diff --git a/scripts/ci/materialize_base_python_requirements.py b/scripts/ci/materialize_base_python_requirements.py
index 98cdad459..dfe9ad436 100755
--- a/scripts/ci/materialize_base_python_requirements.py
+++ b/scripts/ci/materialize_base_python_requirements.py
@@ -165,6 +165,26 @@ def _git(repo_root: pathlib.Path, *args: str) -> bytes:
     return completed.stdout
 
 
+def _verify_trusted_uv_origin(url: str) -> None:
+    """Verify the final response URL remains within the trusted HTTPS origin."""
+    final_url = urllib.parse.urlparse(url)
+    try:
+        final_port = final_url.port
+    except ValueError as exc:
+        raise RuntimeError(
+            "trusted uv archive redirected outside the fixed "
+            "releases.astral.sh HTTPS origin"
+        ) from exc
+    if (
+        (final_url.scheme, final_url.hostname)
+        != ("https", "releases.astral.sh")
+        or final_port not in (None, 443)
+    ):
+        raise RuntimeError(
+            "trusted uv archive redirected outside the fixed "
+            "releases.astral.sh HTTPS origin"
+        )
+
 def _download_trusted_uv_archive() -> bytes:
     """Download the fixed uv release archive through one HTTPS trust boundary."""
     _install_trusted_uv_url_opener()
@@ -177,23 +197,7 @@ def _download_trusted_uv_archive() -> bytes:
             "uv-x86_64-unknown-linux-gnu.tar.gz",
             timeout=TRUSTED_UV_DOWNLOAD_TIMEOUT_SECONDS,
         ) as response:
-            final_url = urllib.parse.urlparse(response.geturl())
-            try:
-                final_port = final_url.port
-            except ValueError as exc:
-                raise RuntimeError(
-                    "trusted uv archive redirected outside the fixed "
-                    "releases.astral.sh HTTPS origin"
-                ) from exc
-            if (
-                (final_url.scheme, final_url.hostname)
-                != ("https", "releases.astral.sh")
-                or final_port not in (None, 443)
-            ):
-                raise RuntimeError(
-                    "trusted uv archive redirected outside the fixed "
-                    "releases.astral.sh HTTPS origin"
-                )
+            _verify_trusted_uv_origin(response.geturl())
             payload = bytearray()
             while len(payload) <= TRUSTED_UV_DOWNLOAD_MAX_BYTES:
                 chunk = response.read(
diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh
index 7343c06ac..9446fa048 100755
--- a/scripts/ci/test_strix_quick_gate.sh
+++ b/scripts/ci/test_strix_quick_gate.sh
@@ -5118,7 +5118,7 @@ EOS
 		;;
 esac
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 
 	cat >"$fake_gh" <<'EOF'
 #!/usr/bin/env bash
@@ -6337,7 +6337,7 @@ else
 fi
 echo "scan ok with PR head content"
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -6460,7 +6460,7 @@ vertex_ai/fallback-one)
 	;;
 esac
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'vertex_ai/stale-source-primary' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -6581,7 +6581,7 @@ if [ -e "$context_file" ]; then
 fi
 echo "scan ok with bounded PR head backend context"
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -6719,7 +6719,7 @@ fi
 echo "Error: unexpected changed context scan attempt $attempt" >&2
 exit 71
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -6924,7 +6924,7 @@ fi
 
 echo "scan ok with non-email backend scope"
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -7150,7 +7150,7 @@ fi
 
 echo "scan ok with frontend email trusted backend authorization context"
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -7239,7 +7239,7 @@ set -euo pipefail
 echo "scan ok"
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -7390,7 +7390,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
 echo "Error: Strix should not run after a PR-head blob failure" >&2
 exit 64
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -7480,7 +7480,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
 echo "Error: Strix should not run after invalid pull request SHA metadata" >&2
 exit 67
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -7573,7 +7573,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
 echo "Error: Strix should not run after an irregular PR-head entry" >&2
 exit 66
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -7654,7 +7654,7 @@ set -euo pipefail
 printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
 exit 66
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -7758,7 +7758,7 @@ if [ -e "$target_path/vendor/newsdom-api" ]; then
 fi
 echo "scan ok with PR head content"
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -7853,7 +7853,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
 echo "Error: Strix should not run for unsafe changed paths" >&2
 exit 65
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'gemini/test-model' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 	cat >"$event_payload_file" <<'EOF'
@@ -7945,7 +7945,7 @@ child_pid=$!
 printf '%s' "$child_pid" > "${FAKE_STRIX_CHILD_PID_FILE:?}"
 sleep "${FAKE_STRIX_TIMEOUT_SLEEP_SECONDS:?}"
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'vertex_ai/timeout-cleanup-primary' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -8024,7 +8024,7 @@ printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
 echo "vertex scan ok without external LLM_API_BASE"
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'vertex_ai/gemini-2.5-pro' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 	printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
@@ -8077,7 +8077,7 @@ set -euo pipefail
 echo "1" >> "${FAKE_STRIX_CALL_COUNT_FILE:?}"
 sleep 30
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'vertex_ai/total-timeout-primary' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -8148,7 +8148,7 @@ set -euo pipefail
 echo "1" >> "${STRIX_CALL_COUNT_FILE:?}"
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	if [ -n "$strix_llm" ]; then
 		printf '%s' "$strix_llm" >"$strix_llm_file"
 	fi
@@ -8197,7 +8197,7 @@ set -euo pipefail
 echo "1" >> "${STRIX_CALL_COUNT_FILE:?}"
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf 'openai-direct/gpt-5.4 $(touch %s)' "$marker_file" >"$strix_llm_file"
 	printf '%s' 'dummy-key' >"$llm_api_key_file"
 
@@ -8252,7 +8252,7 @@ if [ "${LLM_API_KEY_FILE+x}" = "x" ]; then
 fi
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' "vertex_ai/ready-primary" >"$strix_llm_file"
 
 	set +e
@@ -8302,7 +8302,7 @@ if [ "${LLM_API_KEY_FILE+x}" = "x" ]; then
 fi
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' "vertex_ai/ready-primary" >"$strix_llm_file"
 	printf '%s' "openai-key-should-not-reach-vertex" >"$llm_api_key_file"
 
@@ -8345,7 +8345,7 @@ set -euo pipefail
 echo "unexpected strix execution" >&2
 exit 99
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'vertex_ai/ready-primary' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 
@@ -8398,7 +8398,7 @@ set -euo pipefail
 printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 	printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
@@ -8455,7 +8455,7 @@ set -euo pipefail
 printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 	printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
@@ -8514,7 +8514,7 @@ set -euo pipefail
 printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 	printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
@@ -8584,7 +8584,7 @@ set -euo pipefail
 printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 	printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
@@ -8643,7 +8643,7 @@ set -euo pipefail
 echo "Error: transport timeout"
 exit 1
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 	printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
@@ -8699,7 +8699,7 @@ set -euo pipefail
 echo "Error: transport timeout"
 exit 1
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 	printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
@@ -8749,7 +8749,7 @@ set -euo pipefail
 printf '%s\n' called >>"${FAKE_STRIX_CALL_LOG:?}"
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 	printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
@@ -8802,7 +8802,7 @@ run_absolute_outside_target_path_case() {
 printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
 exit 0
 EOF
-	chmod +x "$fake_strix"
+	chmod 0755 "$fake_strix"
 	printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
 	printf '%s' 'dummy' >"$llm_api_key_file"
 	printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"