guest (Turnip on KGSL) don't
 stop at the tracer on each command submission.
 
+Another is in `src/extension/fake_id0/chmod.c`: `chmod` on a file outside the
+guest rootfs is still dropped, except on the app's own files (a directory bound
+into the guest, such as `/home`), so a script or binary written there can be
+made executable.
+
+The shipped `libproot.so` is built with `./build.sh` (NDK r26d). On macOS, put a
+GNU `install` (or a wrapper that handles `install -D`) first in `PATH`.
+
 See https://github.com/green-green-avk/proot for more info.
diff --git a/patches/build-proot-android/build/proot/src/extension/fake_id0/chmod.c b/patches/build-proot-android/build/proot/src/extension/fake_id0/chmod.c
index e1accbc5..e1d5c358 100644
--- a/patches/build-proot-android/build/proot/src/extension/fake_id0/chmod.c
+++ b/patches/build-proot-android/build/proot/src/extension/fake_id0/chmod.c
@@ -1,4 +1,6 @@
 #include <errno.h>
+#include <sys/stat.h>
+#include <unistd.h>
 #include <linux/limits.h>
 
 #include "syscall/sysnum.h"
@@ -28,8 +30,13 @@ int handle_chmod_enter_end(Tracee *tracee, Reg path_sysarg, Reg mode_sysarg,
 		status = read_sysarg_path(tracee, path, path_sysarg, CURRENT);
 	if(status < 0)
 		return status;
-	// If the file exists outside the guestfs, drop the syscall.
+	// If the file exists outside the guestfs, drop the syscall, unless it is
+	// the app's own (a directory bound into the guest, such as /home): then
+	// let the real chmod through, or an executable written there never runs.
 	else if(status == 1) {
+		struct stat host;
+		if(stat(path, &host) == 0 && host.st_uid == getuid())
+			return 0;
 		set_sysnum(tracee, PR_getuid);
 		return 0;
 	}