diff --git a/cli/src/commands/app/apps.ts b/cli/src/commands/app/apps.ts
index 1c6baceda2..0fefd7afbc 100644
--- a/cli/src/commands/app/apps.ts
+++ b/cli/src/commands/app/apps.ts
@@ -18,6 +18,7 @@ import { readInlinePathSync } from "../../utils/utils.ts";
 
 export interface AppFile {
   value: any;
+  public?: boolean;
   summary: string;
   policy: Policy;
 }
@@ -45,6 +46,10 @@ export async function pushApp(
   } catch {
     //ignore
   }
+  if (app?.["policy"]?.["execution_mode"] == "anonymous") {
+    app.public = true;
+  }
+  // console.log(app);
   if (app) {
     app.policy = undefined;
   }
@@ -80,7 +85,7 @@ export async function pushApp(
   }
 
   replaceInlineScripts(localApp.value);
-  await generatingPolicy(localApp, remotePath);
+  await generatingPolicy(localApp, remotePath, localApp?.["public"] ?? false);
   if (app) {
     if (isSuperset(localApp, app)) {
       log.info(colors.green(`App ${remotePath} is up to date`));
@@ -109,11 +114,11 @@ export async function pushApp(
   }
 }
 
-async function generatingPolicy(app: any, path: string) {
+async function generatingPolicy(app: any, path: string, publicApp: boolean) {
   log.info(colors.gray(`Generating fresh policy for app ${path}...`));
   try {
     app.policy = await windmillUtils.updatePolicy(app.value, undefined);
-    app.policy.execution_mode = "publisher";
+    app.policy.execution_mode = publicApp ? "anonymous" : "publisher";
   } catch (e) {
     log.error(colors.red(`Error generating policy for app ${path}: ${e}`));
     throw e;
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index b0e2b74682..d145b03490 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -415,6 +415,9 @@ function ZipFSElement(
               };
             }
 
+            if (app?.["policy"]?.["execution_mode"] == "anonymous") {
+              app.public = true;
+            }
             app.policy = undefined;
             yield {
               isDirectory: false,