diff --git a/contrib/inventory/lxd.py b/contrib/inventory/lxd.py
old mode 100644
new mode 100755
diff --git a/hacking/fix_test_syntax.py b/hacking/fix_test_syntax.py
old mode 100644
new mode 100755
diff --git a/lib/ansible/module_utils/aws/elb_utils.py b/lib/ansible/module_utils/aws/elb_utils.py
index 5af0f25b16..aa89f4f9a2 100644
--- a/lib/ansible/module_utils/aws/elb_utils.py
+++ b/lib/ansible/module_utils/aws/elb_utils.py
@@ -1,4 +1,3 @@
-#!/usr/bin/env python
 # Copyright (c) 2017 Ansible Project
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 
diff --git a/lib/ansible/module_utils/aws/elbv2.py b/lib/ansible/module_utils/aws/elbv2.py
index 2f4d97e7a6..62f4dc4d68 100644
--- a/lib/ansible/module_utils/aws/elbv2.py
+++ b/lib/ansible/module_utils/aws/elbv2.py
@@ -1,4 +1,3 @@
-#!/usr/bin/env python
 # Copyright (c) 2017 Ansible Project
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 
diff --git a/lib/ansible/module_utils/gitlab.py b/lib/ansible/module_utils/gitlab.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/module_utils/manageiq.py b/lib/ansible/module_utils/manageiq.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/cloud/amazon/ec2_lc.py b/lib/ansible/modules/cloud/amazon/ec2_lc.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/cloud/azure/azure_rm_loadbalancer.py b/lib/ansible/modules/cloud/azure/azure_rm_loadbalancer.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/cloud/docker/docker_service.py b/lib/ansible/modules/cloud/docker/docker_service.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/cloud/vmware/vmware_datastore_facts.py b/lib/ansible/modules/cloud/vmware/vmware_datastore_facts.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/clustering/k8s/_kubernetes.py b/lib/ansible/modules/clustering/k8s/_kubernetes.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/clustering/znode.py b/lib/ansible/modules/clustering/znode.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/network/aci/aci_aep_to_domain.py b/lib/ansible/modules/network/aci/aci_aep_to_domain.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/network/aci/aci_contract_subject.py b/lib/ansible/modules/network/aci/aci_contract_subject.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/network/aci/aci_domain_to_vlan_pool.py b/lib/ansible/modules/network/aci/aci_domain_to_vlan_pool.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/network/aci/aci_tenant_ep_retention_policy.py b/lib/ansible/modules/network/aci/aci_tenant_ep_retention_policy.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/network/aci/aci_tenant_span_src_group.py b/lib/ansible/modules/network/aci/aci_tenant_span_src_group.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/network/aci/aci_tenant_span_src_group_to_dst_group.py b/lib/ansible/modules/network/aci/aci_tenant_span_src_group_to_dst_group.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/network/bigswitch/bcf_switch.py b/lib/ansible/modules/network/bigswitch/bcf_switch.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/network/bigswitch/bigmon_chain.py b/lib/ansible/modules/network/bigswitch/bigmon_chain.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/network/panos/panos_sag.py b/lib/ansible/modules/network/panos/panos_sag.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/network/panos/panos_security_rule.py b/lib/ansible/modules/network/panos/panos_security_rule.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/notification/logentries_msg.py b/lib/ansible/modules/notification/logentries_msg.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/notification/snow_record.py b/lib/ansible/modules/notification/snow_record.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/remote_management/hpilo/hpilo_boot.py b/lib/ansible/modules/remote_management/hpilo/hpilo_boot.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/remote_management/hpilo/hpilo_facts.py b/lib/ansible/modules/remote_management/hpilo/hpilo_facts.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/remote_management/manageiq/manageiq_user.py b/lib/ansible/modules/remote_management/manageiq/manageiq_user.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/source_control/gitlab_deploy_key.py b/lib/ansible/modules/source_control/gitlab_deploy_key.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/source_control/gitlab_hooks.py b/lib/ansible/modules/source_control/gitlab_hooks.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/system/interfaces_file.py b/lib/ansible/modules/system/interfaces_file.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/system/service_facts.py b/lib/ansible/modules/system/service_facts.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/modules/web_infrastructure/jenkins_job_facts.py b/lib/ansible/modules/web_infrastructure/jenkins_job_facts.py
old mode 100755
new mode 100644
diff --git a/lib/ansible/plugins/inventory/foreman.py b/lib/ansible/plugins/inventory/foreman.py
old mode 100755
new mode 100644
diff --git a/test/runner/lib/cloud/foreman.py b/test/runner/lib/cloud/foreman.py
index aee1a5f068..ca05bbadfc 100644
--- a/test/runner/lib/cloud/foreman.py
+++ b/test/runner/lib/cloud/foreman.py
@@ -1,4 +1,3 @@
-#!/usr/bin/env python
 """Foreman plugin for integration tests."""
 
