diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index d32e9f2..5eec231 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -40,11 +40,9 @@ jobs:
         env:
           TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
-          # Read version from tauri.conf.json — no fragile filename parsing
           $VERSION = (Get-Content "src-tauri\tauri.conf.json" | ConvertFrom-Json).version
           Write-Host "Version: $VERSION"
 
-          # Get or create the latest release
           $release = Invoke-RestMethod -Uri "$env:GITEA_URL/api/v1/repos/$env:REPO/releases/tags/latest" `
             -Headers @{ Authorization = "token $env:TOKEN" } -ErrorAction SilentlyContinue
           if (-not $release) {
@@ -63,7 +61,6 @@ jobs:
           )
           $names = @("LotusChat-x86_64-setup.exe", "LotusChat-x86_64-setup.nsis.zip", "LotusChat-x86_64-setup.nsis.zip.sig")
           for ($i = 0; $i -lt $files.Length; $i++) {
-            # Delete existing asset with same name if present
             $existing = (Invoke-RestMethod -Uri "$env:GITEA_URL/api/v1/repos/$env:REPO/releases/$releaseId/assets" `
               -Headers @{ Authorization = "token $env:TOKEN" }) | Where-Object { $_.name -eq $names[$i] }
             if ($existing) {
@@ -113,26 +110,29 @@ jobs:
       - name: Install Tauri deps
         run: npm ci
 
+      - name: Stage AppRun for AppImage bundler
+        run: |
+          mkdir -p ~/.cache/tauri
+          cp tools/AppRun-x86_64 ~/.cache/tauri/AppRun-x86_64
+          chmod +x ~/.cache/tauri/AppRun-x86_64
+
       - name: Build
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ''
           NODE_OPTIONS: '--max_old_space_size=4096'
-        # AppImage requires downloading AppRun from GitHub which times out in this runner.
-        # Build deb only; AppImage can be re-enabled once network access to GitHub is confirmed.
-        run: npm run tauri -- build --bundles deb
+        run: npm run tauri -- build --bundles appimage,deb
 
       - name: Upload to release
         env:
           TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
-          # Read version from tauri.conf.json — no fragile filename parsing
           VERSION=$(python3 -c "import json; print(json.load(open('src-tauri/tauri.conf.json'))['version'])")
           echo "Version: $VERSION"
 
-          DEB="src-tauri/target/release/bundle/deb/Lotus Chat_${VERSION}_amd64.deb"
+          APPIMAGE_DIR="src-tauri/target/release/bundle/appimage"
+          DEB_DIR="src-tauri/target/release/bundle/deb"
 
-          # Get or create the latest release
           RELEASE=$(curl -sf "$GITEA_URL/api/v1/repos/$REPO/releases/tags/latest" \
             -H "Authorization: token $TOKEN" 2>/dev/null || true)
           RELEASE_ID=$(echo "$RELEASE" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
@@ -144,10 +144,9 @@ jobs:
               | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
           fi
 
-          for file in \
-            "LotusChat-x86_64.deb|$DEB"; do
-            name="${file%%|*}"
-            path="${file##*|}"
+          upload() {
+            local name="$1" path="$2"
+            local existing_id
             existing_id=$(curl -sf "$GITEA_URL/api/v1/repos/$REPO/releases/$RELEASE_ID/assets" \
               -H "Authorization: token $TOKEN" \
               | python3 -c "import sys,json; assets=json.load(sys.stdin); print(next((str(a['id']) for a in assets if a['name']=='$name'), ''))" 2>/dev/null || true)
@@ -161,7 +160,12 @@ jobs:
               -H "Authorization: token $TOKEN" \
               -H "Content-Type: application/octet-stream" \
               --data-binary @"$path"
-          done
+          }
+
+          upload "LotusChat-x86_64.AppImage"         "$APPIMAGE_DIR/Lotus Chat_${VERSION}_amd64.AppImage"
+          upload "LotusChat-x86_64.AppImage.tar.gz"  "$APPIMAGE_DIR/Lotus Chat_${VERSION}_amd64.AppImage.tar.gz"
+          upload "LotusChat-x86_64.AppImage.tar.gz.sig" "$APPIMAGE_DIR/Lotus Chat_${VERSION}_amd64.AppImage.tar.gz.sig"
+          upload "LotusChat-x86_64.deb"              "$DEB_DIR/Lotus Chat_${VERSION}_amd64.deb"
 
