diff --git a/deploy/README.md b/deploy/README.md
index d2d6a6a..e2e822d 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -57,6 +57,9 @@ Notes:
 - Third arg is Vite base path for production assets.
 - For `https://bestmidi.com/chgrid/`, use `/chgrid/`.
 - For site root deploy (`https://bestmidi.com/`), use `/`.
+- Deploy script normalizes publish permissions to avoid shared-host PHP soft exceptions:
+  - directories `755`
+  - files `644`
 
 Shortcut (client deploy + service restart):
 
diff --git a/deploy/scripts/deploy_client.sh b/deploy/scripts/deploy_client.sh
index 519ce54..730aed1 100755
--- a/deploy/scripts/deploy_client.sh
+++ b/deploy/scripts/deploy_client.sh
@@ -28,5 +28,11 @@ if [[ -d "$PHP_PROXY_DIR" ]]; then
   rsync -a "$PHP_PROXY_DIR/" "$PUBLISH_DIR/"
 fi
 
+# Normalize publish permissions for restrictive shared-host PHP handlers.
+# - Directories must be executable/traversable.
+# - PHP/static files must not be group-writable.
+find "$PUBLISH_DIR" -type d -exec chmod 755 {} +
+find "$PUBLISH_DIR" -type f -exec chmod 644 {} +
+
 echo "client deploy complete: $PUBLISH_DIR"
 echo "client base path: $BASE_PATH"