 from __future__ import absolute_import, print_function
diff --git a/test/sanity/code-smell/shebang.py b/test/sanity/code-smell/shebang.py
index bac373bc45..23fd147881 100755
--- a/test/sanity/code-smell/shebang.py
+++ b/test/sanity/code-smell/shebang.py
@@ -1,6 +1,7 @@
 #!/usr/bin/env python
 
 import os
+import stat
 import sys
 
 
@@ -24,7 +25,6 @@ def main():
     }
 
     skip = set([
-        'hacking/cherrypick.py',
         'test/integration/targets/win_module_utils/library/legacy_only_new_way_win_line_ending.ps1',
         'test/integration/targets/win_module_utils/library/legacy_only_old_way_win_line_ending.ps1',
     ])
@@ -35,17 +35,27 @@ def main():
 
         with open(path, 'rb') as path_fd:
             shebang = path_fd.readline().strip()
+            mode = os.stat(path).st_mode
+            executable = (stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH) & mode
 
-            if not shebang:
-                continue
+            if not shebang or not shebang.startswith(b'#!'):
+                if executable:
+                    print('%s:%d:%d: file without shebang should not be executable' % (path, 0, 0))
 
-            if not shebang.startswith(b'#!'):
                 continue
 
             is_module = False
 
             if path.startswith('lib/ansible/modules/'):
                 is_module = True
+            elif path.startswith('lib/') or path.startswith('test/runner/lib/'):
+                if executable:
+                    print('%s:%d:%d: should not be executable' % (path, 0, 0))
+
+                if shebang:
+                    print('%s:%d:%d: should not have a shebang' % (path, 0, 0))
+
+                continue
             elif path.startswith('test/integration/targets/'):
                 dirname = os.path.dirname(path)
 
@@ -57,6 +67,9 @@ def main():
                     is_module = True
 
             if is_module:
+                if executable:
+                    print('%s:%d:%d: module should not be executable' % (path, 0, 0))
+
                 ext = os.path.splitext(path)[1]
                 expected_shebang = module_shebangs.get(ext)
                 expected_ext = ' or '.join(['"%s"' % k for k in module_shebangs])
diff --git a/test/sanity/validate-modules/test_validate_modules_regex.py b/test/sanity/validate-modules/test_validate_modules_regex.py
index 0e41ee7e2d..f1c00c54e5 100644
--- a/test/sanity/validate-modules/test_validate_modules_regex.py
+++ b/test/sanity/validate-modules/test_validate_modules_regex.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python
-
 # This is a standalone test for the regex inside validate-modules
 # It is not suitable to add to the make tests target because the
 # file under test is outside the test's sys.path AND has a hyphen
diff --git a/test/units/modules/network/nxos/test_nxos_config.py b/test/units/modules/network/nxos/test_nxos_config.py
index 07a149589c..aca3cedd4f 100644
--- a/test/units/modules/network/nxos/test_nxos_config.py
+++ b/test/units/modules/network/nxos/test_nxos_config.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python
-#
 # (c) 2016 Red Hat Inc.
 #
 # This file is part of Ansible
diff --git a/test/units/modules/source_control/test_gitlab_deploy_key.py b/test/units/modules/source_control/test_gitlab_deploy_key.py
old mode 100755
new mode 100644
diff --git a/test/units/modules/source_control/test_gitlab_hooks.py b/test/units/modules/source_control/test_gitlab_hooks.py
old mode 100755
new mode 100644