diff --git a/.github/workflows/zulip-ci.yml b/.github/workflows/zulip-ci.yml
index a9014a38ec..478752e549 100644
--- a/.github/workflows/zulip-ci.yml
+++ b/.github/workflows/zulip-ci.yml
@@ -150,6 +150,7 @@ jobs:
           ./tools/test-migrations
           ./tools/setup/optimize-svg --check
           ./tools/setup/generate_integration_bots_avatars.py --check-missing
+          ./tools/ci/check-executables
 
           # Ban check-database-compatibility.py from transitively
           # relying on static/generated, because it might not be
diff --git a/static/images/integrations/logos/jotform.svg b/static/images/integrations/logos/jotform.svg
old mode 100755
new mode 100644
diff --git a/static/images/store-badges/app-store-badge.svg b/static/images/store-badges/app-store-badge.svg
old mode 100755
new mode 100644
diff --git a/templates/zerver/help/include/sidebar_index.md b/templates/zerver/help/include/sidebar_index.md
old mode 100755
new mode 100644
diff --git a/templates/zerver/help/open-the-compose-box.md b/templates/zerver/help/open-the-compose-box.md
old mode 100755
new mode 100644
diff --git a/tools/ci/check-executables b/tools/ci/check-executables
new file mode 100755
index 0000000000..1bb274982d
--- /dev/null
+++ b/tools/ci/check-executables
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+files="$(git ls-tree -r @ | sed -n 's/^100755 blob \S\+\t//p' | xargs -r grep -Lz '^#!' --)" || [ $? = 123 ]
+if [ "$files" ]; then
+    echo 'error: non-scripts should not be marked executable (fix with chmod -x):'
+    echo
+    printf '%s\n' "$files"
+    exit 1
+fi
diff --git a/tools/documentation_crawler/documentation_crawler/spiders/check_documentation.py b/tools/documentation_crawler/documentation_crawler/spiders/check_documentation.py
old mode 100755
new mode 100644
diff --git a/tools/droplets/cleanup.py b/tools/droplets/cleanup.py
old mode 100755
new mode 100644
diff --git a/zerver/data_import/slack.py b/zerver/data_import/slack.py
old mode 100755
new mode 100644
diff --git a/zerver/lib/mdiff.py b/zerver/lib/mdiff.py
old mode 100755
new mode 100644
diff --git a/zerver/views/development/email_log.py b/zerver/views/development/email_log.py
old mode 100755
new mode 100644
diff --git a/zerver/webhooks/github/fixtures/team__edited_description.json b/zerver/webhooks/github/fixtures/team__edited_description.json
old mode 100755
new mode 100644
diff --git a/zerver/webhooks/github/fixtures/team__edited_name.json b/zerver/webhooks/github/fixtures/team__edited_name.json
old mode 100755
new mode 100644
diff --git a/zerver/webhooks/github/fixtures/team__edited_privacy_closed.json b/zerver/webhooks/github/fixtures/team__edited_privacy_closed.json
old mode 100755
new mode 100644
diff --git a/zerver/webhooks/github/fixtures/team__edited_privacy_secret.json b/zerver/webhooks/github/fixtures/team__edited_privacy_secret.json
old mode 100755
new mode 100644
diff --git a/zerver/webhooks/sentry/fixtures/event_for_exception_js.json b/zerver/webhooks/sentry/fixtures/event_for_exception_js.json
old mode 100755
new mode 100644