diff --git a/Makefile.cbm b/Makefile.cbm
index 56bd9237..d4211671 100644
--- a/Makefile.cbm
+++ b/Makefile.cbm
@@ -699,7 +699,7 @@ BUILD_DIR = build/c
 # Integration-asset hash header (variables defined next to PROJECT_HDRS; the
 # rule lives here because target lines expand $(BUILD_DIR) immediately).
 $(INTEGRATIONS_HASH_HDR): $(INTEGRATIONS_ASSET) scripts/gen-integrations-hash.sh | $(BUILD_DIR)
-	scripts/gen-integrations-hash.sh $(INTEGRATIONS_ASSET) $@
+	sh scripts/gen-integrations-hash.sh $(INTEGRATIONS_ASSET) $@
 
 # ── Object file compilation (grammars need relaxed warnings) ─────
 
diff --git a/scripts/gen-integrations-hash.sh b/scripts/gen-integrations-hash.sh
old mode 100644
new mode 100755
diff --git a/scripts/license-policy.json b/scripts/license-policy.json
index a4430c18..a8490d6e 100644
--- a/scripts/license-policy.json
+++ b/scripts/license-policy.json
@@ -16,13 +16,14 @@
     "LicenseRef-scancode-public-domain",
     "LicenseRef-scancode-public-domain-disclaimer"
   ],
-  "_ignored_paths_comment": "Path prefixes (relative to the staged scan tree) excluded from the gate. Use ONLY for documented false positives. Justifications: the license tooling itself (gate scripts + this policy file) necessarily names prohibited licenses; gen-third-party-notices.sh echoes license terminology; audit-license-provenance.py names licenses in its verdict maps; src/discover/discover.c contains a license-FILENAME classification list (LICENSE-MIT, LICENSE-APACHE, ...) for file discovery, which ScanCode reads as license references.",
+  "_ignored_paths_comment": "Path prefixes (relative to the staged scan tree) excluded from the gate. Use ONLY for documented false positives. Justifications: the license tooling itself (gate scripts + this policy file) necessarily names prohibited licenses; gen-third-party-notices.sh echoes license terminology; audit-license-provenance.py names licenses in its verdict maps; src/discover/discover.c contains a license-FILENAME classification list (LICENSE-MIT, LICENSE-APACHE, ...) for file discovery, which ScanCode reads as license references; package-release.sh lists the archive members 'cbm-integrations.json LICENSE ...' adjacently (an order the Windows single-binary contract locks), and ScanCode reads the '.json LICENSE' token adjacency as a reference to the SPDX 'JSON' license — a first-party MIT build script, not vendored code.",
   "ignored_paths": [
     "tree/scripts/license-policy.json",
     "tree/scripts/license-gate-check.py",
     "tree/scripts/license-gate.sh",
     "tree/scripts/gen-third-party-notices.sh",
     "tree/src/discover/discover.c",
-    "tree/scripts/audit-license-provenance.py"
+    "tree/scripts/audit-license-provenance.py",
+    "tree/scripts/package-release.sh"
   ]
 }