diff --git a/.github/workflows/bake-rootfs.yml b/.github/workflows/bake-rootfs.yml
index c99c8163..1cd98c41 100644
--- a/.github/workflows/bake-rootfs.yml
+++ b/.github/workflows/bake-rootfs.yml
@@ -40,7 +40,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Ensure AWS CLI is available
         run: aws --version || { sudo apt-get update && sudo apt-get install -y awscli; }
@@ -98,14 +98,14 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Ensure AWS CLI is available
         run: aws --version || { sudo apt-get update && sudo apt-get install -y awscli; }
 
       - name: Build all tiers for ${{ matrix.arch }}
         run: |
-          sudo ./tools/rootfs-builder/build-iiab-rootfs.sh \
+          sudo bash ./tools/rootfs-builder/build-iiab-rootfs.sh \
             --all-tier --arch "${{ matrix.arch }}" \
             --publish-url "$ROOTFS_PUBLIC_BASE" --reset-mirrors
           # the builder runs as root; hand dist/ back to the runner so the upload step can read it
diff --git a/tools/rootfs-builder/build-iiab-rootfs.sh b/tools/rootfs-builder/build-iiab-rootfs.sh
old mode 100644
new mode 100755