diff --git a/Dockerfile b/Dockerfile
index f7f937a..c6c5368 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -41,8 +41,10 @@ RUN curl -sSL "https://github.com/livekit/livekit/releases/download/${LIVEKIT_VE
 # Copy Python agent + venv from build stage
 COPY --from=build /app/agent/.venv /opt/voice-agent/.venv
 COPY agent/agent.py /opt/voice-agent/agent.py
-COPY --chmod=644 agent/hermes_llm.py /opt/voice-agent/hermes_llm.py
-COPY --chmod=644 agent/healthcheck.py /opt/voice-agent/healthcheck.py
+# Keep COPY compatible with the Unraid runner's legacy Docker builder.
+# The RUN chmod below sets these non-secret application files to mode 644.
+COPY agent/hermes_llm.py /opt/voice-agent/hermes_llm.py
+COPY agent/healthcheck.py /opt/voice-agent/healthcheck.py
 
 # Copy the voice frontend + token endpoint. Hope Music is a separate service.
 # Source files created by automation may be private on the build host; packaged