diff --git a/config/sites/vitec/config.yaml b/config/sites/vitec/config.yaml
index 3a657c9..5576bdc 100644
--- a/config/sites/vitec/config.yaml
+++ b/config/sites/vitec/config.yaml
@@ -6,7 +6,6 @@ dependencies:
   - typo3/form
   - typo3/seo-sitemap
   - friendsoftypo3/headless
-  - friendsoftypo3/headless-mixed
   - nb-headless-content-blocks/headless-content-blocks
   - evomedien/vitecset
   - vitec/content-blocks-bundle
diff --git a/fix-asset-perms.sh b/fix-asset-perms.sh
index 5413bc8..ad2a0f4 100755
--- a/fix-asset-perms.sh
+++ b/fix-asset-perms.sh
@@ -16,9 +16,15 @@ set -u
 cd "$(dirname "$0")" || exit 1
 
 echo "[perms] Project root: $(pwd)"
-echo "[perms] Setting files 644 / directories 755 under Resources/Public + _assets ..."
-find public/_assets public/fileadmin/icons packages/vitec/Resources/Public -type f -exec chmod 644 {} \; 2>/dev/null
-find public/_assets public/fileadmin/icons packages/vitec/Resources/Public -type d -exec chmod 755 {} \; 2>/dev/null
+# public/fileadmin as a whole, not just icons: every editorial upload and every
+# importer output lands there (success_stories_import, blog-import, downloads,
+# user_upload/products ...) and hits the same 403 otherwise. Found 2026-09-11,
+# when the imported success-story images stayed invisible in the megamenu.
+TARGETS="public/_assets public/fileadmin packages/vitec/Resources/Public"
+
+echo "[perms] Setting files 644 / directories 755 under $TARGETS ..."
+find $TARGETS -type f -exec chmod 644 {} \; 2>/dev/null
+find $TARGETS -type d -exec chmod 755 {} \; 2>/dev/null
 
 echo "[perms] Flushing TYPO3 caches ..."
 if [ -x vendor/bin/typo3 ]; then