diff --git a/deploy/shop.service b/deploy/shop.service
index ec5a56e..8b22228 100644
--- a/deploy/shop.service
+++ b/deploy/shop.service
@@ -9,7 +9,7 @@ User=www-data
 Group=www-data
 WorkingDirectory=/opt/shop
 EnvironmentFile=/opt/shop/.env
-ExecStartPre=+/opt/shop/scripts/wait-postgres.sh
+ExecStartPre=+/bin/bash /opt/shop/scripts/wait-postgres.sh
 ExecStart=/usr/bin/node src/server.js
 Restart=on-failure
 RestartSec=5
diff --git a/scripts/fix-shop-permissions.sh b/scripts/fix-shop-permissions.sh
index 5d973cf..0e46cd8 100644
--- a/scripts/fix-shop-permissions.sh
+++ b/scripts/fix-shop-permissions.sh
@@ -21,8 +21,18 @@ fi
 
 echo "=== Права Shop: $SHOP_ROOT → $SHOP_SERVICE_USER ==="
 
+# CRLF из Windows → 203/EXEC в systemd
+if [ -d "$SHOP_ROOT/scripts" ]; then
+  find "$SHOP_ROOT/scripts" -name '*.sh' -type f -exec sed -i 's/\r$//' {} +
+fi
+
 chown -R "$SHOP_SERVICE_USER:$SHOP_SERVICE_USER" "$SHOP_ROOT"
 
+# Исполняемые скрипты (wait-postgres.sh для ExecStartPre)
+if [ -d "$SHOP_ROOT/scripts" ]; then
+  chmod +x "$SHOP_ROOT"/scripts/*.sh 2>/dev/null || true
+fi
+
 # npm cache/logs для www-data
 for dir in /var/www/.npm /var/www/.cache; do
   mkdir -p "$dir"
@@ -34,4 +44,9 @@ if [ -f "$SHOP_ROOT/.env" ]; then
   chown "$SHOP_SERVICE_USER:$SHOP_SERVICE_USER" "$SHOP_ROOT/.env"
 fi
 
-echo "OK: владелец $SHOP_SERVICE_USER, можно: systemctl restart shop"
+# Родительские каталоги — traverse для www-data
+chmod o+x /opt /opt/shop 2>/dev/null || true
+
+echo "OK: владелец $SHOP_SERVICE_USER, скрипты +x"
+echo "Проверка unit: grep ExecStartPre /etc/systemd/system/shop.service"
+echo "  sudo systemctl daemon-reload && sudo systemctl restart shop"
diff --git a/scripts/install-shop-service.sh b/scripts/install-shop-service.sh
index 63ed520..188991e 100644
--- a/scripts/install-shop-service.sh
+++ b/scripts/install-shop-service.sh
@@ -58,16 +58,12 @@ fi
 
 npm install --omit=dev --prefix "$SHOP_ROOT"
 
-# Доступ www-data: чтение кода и .env (systemd читает .env от root, но на всякий случай)
-chmod o+x /opt /opt/shop 2>/dev/null || true
-chmod -R a+rX "$SHOP_ROOT"
-chmod 640 "$SHOP_ROOT/.env"
-chown root:www-data "$SHOP_ROOT/.env" 2>/dev/null || chmod 644 "$SHOP_ROOT/.env"
+bash "$SCRIPT_DIR/fix-shop-permissions.sh"
 
 cp -f "$SHOP_ROOT/deploy/shop.service" /etc/systemd/system/shop.service
 sed -i "s|WorkingDirectory=.*|WorkingDirectory=${SHOP_ROOT}|" /etc/systemd/system/shop.service
 sed -i "s|EnvironmentFile=.*|EnvironmentFile=${SHOP_ROOT}/.env|" /etc/systemd/system/shop.service
-sed -i "s|ExecStartPre=.*|ExecStartPre=+${SHOP_ROOT}/scripts/wait-postgres.sh|" /etc/systemd/system/shop.service
+sed -i "s|ExecStartPre=.*|ExecStartPre=+/bin/bash ${SHOP_ROOT}/scripts/wait-postgres.sh|" /etc/systemd/system/shop.service
 sed -i "s|ExecStart=.*|ExecStart=${NODE_BIN} src/server.js|" /etc/systemd/system/shop.service
 
 if ! sudo -u www-data test -r "$SHOP_ROOT/package.json"; then
diff --git a/wiki/Troubleshooting.md b/wiki/Troubleshooting.md
index 0980ae2..373c168 100644
--- a/wiki/Troubleshooting.md
+++ b/wiki/Troubleshooting.md
@@ -40,6 +40,7 @@ journalctl -u shop -n 50 --no-pager
 | detached HEAD | `bash scripts/git-sync.sh` |
 | `EACCES` на `package-lock.json`, npm от www-data | `sudo bash scripts/fix-shop-permissions.sh` затем `sudo npm install --omit=dev` и снова `fix-shop-permissions` |
 | `shop.service` failed после обновления | `sudo bash scripts/fix-shop-permissions.sh` && `sudo systemctl restart shop` |
+| `status=203/EXEC` на `wait-postgres.sh` | `chmod +x scripts/*.sh`; `sed -i 's/\r$//' scripts/*.sh`; в unit: `ExecStartPre=+/bin/bash .../wait-postgres.sh`; `sudo bash scripts/install-shop-service.sh` |
 | Нет `scripts/...` | `bash "$SHOP_ROOT/scripts/server-update.sh"` |
 | Unit shop not found | `sudo bash scripts/install-shop-service.sh` |
 | shop exit-code / auto-restart | `sudo bash scripts/free-port-3000.sh`; `systemctl restart shop` |