diff --git a/package.json b/package.json
index d3d7cb3..53f0361 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,7 @@
   "scripts": {
     "dev": "tsx src/index.tsx",
     "build": "tsup",
-    "postbuild": "cp scripts/cli-entry.cjs dist/cli.cjs && chmod +x dist/cli.cjs",
+    "postbuild": "node scripts/postbuild.cjs",
     "start": "node dist/index.js",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
diff --git a/scripts/postbuild.cjs b/scripts/postbuild.cjs
new file mode 100644
index 0000000..091341c
--- /dev/null
+++ b/scripts/postbuild.cjs
@@ -0,0 +1,20 @@
+'use strict';
+
+const { chmodSync, copyFileSync } = require('node:fs');
+const { resolve } = require('node:path');
+
+const root = resolve(__dirname, '..');
+const src = resolve(root, 'scripts/cli-entry.cjs');
+const dest = resolve(root, 'dist/cli.cjs');
+
+copyFileSync(src, dest);
+
+// On Windows chmod is effectively a no-op, and npm re-applies bin permissions on install anyway, so a failure
+// here shouldn't fail the build, but warn rather than swallow the error.
+try {
+  chmodSync(dest, 0o755);
+} catch (err) {
+  console.warn('postbuild: could not set executable bit on dist/cli.cjs:', err.message);
+}
+
+console.log('postbuild: wrote dist/cli.cjs');