diff --git a/.forgejo/workflows/desktop.yml b/.forgejo/workflows/desktop.yml
index 3f559c7..b012b6e 100644
--- a/.forgejo/workflows/desktop.yml
+++ b/.forgejo/workflows/desktop.yml
@@ -83,6 +83,33 @@ jobs:
           (cd /tmp && rm -rf squashfs-root && "$GITHUB_WORKSPACE/out/storebound_${V}_amd64.AppImage" --appimage-extract >/dev/null && squashfs-root/usr/bin/storebound-desktop --self-test)
           rm -rf /tmp/deb && dpkg-deb -x "out/storebound_${V}_amd64.deb" /tmp/deb && /tmp/deb/usr/bin/storebound-desktop --self-test
           dpkg-deb -I "out/storebound_${V}_amd64.deb" | sed -n '1,20p'
+      - name: Start the app under Xvfb (AppImage and deb)
+        # --self-test checks only the sidecar; this opens the real window (GTK, WebKitGTK, the bundled libraries of the
+        # AppImage) on a virtual display. "sidecar started" in host.log means the webview ran the UI and called the host.
+        run: |
+          sudo apt-get install -y -qq --no-install-recommends xvfb xauth dbus-x11 >/dev/null
+          V=$(bun tools/desktop-version.ts --print)
+          smoke() { # <label> <executable>
+            local d; d=$(mktemp -d); local log="$d/data/dev.storebound.desktop/logs/host.log"
+            XDG_DATA_HOME="$d/data" XDG_CONFIG_HOME="$d/config" XDG_CACHE_HOME="$d/cache" \
+              xvfb-run -a dbus-run-session -- "$2" >"$d/out.txt" 2>&1 &
+            local pid=$! ok=0
+            for i in $(seq 1 90); do
+              if grep -q 'sidecar started' "$log" 2>/dev/null; then ok=1; break; fi
+              kill -0 "$pid" 2>/dev/null || break
+              sleep 1
+            done
+            sleep 3; kill -0 "$pid" 2>/dev/null || ok=0
+            pkill -TERM -f storebound-desktop || true; wait "$pid" 2>/dev/null || true
+            echo "--- $1 host.log"; cat "$log" 2>/dev/null || true
+            local wv="$d/data/dev.storebound.desktop/logs/webview.log"
+            if [ -f "$wv" ]; then echo "--- $1 webview.log"; cat "$wv"; grep -qE '^\S+ error ' "$wv" && ok=0; fi
+            grep -qE '^\S+ error |panicked' "$log" 2>/dev/null && ok=0
+            if [ "$ok" != 1 ]; then echo "--- $1 output"; tail -n 60 "$d/out.txt"; echo "$1: the window did not start the UI" >&2; return 1; fi
+            echo "$1: window started, UI reached the sidecar"
+          }
+          smoke AppImage "$GITHUB_WORKSPACE/out/storebound_${V}_amd64.AppImage"
+          smoke deb /tmp/deb/usr/bin/storebound-desktop
       - name: Privacy scan
         run: bun tools/privacy-scan.ts out/
       - name: Checksums