diff --git a/docs/agents/binary-distribution.md b/docs/agents/binary-distribution.md
index c521def..6a7f025 100644
--- a/docs/agents/binary-distribution.md
+++ b/docs/agents/binary-distribution.md
@@ -62,8 +62,10 @@ vp check
 | 矩阵变更未通知脚本方   | 装错 arch / 永久失败      |
 | webhook 配错当发版失败 | 不应；webhook 失败只 warn |
 | 用 `Bun.build({ compile })` 代替 CLI | Bun ≤1.2.19 可能 exit 0 但不写 outfile → `sha256` ENOENT |
+| 编译后未 `chmod` windows `.exe` | Bun 1.2.19 在 Unix 上写出 mode `000` → `sha256` / upload `EACCES` |
 
 ## 编译实现注意
 
 - `binary-compile.mjs` 必须走 **`bun build --compile --outfile …`**，不要用 `Bun.build({ compile })`（CI 钉 `1.2.19` 时 API 会假成功）。
 - 编译后校验 outfile 存在再算 SHA256。
+- 每个产物在哈希前 `chmod 0755`（规避 Bun 1.2.19 windows cross-compile 无权限，见 oven-sh/bun#21308）。
diff --git a/tools/release/lib/binary-build.mjs b/tools/release/lib/binary-build.mjs
index d076aca..030b118 100644
--- a/tools/release/lib/binary-build.mjs
+++ b/tools/release/lib/binary-build.mjs
@@ -10,7 +10,7 @@
  *   --mode channel → writes <channel>.json only (does not touch latest.json)
  */
 import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
@@ -154,6 +154,9 @@ function compileOne({ bunTarget, os, arch, exe }, version, outdir, entry) {
   }
   if (result.stdout) process.stdout.write(result.stdout);
   if (result.stderr) process.stderr.write(result.stderr);
+  // Bun 1.2.19 writes windows-x64 .exe with mode 000 on Unix hosts (oven-sh/bun#21308).
+  // chmod so sha256 / gh upload can open the file; harmless for other targets.
+  chmodSync(outfile, 0o755);
   return { fileName, outfile, os, arch, sha256: sha256File(outfile) };
 }