diff --git a/src/index.tsx b/src/index.tsx
index f03746241..63631bc7d 100644
--- a/src/index.tsx
+++ b/src/index.tsx
@@ -22,7 +22,14 @@ import { cleanupSearchCacheIfSignedOut } from './client/initMatrix';
 document.body.classList.add(configClass, varsClass);
 
 // Register Service Worker
-if ('serviceWorker' in navigator) {
+// Service workers only register on http(s) pages. The desktop app loads from
+// `tauri://localhost` in debug builds (and on any platform where the localhost
+// plugin isn't used), where register() rejects: that surfaced in Sentry as an
+// unhandled "must be called with a script URL whose protocol is either HTTP or
+// HTTPS". Skip it there; the app works without a SW, only authenticated media
+// falls back to the client's own fetch.
+const swProtocolOk = window.location.protocol === 'https:' || window.location.protocol === 'http:';
+if ('serviceWorker' in navigator && swProtocolOk) {
   const swUrl =
     import.meta.env.MODE === 'production'
       ? `${trimTrailingSlash(import.meta.env.BASE_URL)}/sw.js`
@@ -39,7 +46,11 @@ if ('serviceWorker' in navigator) {
   // never route. Production sw.js is a classic bundled script.
   navigator.serviceWorker
     .register(swUrl, import.meta.env.MODE === 'production' ? undefined : { type: 'module' })
-    .then(sendSessionToSW);
+    .then(sendSessionToSW)
+    .catch((err) => {
+      // e.g. a private window with SWs disabled; the app still works.
+      console.warn('Service worker registration failed', err);
+    });
   navigator.serviceWorker.ready.then(sendSessionToSW);
 
   navigator.serviceWorker.addEventListener('message', (ev) => {