   update-manifest:
     needs: [build-windows, build-linux]
@@ -177,6 +181,7 @@ jobs:
           BASE="$GITEA_URL/LotusGuild/cinny-desktop/releases/download/latest"
 
           WIN_SIG=$(curl -sf "$BASE/LotusChat-x86_64-setup.nsis.zip.sig")
+          LIN_SIG=$(curl -sf "$BASE/LotusChat-x86_64.AppImage.tar.gz.sig")
 
           RELEASE=$(curl -sf "$GITEA_URL/api/v1/repos/$REPO/releases/tags/latest" \
             -H "Authorization: token $TOKEN")
@@ -187,14 +192,22 @@ jobs:
           jq -n \
             --arg version "$VERSION" \
             --arg date "$DATE" \
-            --arg url "$BASE/LotusChat-x86_64-setup.nsis.zip" \
-            --arg sig "$WIN_SIG" \
-            '{"version":$version,"notes":"Latest Lotus Chat release","pub_date":$date,"platforms":{"windows-x86_64":{"url":$url,"signature":$sig}}}' \
-            > release.json
+            --arg win_url "$BASE/LotusChat-x86_64-setup.nsis.zip" \
+            --arg win_sig "$WIN_SIG" \
+            --arg lin_url "$BASE/LotusChat-x86_64.AppImage.tar.gz" \
+            --arg lin_sig "$LIN_SIG" \
+            '{
+              version: $version,
+              notes: "Latest Lotus Chat release",
+              pub_date: $date,
+              platforms: {
+                "windows-x86_64": { url: $win_url, signature: $win_sig },
+                "linux-x86_64":   { url: $lin_url, signature: $lin_sig }
+              }
+            }' > release.json
 
           cat release.json
 
-          # Delete old manifest asset if present
           OLD=$(curl -sf "$GITEA_URL/api/v1/repos/$REPO/releases/$RELEASE_ID/assets" \
             -H "Authorization: token $TOKEN" \
             | python3 -c "import sys,json; print(next((str(a['id']) for a in json.load(sys.stdin) if a['name']=='release.json'), ''))" 2>/dev/null || true)
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index ea3f824..2fcaa81 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -17,7 +17,7 @@ tauri-build = { version = "2", features = [] }
 [dependencies]
 serde_json = "1.0.109"
 serde = { version = "1.0.193", features = ["derive"] }
-tauri = { version = "2", features = [ "devtools"] }
+tauri = { version = "2", features = ["devtools", "wry"] }
 tauri-plugin-localhost = "2"
 tauri-plugin-window-state = "2"
 tauri-plugin-clipboard-manager = "2"
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 1791219..acd7de7 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -53,7 +53,9 @@ pub fn run() {
                     let handler = PermissionRequestedEventHandler::create(Box::new(
                         |_sender, args| {
                             if let Some(args) = args {
-                                let kind = unsafe { args.PermissionKind() }?;
+                                // PermissionKind uses a COM out-param pattern
+                                let mut kind = COREWEBVIEW2_PERMISSION_KIND(0);
+                                unsafe { args.PermissionKind(&mut kind) }?;
                                 if kind == COREWEBVIEW2_PERMISSION_KIND_MICROPHONE
                                     || kind == COREWEBVIEW2_PERMISSION_KIND_CAMERA
                                 {
diff --git a/tools/AppRun-x86_64 b/tools/AppRun-x86_64
new file mode 100755
index 0000000..c0f36d5
Binary files /dev/null and b/tools/AppRun-x86_64 differ