diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc
index 7fe41588..55b7afd7 100644
--- a/fw-addr-lists.rsc
+++ b/fw-addr-lists.rsc
@@ -72,7 +72,7 @@
       :local Data false;
       :local TimeOut [ $EitherOr [ :totime ($List->"timeout") ] $FwAddrListTimeOut ];
 
-      :foreach Cert in=[ :toarray delimiter=":" ($List->"cert") ] do={
+      :foreach Cert in=[ :toarray delimiter=":" [ :tostr ($List->"cert") ] ] do={
         :if ([ :len ($Cert) ] > 0) do={
           :set CheckCertificate true;
           :if ([ $CertificateAvailable $Cert "fetch" ] = false) do={
diff --git a/global-functions.rsc b/global-functions.rsc
index 85744878..6da5e740 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -1336,14 +1336,6 @@
     :local ScriptInfo [ $ParseKeyValueStore ($ScriptVal->"comment") ];
     :local SourceNew;
 
-    :foreach Scheduler in=[ /system/scheduler/find where on-event~("\\b" . $ScriptVal->"name" . "\\b") ] do={
-      :local SchedulerVal [ /system/scheduler/get $Scheduler ];
-      :if ($ScriptVal->"policy" != $SchedulerVal->"policy") do={
-        $LogPrint warning $0 ("Policies differ for script '" . $ScriptVal->"name" . \
-          "' and its scheduler '" . $SchedulerVal->"name" . "'!");
-      }
-    }
-
     :do {
       :if ($ScriptInfo->"ignore" = true) do={
         $LogPrint debug $0 ("Ignoring script '" . $ScriptVal->"name" . "', as requested.");
@@ -1434,12 +1426,22 @@
         :error false;
       }
 
+      :local ReqPolicy [ $ParseKeyValueStore [ $Grep $SourceNew ("\23 requires policy, ") ] ];
+      :if ([ :len ($ReqPolicy->"policy") ] > 0) do={
+        :set ($ScriptVal->"policy") [ :toarray delimiter=";" ($ReqPolicy->"policy") ];
+        $LogPrint debug $0 ("New policy for script '" . $ScriptVal->"name" . \
+            "': " . ($ReqPolicy->"policy"));
+      }
+      :if ([ :len ($ReqPolicy->"dont-require-permissions") ] > 0) do={
+        :set ($ScriptVal->"dont-require-permissions") ($ReqPolicy->"dont-require-permissions");
+        $LogPrint debug $0 ("Setting dont-require-permissions for script '" . $ScriptVal->"name" . "'.");
+      }
+
       $LogPrint info $0 ("Updating script: " . $ScriptVal->"name");
-      /system/script/set owner=($ScriptVal->"name") \
+      /system/script/set owner=($ScriptVal->"name") policy=($ScriptVal->"policy") \
+          dont-require-permissions=($ScriptVal->"dont-require-permissions") \
           source=[ $IfThenElse ($ScriptUpdatesCRLF = true) $SourceCRLF $SourceNew ] $Script;
-      :if ($ScriptVal->"name" = "global-config" || \
-           $ScriptVal->"name" = "global-functions" || \
-           $ScriptVal->"name" ~ ("^(global-functions\\.d|mod)/.")) do={
+      :if ($ScriptVal->"name" ~ ("^(global-config|global-functions(\\.d/.+)?|mod/.+)\$")) do={
         :set ReloadGlobal true;
       }
     } on-error={ }
diff --git a/mode-button.rsc b/mode-button.rsc
index 364fa33f..ee183b4d 100644
--- a/mode-button.rsc
+++ b/mode-button.rsc
@@ -5,6 +5,7 @@
 #
 # requires RouterOS, version=7.21
 # requires device-mode, scheduler
+# requires policy, dont-require-permissions
 #
 # act on multiple mode and reset button presses
 # https://rsc.eworm.de/doc/mode-button.md