diff --git a/remount-fuse.sh b/remount-fuse.sh
index 42fc080..462d552 100644
--- a/remount-fuse.sh
+++ b/remount-fuse.sh
@@ -38,14 +38,16 @@ PY
 [ ! -L "$install_dir/config.yaml" ] || die 'config.yaml must not be a symlink'
 for protected in "$install_dir/.env" "$install_dir/config.yaml"; do
   [ "$(stat -c '%u' "$protected")" -eq 0 ] || die "protected file must be owned by root: $protected"
-  [ $(( $(stat -c '%a' "$protected") & 022 )) -eq 0 ] || die "protected file must not be group/world writable: $protected"
+  protected_mode=$(stat -c '%a' "$protected")
+  [ $(( 0$protected_mode & 022 )) -eq 0 ] || die "protected file must not be group/world writable: $protected"
 done
 state_dir=$install_dir/state
 if [ -e "$state_dir" ] && [ -L "$state_dir" ]; then die 'state directory must not be a symlink'; fi
 if [ ! -e "$state_dir" ]; then umask 077; mkdir "$state_dir" || die 'cannot create state directory'; fi
 [ -d "$state_dir" ] || die 'state path must be a directory'
 [ "$(stat -c '%u' "$state_dir")" -eq 0 ] || die 'state directory must be owned by root'
-[ $(( $(stat -c '%a' "$state_dir") & 022 )) -eq 0 ] || die 'state directory must not be group/world writable'
+state_mode=$(stat -c '%a' "$state_dir")
+[ $(( 0$state_mode & 022 )) -eq 0 ] || die 'state directory must not be group/world writable'
 [ -e /dev/fuse ] && [ -c /dev/fuse ] || die '/dev/fuse character device is required'
 command -v docker >/dev/null 2>&1 || die 'docker is required'
 docker compose version >/dev/null 2>&1 || die 'Docker Compose V2 is required'