diff --git a/roles/linroom/handlers/main.yml b/roles/linroom/handlers/main.yml
new file mode 100644
index 0000000..70c210e
--- /dev/null
+++ b/roles/linroom/handlers/main.yml
@@ -0,0 +1,4 @@
+# Mark everything in bin/ directories executable. Some extensions do
+# this on activation, but non-root users don’t have permission for it.
+- name: fix VS code extensions
+  command: find /usr/share/code/resources/app -name bin -exec chmod -R +x '{}' ';'
diff --git a/roles/linroom/tasks/vscode.yml b/roles/linroom/tasks/vscode.yml
index da2c551..214204d 100644
--- a/roles/linroom/tasks/vscode.yml
+++ b/roles/linroom/tasks/vscode.yml
@@ -1,21 +1,19 @@
-- name: Add VS repository
-  block:
-    - name: VS repo - apt key
-      ansible.builtin.get_url:
-        url: https://packages.microsoft.com/keys/microsoft.asc
-        dest: /etc/apt/trusted.gpg.d/microsoft_key.asc
-    - name: VS repo - url
-      ansible.builtin.apt_repository:
-        repo: "deb https://packages.microsoft.com/repos/vscode stable main"
-        state: present
+- name: Add VS repo key
+  apt_key:
+    url: https://packages.microsoft.com/keys/microsoft.asc
+    keyring: /etc/apt/trusted.gpg.d/microsoft.gpg
+
+- name: Add VS repo url
+  apt_repository:
+    repo: "deb https://packages.microsoft.com/repos/vscode stable main"
 
 - name: Install VSCode
-  ansible.builtin.apt:
+  apt:
     name: code
     state: latest
 
 - name: Install VS Code extensions
-  shell: code --no-sandbox --user-data-dir "/usr/share/code/resources/app" --extensions-dir "/usr/share/code/resources/app/extensions" --install-extension "{{ item }}"
+  command: code --no-sandbox --user-data-dir "/usr/share/code/resources/app" --extensions-dir "/usr/share/code/resources/app/extensions" --install-extension "{{ item }}"
   loop:
   - VisualStudioExptTeam.vscodeintellicode
   - arthurwang.vsc-prolog
@@ -33,3 +31,4 @@
   - marus25.cortex-debug # RA-63703
   - NateAGeek.memory-viewer # RA-63703
   - ms-vscode.cpptools-extension-pack # RA-63703
+  notify: fix VS code extensions