diff --git a/crates/engine/src/automate_cmds.rs b/crates/engine/src/automate_cmds.rs
index 2256a76cda..800ff954e0 100644
--- a/crates/engine/src/automate_cmds.rs
+++ b/crates/engine/src/automate_cmds.rs
@@ -358,7 +358,9 @@ fn write_shim(droplet: &str) -> Result<String> {
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;
-        let _ = std::fs::set_permissions(&shim, std::fs::Permissions::from_mode(0o755));
+        // The shim only has to run as the user who created it; 0o755 would also let every other
+        // local account read and execute it.
+        let _ = std::fs::set_permissions(&shim, std::fs::Permissions::from_mode(0o700));
     }
     Ok(shim)
 }
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index d7ab90b2e9..223d0cfa8e 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -2367,7 +2367,8 @@ mod tests {
 
     #[test]
     fn arrow_keys_on_a_field_with_a_reversed_range_do_not_panic() {
-        let mut h = focused(5.0, 10.0..=0.0);
+        // The empty range is the case under test — arrow keys must not panic on it.
+        let mut h = focused(5.0, 10.0..=0.0); // NOSONAR
         let _ = press(&mut h, Modifiers::NONE, Key::ArrowUp);
         let mut h = focused(5.0, f32::NAN..=10.0);
         let _ = press(&mut h, Modifiers::NONE, Key::ArrowDown);