diff --git a/.github/workflows/create-binaries.yaml b/.github/workflows/create-binaries.yaml
index d2214fa..02bb4b9 100644
--- a/.github/workflows/create-binaries.yaml
+++ b/.github/workflows/create-binaries.yaml
@@ -5,30 +5,16 @@ on:
       - v**
   workflow_dispatch:
 
-env:
-  dist-folder-path: dist/OpenSeeFace # The directory generated by PyInstaller
-  artifact-path: OpenSeeFace # Needed since upload-artifacts pulls files out of parent directories
-
 jobs:
-  build-all:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
+  build-windows:
+    env:
+      dist-path: dist/OpenSeeFace
+    runs-on: windows-latest
     steps:
       - name: Pull OpenSeeFace
         uses: actions/checkout@v3
 
-      - name: Create binary Unix
-        if: matrix.os != 'windows-latest'
-        shell: bash
-        run: |
-          chmod +x make_exe.sh
-          ./make_exe.sh
-
-      - name: Create binary Windows
-        if: matrix.os == 'windows-latest'
+      - name: Create binary
         shell: cmd
         run: |
           choco install vcredist140
@@ -41,23 +27,59 @@ jobs:
           make_exe.bat
 
       - name: Move files for uploading
-        shell: bash # Using bash for all OSs should be fine, even on Windows
-        run: |
-          mv dist/facetracker ${{ env.dist-folder-path }}
-          cp -r models ${{ env.dist-folder-path }}
-
-          mkdir ${{ env.artifact-path }}
-          mv ${{ env.dist-folder-path }} ${{ env.artifact-path }}
-
-      # Sometimes the executable bit doesn't get set for Unix builds for some reason
-      - name: Set executable bit
-        if: matrix.os != 'windows-latest'
         shell: bash
-        run: chmod +x ${{ env.artifact-path }}/*
+        run: |
+          # Prevents the parent dist/ directory from being included
+          mv dist/facetracker ${{ env.dist-path }}
+          cp -r models ${{ env.dist-path }}
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: windows-latest
+          path: dist # Add the parent directory to prevent a tarbomb
+          if-no-files-found: error
+
+  # Files must be packed into a tar in order for file permissions to be preserved
+  build-unix:
+    env:
+      artifact-path: OpenSeeFace
+      tar-path: OpenSeeFace.tar
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Pull OpenSeeFace
+        uses: actions/checkout@v3
+
+      - name: Create binary
+        shell: bash
+        run: |
+          chmod +x make_exe.sh
+          ./make_exe.sh
+
+      - name: Move files for uploading
+        shell: bash
+        run: |
+          # Prevents the parent dist/ directory from being included
+          mv dist/facetracker ${{ env.artifact-path }}
+          cp -r models ${{ env.artifact-path }}
+
+      - name: Fix permissions from PyInstaller
+        shell: bash
+        run: |
+          find ${{ env.artifact-path }} -type f -exec chmod -x {} +
+          chmod +x ${{ env.artifact-path }}/facetracker
+
+      - name: Pack files into tar
+        shell: bash
+        run: tar -cvf ${{ env.tar-path }} ${{ env.artifact-path }}
 
       - name: Upload artifact
         uses: actions/upload-artifact@v3
         with:
           name: ${{ matrix.os }}
-          path: ${{ env.artifact-path }}
+          path: ${{ env.tar-path }}
           if-no-files-found: error