diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ca25f908e2..a8948eed9a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,7 +47,7 @@ jobs:
             extra: [nogui]
           - features: tiny
             compiler: gcc
-            extra: [nogui]
+            extra: [nogui, syn_test_execs]
           - features: tiny
             compiler: gcc
             extra: [nogui]
@@ -106,6 +106,13 @@ jobs:
           # exit with an error code and list the missing entries.
           make -C ci -f hlgroups.make
 
+      - name: Report executable syntax tests
+        if: contains(matrix.extra, 'syn_test_execs')
+        run: |
+          # Search and list all found executable syntax tests, and exit with
+          # an error code.
+          make -C runtime/syntax executables
+
       - run: sudo dpkg --add-architecture i386
         if: matrix.architecture == 'i386'
 
diff --git a/runtime/syntax/Makefile b/runtime/syntax/Makefile
index 9392b8dc98..d0f71270ac 100644
--- a/runtime/syntax/Makefile
+++ b/runtime/syntax/Makefile
@@ -27,7 +27,7 @@ RUN_VIMTEST = VIMRUNTIME=$(VIMRUNTIME) $(VALGRIND) $(ENVVARS) ../$(VIMPROG) -f $
 # DEBUGLOG = --log testlog
 
 # All initial phony targets; these names may clash with file types.
-phonies = clean test testclean
+phonies = clean executables test testclean
 .PHONY: $(phonies)
 
 # Run the tests that didn't run yet or failed previously.
@@ -53,6 +53,9 @@ testdir/testdeps.mk:
 
 -include testdir/testdeps.mk
 
+executables:
+	@! find testdir/input -type f -perm /a+x -exec echo Executable syntax test found: \{\} \; | grep :
+
 clean testclean:
 	rm -f testdir/failed/* testdir/done/* testdir/vimcmd testdir/messages testdir/Xtestscript testdir/Xfilter testdir/testdeps.mk
 
diff --git a/runtime/syntax/testdir/README.txt b/runtime/syntax/testdir/README.txt
index e4f3945c8f..bd3730435f 100644
--- a/runtime/syntax/testdir/README.txt
+++ b/runtime/syntax/testdir/README.txt
@@ -146,6 +146,9 @@ is covered by the test.  You can follow these steps:
 	- Vim setup file:   syntax/testdir/input/setup/{name}.vim (if any)
 	- test input file:  syntax/testdir/input/{name}.{ext}
 	- test dump files:  syntax/testdir/dumps/{name}_*.dump
+   Since no input file is ever executed when you run the tests, review and
+   revoke each previously granted permission to execute such a file before
+   publishing it; e.g. "chmod -x input/java.java; git add input/java.java".
 
 As an extra check you can temporarily put back the old syntax plugin and
 verify that the tests fail.  Then you know your changes are covered by the
diff --git a/runtime/syntax/testdir/input/sh_mksh_gibberish.ksh b/runtime/syntax/testdir/input/sh_mksh_gibberish.ksh
old mode 100755
new mode 100644