diff --git a/.changeset/cli-prepack-chmod.md b/.changeset/cli-prepack-chmod.md
new file mode 100644
index 0000000..04caebe
--- /dev/null
+++ b/.changeset/cli-prepack-chmod.md
@@ -0,0 +1,11 @@
+---
+"tokenometer": patch
+"@tokenometer/core": patch
+---
+
+Fix CLI bin missing execute bit when published from CI. Root `npm run
+build` runs `tsc -b` without recursing into workspace scripts, so the
+chmod added in the CLI's build script never ran in CI. Added a `prepack`
+hook in `packages/cli/package.json` that chmods `dist/index.js` right
+before `npm publish` packs the tarball — runs regardless of how the
+build was invoked.
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 29f2d9b..969cf9e 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -76,6 +76,7 @@
   },
   "scripts": {
     "build": "tsc -b && chmod +x dist/index.js",
+    "prepack": "chmod +x dist/index.js",
     "clean": "rm -rf dist"
   },
   "dependencies": {