diff --git a/docs/configuring-playbook-synology.md b/docs/configuring-playbook-synology.md
index 9a3d2e33a..969831c2b 100644
--- a/docs/configuring-playbook-synology.md
+++ b/docs/configuring-playbook-synology.md
@@ -43,15 +43,15 @@ You must set a password for this account via `matrix_synology_user_password` in
 
 Synology DSM has two boot-time quirks that the boot-fix service addresses automatically:
 
-**1. `/volume1` shared mount propagation**
+1. **`/volume1` shared mount propagation**
 
-Docker requires `/volume1` to be mounted as shared (`mount --make-shared /volume1`) for container bind mounts with `bind-propagation=slave` to work correctly (used by matrix-synapse for its media store). On Synology, this cannot be inserted into the systemd chain before Container Manager starts — doing so causes Container Manager to detect a broken dependency and prompt for repair on every boot. The playbook applies this during setup, and the boot-fix service re-applies it on every subsequent reboot, safely outside Container Manager's dependency chain.
+    Docker requires `/volume1` to be mounted as shared (`mount --make-shared /volume1`) for container bind mounts with `bind-propagation=slave` to work correctly (used by matrix-synapse for its media store). On Synology, this cannot be inserted into the systemd chain before Container Manager starts — doing so causes Container Manager to detect a broken dependency and prompt for repair on every boot. The playbook applies this during setup, and the boot-fix service re-applies it on every subsequent reboot, safely outside Container Manager's dependency chain.
 
-**2. Skipped services at boot**
+2. **Skipped services at boot**
 
-Synology's systemd drops services with multi-level dependency chains from the boot activation queue (e.g. `matrix-traefik → matrix-container-socket-proxy → docker`). These services show as `inactive` or `failed` after reboot even though they are enabled. The boot-fix service scans for any enabled `matrix-*.service` in either state and starts them automatically.
+    Synology's systemd drops services with multi-level dependency chains from the boot activation queue (e.g. `matrix-traefik → matrix-container-socket-proxy → docker`). These services show as `inactive` or `failed` after reboot even though they are enabled. The boot-fix service scans for any enabled `matrix-*.service` in either state and starts them automatically.
 
-> **If you previously configured a Task Scheduler entry** (`Control Panel > Task Scheduler`) to run `mount --make-shared /volume1` at boot-up, you can remove it — the boot-fix service now handles this.
+    > **If you previously configured a Task Scheduler entry** (`Control Panel > Task Scheduler`) to run `mount --make-shared /volume1` at boot-up, you can remove it — the boot-fix service now handles this.
 
 ## Synology GUI Preparation
 
diff --git a/roles/custom/matrix-base/tasks/setup_synology_prerequisites.yml b/roles/custom/matrix-base/tasks/setup_synology_prerequisites.yml
index 6d473fc2a..8332fed29 100644
--- a/roles/custom/matrix-base/tasks/setup_synology_prerequisites.yml
+++ b/roles/custom/matrix-base/tasks/setup_synology_prerequisites.yml
@@ -11,8 +11,10 @@
 
 # Run immediately during setup so matrix services can start without a manual
 # step. The boot-fix service handles this on every subsequent reboot.
+# noqa command-instead-of-module: ansible.builtin.mount does not support
+# changing mount propagation (--make-shared); command is the only option here.
 - name: Ensure /volume1 has shared mount propagation (Synology)
-  ansible.builtin.command: mount --make-shared /volume1
+  ansible.builtin.command: mount --make-shared /volume1  # noqa command-instead-of-module
   changed_when: false
 
 - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_synology_boot_fix.yml"
diff --git a/roles/custom/matrix-base/templates/bin/matrix-synology-boot-fix.j2 b/roles/custom/matrix-base/templates/bin/matrix-synology-boot-fix.j2
old mode 100644
new mode 100755