If you want to get fancy you can set permissions on a per-file basis, so only admins have write/modify access to the execuable files. I'm not that worried abou

If you want to get fancy you can set permissions on a per-file basis, so only admins have write/modify access to the execuable files. I'm not that worried about that, as the executable won't get admin privileges without some exploit, so I don't go there. But it's an option.