diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c10b3f0..aadea70 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -95,6 +95,7 @@ jobs:
         run: |
           appimage=(src-tauri/target/${{ matrix.target }}/release/bundle/appimage/*.AppImage)
           bash scripts/fix-appimage.sh "${appimage[0]}"
+          bash scripts/check-appimage-modes.sh "${appimage[0]}"
           dbus-run-session -- xvfb-run -a python3 tests/smoke-linux.py "${appimage[0]}"
       - name: Archive macOS application
         if: runner.os == 'macOS'
diff --git a/package.json b/package.json
index 8fa6598..dac9cca 100644
--- a/package.json
+++ b/package.json
@@ -20,7 +20,7 @@
     "@fortawesome/free-solid-svg-icons": "^7.3.1",
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "@tauri-apps/api": "~2.11.1",
-    "@tauri-apps/cli": "~2.11.4",
+    "@tauri-apps/cli": "~2.12.1",
     "@tauri-apps/plugin-clipboard-manager": "2.3.3",
     "@tsconfig/svelte": "^5.0.8",
     "@types/dygraphs": "^2.1.11",
diff --git a/scripts/check-appimage-modes.sh b/scripts/check-appimage-modes.sh
new file mode 100644
index 0000000..25742af
--- /dev/null
+++ b/scripts/check-appimage-modes.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Fail if an AppImage contains a file or directory with owner-only permissions.
+set -euo pipefail
+
+image="${1:?usage: $0 <file.AppImage>}"
+
+command -v unsquashfs >/dev/null
+[ -x "$image" ] || chmod +x "$image"
+offset="$("$(realpath "$image")" --appimage-offset)"
+[[ "$offset" =~ ^[0-9]+$ ]] && (( offset > 0 ))
+
+listing="$(unsquashfs -lln -o "$offset" "$image")"
+
+bad="$(awk '
+  $1 ~ /^[-d]/ {
+    m = $1
+    owner_x = substr(m, 4, 1) ~ /[xs]/
+    other_r = substr(m, 8, 1) == "r"
+    other_x = substr(m, 10, 1) ~ /[xt]/
+    if ((owner_x && !other_x) || !other_r) {
+      path = $0; sub(/^.*squashfs-root\/?/, "", path)
+      print m, path
+    }
+  }' <<<"$listing")"
+
+if [ -n "$bad" ]; then
+  echo "::error::AppImage contains owner-only permissions; non-root users cannot run it:"
+  echo "$bad"
+  exit 1
+fi
+
+echo "AppImage modes verified: all entries in $(basename "$image") are accessible by any user."
diff --git a/scripts/fix-appimage.sh b/scripts/fix-appimage.sh
index aa2b93d..93e34d2 100644
--- a/scripts/fix-appimage.sh
+++ b/scripts/fix-appimage.sh
@@ -20,6 +20,14 @@ trap 'rm -rf "$workdir"' EXIT
 
 find "$workdir/squashfs-root/usr/lib" -name 'libwayland-*.so*' -print -delete
 
+# Ensure all files and directories in AppDir are readable and executable
+# for any user. Tauri may package AppRun.wrapped with mode 0770, causing
+# permission denied when firejail or the AppImage catalog tests run as non-root.
+chmod -R a+rX "$workdir/squashfs-root"
+if [ -e "$workdir/squashfs-root/AppRun.wrapped" ]; then
+  chmod a+rx "$workdir/squashfs-root/AppRun.wrapped"
+fi
+
 # Retain the exact unsigned AppImage runtime generated by Tauri and replace
 # only its SquashFS payload. No extra runtime download or FUSE mount is needed.
 mksquashfs "$workdir/squashfs-root" "$workdir/payload.squashfs" \
diff --git a/yarn.lock b/yarn.lock
index 08d000b..877db15 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -516,98 +516,98 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli-darwin-arm64@npm:2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli-darwin-arm64@npm:2.11.4"
+"@tauri-apps/cli-darwin-arm64@npm:2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli-darwin-arm64@npm:2.12.1"
   conditions: os=darwin & cpu=arm64
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli-darwin-x64@npm:2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli-darwin-x64@npm:2.11.4"
+"@tauri-apps/cli-darwin-x64@npm:2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli-darwin-x64@npm:2.12.1"
   conditions: os=darwin & cpu=x64
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli-linux-arm-gnueabihf@npm:2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli-linux-arm-gnueabihf@npm:2.11.4"
+"@tauri-apps/cli-linux-arm-gnueabihf@npm:2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli-linux-arm-gnueabihf@npm:2.12.1"
   conditions: os=linux & cpu=arm
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli-linux-arm64-gnu@npm:2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli-linux-arm64-gnu@npm:2.11.4"
+"@tauri-apps/cli-linux-arm64-gnu@npm:2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli-linux-arm64-gnu@npm:2.12.1"
   conditions: os=linux & cpu=arm64 & libc=glibc
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli-linux-arm64-musl@npm:2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli-linux-arm64-musl@npm:2.11.4"
+"@tauri-apps/cli-linux-arm64-musl@npm:2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli-linux-arm64-musl@npm:2.12.1"
   conditions: os=linux & cpu=arm64 & libc=musl
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli-linux-riscv64-gnu@npm:2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli-linux-riscv64-gnu@npm:2.11.4"
+"@tauri-apps/cli-linux-riscv64-gnu@npm:2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli-linux-riscv64-gnu@npm:2.12.1"
   conditions: os=linux & cpu=riscv64 & libc=glibc
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli-linux-x64-gnu@npm:2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli-linux-x64-gnu@npm:2.11.4"
+"@tauri-apps/cli-linux-x64-gnu@npm:2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli-linux-x64-gnu@npm:2.12.1"
   conditions: os=linux & cpu=x64 & libc=glibc
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli-linux-x64-musl@npm:2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli-linux-x64-musl@npm:2.11.4"
+"@tauri-apps/cli-linux-x64-musl@npm:2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli-linux-x64-musl@npm:2.12.1"
   conditions: os=linux & cpu=x64 & libc=musl
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli-win32-arm64-msvc@npm:2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli-win32-arm64-msvc@npm:2.11.4"
+"@tauri-apps/cli-win32-arm64-msvc@npm:2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli-win32-arm64-msvc@npm:2.12.1"
   conditions: os=win32 & cpu=arm64
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli-win32-ia32-msvc@npm:2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli-win32-ia32-msvc@npm:2.11.4"
+"@tauri-apps/cli-win32-ia32-msvc@npm:2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli-win32-ia32-msvc@npm:2.12.1"
   conditions: os=win32 & cpu=ia32
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli-win32-x64-msvc@npm:2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli-win32-x64-msvc@npm:2.11.4"
+"@tauri-apps/cli-win32-x64-msvc@npm:2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli-win32-x64-msvc@npm:2.12.1"
   conditions: os=win32 & cpu=x64
   languageName: node
   linkType: hard
 
