diff --git a/.chezmoiscripts/run_onchange_after_20-setup-neovim.sh.tmpl b/.chezmoiscripts/run_onchange_after_20-setup-neovim.sh.tmpl
index 9e5d1d6..64668f6 100644
--- a/.chezmoiscripts/run_onchange_after_20-setup-neovim.sh.tmpl
+++ b/.chezmoiscripts/run_onchange_after_20-setup-neovim.sh.tmpl
@@ -38,9 +38,13 @@ exit 1
   exit 1
 }
 
+nvim_bin="$HOME/.local/share/bob/nvim-bin/nvim"
+if [[ -e "$nvim_bin" && ! -w "$nvim_bin" ]]; then
+  chmod u+w "$nvim_bin"
+fi
+
 "$bob_bin" use "$channel"
 
-nvim_bin="$HOME/.local/share/bob/nvim-bin/nvim"
 [[ -x "$nvim_bin" ]] || {
   echo "Bob did not activate Neovim at $nvim_bin" >&2
   exit 1
diff --git a/scripts/check-portability.sh b/scripts/check-portability.sh
index 6cd348e..4063d15 100755
--- a/scripts/check-portability.sh
+++ b/scripts/check-portability.sh
@@ -780,6 +780,7 @@ check_bob_contract() {
   local fedora_hook="$WORK/bob-fedora-hook.sh"
   local installation_surfaces="$WORK/neovim-installation-surfaces"
   local competing_probe="$WORK/competing-neovim-probe.sh"
+  local repair_line use_line
   local competing_pattern='^[[:space:]]*([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]+[[:space:]]+)*(([^[:space:]]*/)?brew|"\$brew")[[:space:]]+install[[:space:]].*neovim|^[[:space:]]*([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]+[[:space:]]+)*(sudo[[:space:]]+)?dnf[[:space:]]+install[[:space:]].*neovim|^[[:space:]]*([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]+[[:space:]]+)*(mise|"\$mise"|"\$mise_bin")[[:space:]]+(install|use)[[:space:]].*neovim'
 
   [[ -f "$PUBLIC_SOURCE/$hook" ]] || fail "missing Bob-managed Neovim hook"
@@ -805,8 +806,13 @@ PY
   grep -Fq 'channel=stable' "$PUBLIC_SOURCE/$hook" || fail "Bob channel is not declared stable"
   grep -Fq 'export BOB_CONFIG="$HOME/.config/bob/config.toml"' "$PUBLIC_SOURCE/$hook" || \
     fail "Bob hook does not use the noninteractive managed config"
+  grep -Fq 'chmod u+w "$nvim_bin"' "$PUBLIC_SOURCE/$hook" || \
+    fail "Bob hook does not repair a legacy read-only Neovim proxy"
   grep -Fq '"$bob_bin" use "$channel"' "$PUBLIC_SOURCE/$hook" || \
     fail "Bob hook does not idempotently install/use its channel"
+  repair_line=$(grep -n 'chmod u+w "$nvim_bin"' "$PUBLIC_SOURCE/$hook" | cut -d: -f1)
+  use_line=$(grep -n '"$bob_bin" use "$channel"' "$PUBLIC_SOURCE/$hook" | cut -d: -f1)
+  (( repair_line < use_line )) || fail "Bob proxy repair must precede channel activation"
   grep -Fq '$HOME/.local/share/bob/nvim-bin/nvim' "$PUBLIC_SOURCE/$hook" || \
     fail "Bob hook does not verify the managed Neovim path"
   grep -Fq '"$nvim_bin" --clean --headless '\''+qa'\''' "$PUBLIC_SOURCE/$hook" || \