diff --git a/modules/users/s6-rc.nix b/modules/users/s6-rc.nix
index f7bd01e7..4f50cf57 100644
--- a/modules/users/s6-rc.nix
+++ b/modules/users/s6-rc.nix
@@ -8,7 +8,12 @@ let
       (pkgs.writeTextFile {
         name = "s6-${name}-run";
         destination = "/${normalizeName name}/run";
-        text = run;
+        executable = true;
+        # text = run;
+        text = ''
+          #!/bin/sh
+          ${run}
+        '';
       })
     ]
   else
@@ -80,6 +85,9 @@ let
   # s6-svscan scandir &
   # s6-rc-init -c $compiled -l $PWD/live -d $PWD/scandir
   # s6-rc -l $PWD/live start svc-a
+  #
+  # N.B.: it seems the $compiled dir needs to be rw, for s6 to write lock files within it.
+  #       so `cp` and `chmod -R 600` it, first.
   compileServices = sources: with pkgs; stdenv.mkDerivation {
     name = "s6-user-services";
     src = sources;