diff --git a/ci.Dockerfile b/ci.Dockerfile
index 9e7c097..605d76f 100644
--- a/ci.Dockerfile
+++ b/ci.Dockerfile
@@ -21,8 +21,8 @@ RUN set -eux; \
     tar -C /usr/local/bin -xzf /usr/local/bin/actionlint; \
     rm -f /usr/local/bin/actionlint
 
-# yamllint via pip
-RUN pip3 install --no-cache-dir yamllint==1.35.1
+# yamllint via pip (allow install on Debian's externally-managed Python)
+RUN pip3 install --break-system-packages --no-cache-dir yamllint==1.35.1
 
 # Node + npm for prettier, markdownlint, commitlint
 RUN set -eux; \
@@ -38,4 +38,3 @@ RUN npm --location=global install \
 WORKDIR /workspace
 ENTRYPOINT ["bash","-lc"]
 CMD ["bash"]
-
diff --git a/scripts/ci b/scripts/ci
old mode 100644
new mode 100755
diff --git a/scripts/commitlint-hook b/scripts/commitlint-hook
old mode 100644
new mode 100755
diff --git a/scripts/setup-hooks b/scripts/setup-hooks
old mode 100644
new mode 100755