diff --git a/image/BUILD.bazel b/image/BUILD.bazel
index 681c6f385c..772801b0c7 100644
--- a/image/BUILD.bazel
+++ b/image/BUILD.bazel
@@ -1,16 +1,12 @@
 load("@aspect_bazel_lib//lib:copy_file.bzl", "copy_file")
 load("@rules_pkg//:pkg.bzl", "pkg_tar")
-load("@rules_pkg//pkg:mappings.bzl", "pkg_files", "strip_prefix")
-
-filegroup(
-    name = "sysroot_tree",
-    srcs = glob(["sysroot-tree/**"]),
-)
+load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_files", "strip_prefix")
 
 pkg_files(
     name = "sysroot",
-    srcs = [":sysroot_tree"],
-    strip_prefix = strip_prefix.from_pkg() + "sysroot-tree",
+    srcs = glob(["sysroot-tree/**"]),
+    attributes = pkg_attributes(mode = "0555"),
+    strip_prefix = strip_prefix.from_pkg("sysroot-tree"),
     visibility = ["//visibility:public"],
 )
 
diff --git a/image/base/BUILD.bazel b/image/base/BUILD.bazel
index 2928787f16..9e613d4fdd 100644
--- a/image/base/BUILD.bazel
+++ b/image/base/BUILD.bazel
@@ -1,5 +1,6 @@
 load("@aspect_bazel_lib//lib:copy_to_directory.bzl", "copy_to_directory")
 load("@rules_pkg//:pkg.bzl", "pkg_tar")
+load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_files", "strip_prefix")
 load("//bazel/mkosi:mkosi_image.bzl", "mkosi_image")
 
 copy_to_directory(
@@ -33,9 +34,7 @@ copy_to_directory(
             "mkosi.finalize",
             "mkosi.postinst",
             "mkosi.prepare",
-        ] + glob([
-            "mkosi.skeleton/**",
-        ]),
+        ],
         outs = [
             kernel_variant,
             kernel_variant + ".tar",
@@ -46,6 +45,7 @@ copy_to_directory(
             kernel_variant + "-rpmdb.sqlite-wal",
         ],
         extra_trees = [
+            ":skeleton",
             "//image:sysroot_tar",
             "//image:cryptsetup_closure",
         ],
@@ -86,3 +86,15 @@ pkg_tar(
     tags = ["manual"],
     visibility = ["//visibility:public"],
 )
+
+pkg_files(
+    name = "skeleton_files",
+    srcs = glob(["mkosi.skeleton/**"]),
+    attributes = pkg_attributes(mode = "0555"),
+    strip_prefix = strip_prefix.from_pkg("mkosi.skeleton"),
+)
+
+pkg_tar(
+    name = "skeleton",
+    srcs = [":skeleton_files"],
+)
diff --git a/image/initrd/BUILD.bazel b/image/initrd/BUILD.bazel
index 6301d6cb52..a959018eca 100644
--- a/image/initrd/BUILD.bazel
+++ b/image/initrd/BUILD.bazel
@@ -1,17 +1,18 @@
+load("@rules_pkg//:pkg.bzl", "pkg_tar")
+load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_files", "strip_prefix")
 load("//bazel/mkosi:mkosi_image.bzl", "mkosi_image")
 
 mkosi_image(
     name = "initrd",
     srcs = [
         "mkosi.postinst",
-    ] + glob([
-        "mkosi.skeleton/**",
-    ]),
+    ],
     outs = [
         "image",
         "image.cpio.zst",
     ],
     extra_trees = [
+        ":skeleton",
         "//image:sysroot_tar",
         "//image:cryptsetup_closure",
         "//disk-mapper/cmd:disk-mapper-package.tar",
@@ -24,3 +25,15 @@ mkosi_image(
     ],
     visibility = ["//visibility:public"],
 )
+
+pkg_files(
+    name = "skeleton_files",
+    srcs = glob(["mkosi.skeleton/**"]),
+    attributes = pkg_attributes(mode = "0555"),
+    strip_prefix = strip_prefix.from_pkg("mkosi.skeleton"),
+)
+
+pkg_tar(
+    name = "skeleton",
+    srcs = [":skeleton_files"],
+)