diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..6cecf3c
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,13 @@
+# Force LF line endings on files that get executed on Linux. Without this,
+# Windows checkouts commit CRLF and shell shebangs break on the Pi
+# ("/usr/bin/env bash\r" → command not found).
+*.sh             text eol=lf
+*.bash           text eol=lf
+*.service        text eol=lf
+*.script         text eol=lf
+*.plymouth       text eol=lf
+Dockerfile*      text eol=lf
+*.conf           text eol=lf
+*.yaml           text eol=lf
+*.yml            text eol=lf
+deploy/pam.d/*   text eol=lf
diff --git a/deploy/scripts/setup-pi-kiosk.sh b/deploy/scripts/setup-pi-kiosk.sh
old mode 100644
new mode 100755