diff --git a/gh_setup_and_patches/setup_repo.sh b/gh_setup_and_patches/setup_repo.sh
index 14b19d0..c39806e 100755
--- a/gh_setup_and_patches/setup_repo.sh
+++ b/gh_setup_and_patches/setup_repo.sh
@@ -186,7 +186,9 @@ setup_branch_protection() {
   # These MUST match the check names you see in PR -> Checks.
   # If you change workflow/job names, update this list.
   local -a contexts=()
-  mapfile -t contexts < <(load_required_contexts)
+  while IFS= read -r line; do
+    contexts+=("${line}")
+  done < <(load_required_contexts)
 
   # JSON array for contexts
   local contexts_json
diff --git a/tools/cad_runtime.py b/tools/cad_runtime.py
index 3f16e75..a88b195 100644
--- a/tools/cad_runtime.py
+++ b/tools/cad_runtime.py
@@ -28,7 +28,7 @@ def ensure_cad_home() -> Path:
 def create_runtime_temp_dir(prefix: str) -> Path:
     ensure_cad_home()
     path = Path(tempfile.mkdtemp(prefix=f"{prefix}-", dir=CAD_HOME))
-    os.chmod(path, 0o777)
+    os.chmod(path, 0o700)
     return path