diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 1805b61..a7ae3f4 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -2,6 +2,29 @@
 
 ---
 
+## V28 2026-03-20 07:26:46
+
+**Fix package repos missing from ISO and harden squashfs test checks**
+
+### Changes:
+- Fixed `src/iso/build-iso-arch.sh`: package repos copied into ISO now get `chmod -R a+rX`
+  to fix restrictive 700 permissions inherited from the build user. Without this, the
+  repos directories existed in the squashfs but were inaccessible to non-root users.
+  - Also refactored the 4 individual `cp -a` commands into a loop with existence check.
+- Fixed `tests/run-tests.sh`: all squashfs file/directory checks now use `sudo test`
+  and `sudo grep` instead of bare `[ -f ... ]` / `[ -d ... ]`. Squashfs mounts preserve
+  original file permissions, so tests running as a non-root user could fail to traverse
+  directories with restrictive permissions even when the files exist.
+
+### Plan deviation/changes:
+- None
+
+### What is missing/needs polish:
+- `qemu.kernel_boots` and `qemu.reaches_userspace` still expected failures — no real
+  kernel built yet (Phase 4 deliverable). ISO uses placeholder BOOTX64.EFI.
+
+---
+
 ## V27 2026-03-20 07:00:00
 
 **Add ISO build, boot chain verification, and fix installer bugs**
diff --git a/src/iso/build-iso-arch.sh b/src/iso/build-iso-arch.sh
index 5b6c6b8..42c533e 100755
--- a/src/iso/build-iso-arch.sh
+++ b/src/iso/build-iso-arch.sh
@@ -184,11 +184,14 @@ else
     warn "dpack binary not found — build it first: cd src/dpack && cargo build --release"
 fi
 
-# Package repos
-cp -a "${PROJECT_ROOT}/src/repos/core" "${ROOTFS}/var/lib/dpack/repos/" 2>/dev/null || true
-cp -a "${PROJECT_ROOT}/src/repos/extra" "${ROOTFS}/var/lib/dpack/repos/" 2>/dev/null || true
-cp -a "${PROJECT_ROOT}/src/repos/desktop" "${ROOTFS}/var/lib/dpack/repos/" 2>/dev/null || true
-cp -a "${PROJECT_ROOT}/src/repos/gaming" "${ROOTFS}/var/lib/dpack/repos/" 2>/dev/null || true
+# Package repos — copy and fix permissions for system paths
+for repo in core extra desktop gaming; do
+    if [ -d "${PROJECT_ROOT}/src/repos/${repo}" ]; then
+        cp -a "${PROJECT_ROOT}/src/repos/${repo}" "${ROOTFS}/var/lib/dpack/repos/" 2>/dev/null || true
+    fi
+done
+# Fix permissions: repo dirs came from build user, but must be world-readable in the ISO
+chmod -R a+rX "${ROOTFS}/var/lib/dpack/repos/" 2>/dev/null || true
 
 # --- Install kernel ----------------------------------------------------------
 KERNEL_PATH=""
diff --git a/tests/run-tests.sh b/tests/run-tests.sh
index 996c436..9d11814 100755
--- a/tests/run-tests.sh
+++ b/tests/run-tests.sh
@@ -789,7 +789,7 @@ if [ "$QUICK_MODE" = false ] && [ "$ISO_PREREQS_OK" = true ]; then
                 "install/configs/zprofile:zprofile for target user in live rootfs"; do
                 fpath="${check_file%%:*}"
                 fdesc="${check_file##*:}"
-                if [ -f "$SQFS_MNT/$fpath" ]; then
+                if sudo test -f "$SQFS_MNT/$fpath"; then
                     record_test "iso.rootfs.${fpath##*/}" "pass"
                 else
                     record_test "iso.rootfs.${fpath##*/}" "fail" "Missing: ${fdesc}"
@@ -797,8 +797,8 @@ if [ "$QUICK_MODE" = false ] && [ "$ISO_PREREQS_OK" = true ]; then
             done
 
             # Check that the zprofile in the ISO has dwl auto-start
-            if [ -f "$SQFS_MNT/install/configs/zprofile" ]; then
-                if grep -q 'exec dwl' "$SQFS_MNT/install/configs/zprofile"; then
+            if sudo test -f "$SQFS_MNT/install/configs/zprofile"; then
+                if sudo grep -q 'exec dwl' "$SQFS_MNT/install/configs/zprofile"; then
                     record_test "iso.rootfs.zprofile_has_dwl" "pass"
                 else
                     record_test "iso.rootfs.zprofile_has_dwl" "fail" "zprofile in ISO missing 'exec dwl'"
@@ -806,14 +806,14 @@ if [ "$QUICK_MODE" = false ] && [ "$ISO_PREREQS_OK" = true ]; then
             fi
 
             # Check that dpack binary is in the ISO
-            if [ -f "$SQFS_MNT/usr/bin/dpack" ]; then
+            if sudo test -f "$SQFS_MNT/usr/bin/dpack"; then
                 record_test "iso.rootfs.dpack_binary" "pass"
             else
                 record_test "iso.rootfs.dpack_binary" "fail" "dpack binary missing from ISO — installer can't use dpack"
             fi
 
-            # Check that package repos are in the ISO
-            if [ -d "$SQFS_MNT/var/lib/dpack/repos/core" ]; then
+            # Check that package repos are in the ISO (use sudo — squashfs may preserve restrictive perms)
+            if sudo test -d "$SQFS_MNT/var/lib/dpack/repos/core"; then
                 record_test "iso.rootfs.repos" "pass"
             else
                 record_test "iso.rootfs.repos" "fail" "Package repos missing from ISO"