-"@tauri-apps/cli@npm:~2.11.4":
-  version: 2.11.4
-  resolution: "@tauri-apps/cli@npm:2.11.4"
+"@tauri-apps/cli@npm:~2.12.1":
+  version: 2.12.1
+  resolution: "@tauri-apps/cli@npm:2.12.1"
   dependencies:
-    "@tauri-apps/cli-darwin-arm64": "npm:2.11.4"
-    "@tauri-apps/cli-darwin-x64": "npm:2.11.4"
-    "@tauri-apps/cli-linux-arm-gnueabihf": "npm:2.11.4"
-    "@tauri-apps/cli-linux-arm64-gnu": "npm:2.11.4"
-    "@tauri-apps/cli-linux-arm64-musl": "npm:2.11.4"
-    "@tauri-apps/cli-linux-riscv64-gnu": "npm:2.11.4"
-    "@tauri-apps/cli-linux-x64-gnu": "npm:2.11.4"
-    "@tauri-apps/cli-linux-x64-musl": "npm:2.11.4"
-    "@tauri-apps/cli-win32-arm64-msvc": "npm:2.11.4"
-    "@tauri-apps/cli-win32-ia32-msvc": "npm:2.11.4"
-    "@tauri-apps/cli-win32-x64-msvc": "npm:2.11.4"
+    "@tauri-apps/cli-darwin-arm64": "npm:2.12.1"
+    "@tauri-apps/cli-darwin-x64": "npm:2.12.1"
+    "@tauri-apps/cli-linux-arm-gnueabihf": "npm:2.12.1"
+    "@tauri-apps/cli-linux-arm64-gnu": "npm:2.12.1"
+    "@tauri-apps/cli-linux-arm64-musl": "npm:2.12.1"
+    "@tauri-apps/cli-linux-riscv64-gnu": "npm:2.12.1"
+    "@tauri-apps/cli-linux-x64-gnu": "npm:2.12.1"
+    "@tauri-apps/cli-linux-x64-musl": "npm:2.12.1"
+    "@tauri-apps/cli-win32-arm64-msvc": "npm:2.12.1"
+    "@tauri-apps/cli-win32-ia32-msvc": "npm:2.12.1"
+    "@tauri-apps/cli-win32-x64-msvc": "npm:2.12.1"
   dependenciesMeta:
     "@tauri-apps/cli-darwin-arm64":
       optional: true
@@ -633,7 +633,7 @@ __metadata:
       optional: true
   bin:
     tauri: tauri.js
-  checksum: 10/581c5c6ee0ba3a609dcea7504774737b80da3a2e47aa54462c2694bdc9ca304d0ecaf5e94200e928ce53ff58d0acbf0c30799714877d98eb2d1ef8d9e11ad2a1
+  checksum: 10/bdf57100a36799d27d6d187025c57a72e7382a66a2eb3163ec3142ceba224e14386858b8dbc41e11c5baa358ddc5ea723e33104cd013bebb83a0fd50bc093b34
   languageName: node
   linkType: hard
 
@@ -1371,7 +1371,7 @@ __metadata:
     "@fortawesome/free-solid-svg-icons": "npm:^7.3.1"
     "@sveltejs/vite-plugin-svelte": "npm:^7.3.0"
     "@tauri-apps/api": "npm:~2.11.1"
-    "@tauri-apps/cli": "npm:~2.11.4"
+    "@tauri-apps/cli": "npm:~2.12.1"
     "@tauri-apps/plugin-clipboard-manager": "npm:2.3.3"
     "@tsconfig/svelte": "npm:^5.0.8"
     "@types/dygraphs": "npm:^2.1.11"