diff --git a/native-messaging/README.md b/native-messaging/README.md
index 08a17b1..0b44138 100644
--- a/native-messaging/README.md
+++ b/native-messaging/README.md
@@ -27,5 +27,9 @@ native-messaging/install.sh --uninstall
 | Firefox | `~/.mozilla/native-messaging-hosts/app.kestrove.nmh.json` | `HKCU\Software\Mozilla\NativeMessagingHosts\app.kestrove.nmh` |
 | Brave | `~/.config/BraveSoftware/Brave-Browser/NativeMessagingHosts/` | same key as Chrome |
 
+The Linux `.deb` and `.rpm` install these manifests system-wide (`src-tauri/linux/`), so they need no script. That
+covers snap Firefox too: it can't start the host itself, so the desktop portal does, after asking the user once.
+AppImage users run `install.sh`.
+
 `allowed_origins` / `allowed_extensions` pin the host to **your** extension id.
 That is the first line of defense against other extensions (docs/04 A8).
diff --git a/native-messaging/install.sh b/native-messaging/install.sh
index 7d059e6..4e086dd 100755
--- a/native-messaging/install.sh
+++ b/native-messaging/install.sh
@@ -84,6 +84,10 @@ esac
   eval "d=\$dir_$b"
   [ -d "$d" ] && BROWSERS="$BROWSERS $b"
 done
+# Snap Firefox keeps its profile in ~/snap, but its portal reads the host from ~/.mozilla like any other Firefox.
+case " $BROWSERS " in *" firefox "*) ;; *)
+  [ -n "$USER_DATA_DIR" ] || { [ -d /snap/firefox ] && BROWSERS="$BROWSERS firefox"; } || true ;;
+esac
 
 render() { # template → stdout
   sed -e "s|__NMH_PATH__|$NMH|" -e "s|chrome-extension://__CHROME_EXTENSION_ID__/|$CHROME_ORIGINS|" -e "s|__FIREFOX_EXTENSION_ID__|$FIREFOX_ID|" "$HERE/$HOST.$1.json"
diff --git a/src-tauri/linux/app.kestrove.nmh.chrome.json b/src-tauri/linux/app.kestrove.nmh.chrome.json
new file mode 100644
index 0000000..0353d18
--- /dev/null
+++ b/src-tauri/linux/app.kestrove.nmh.chrome.json
@@ -0,0 +1,7 @@
+{
+  "name": "app.kestrove.nmh",
+  "description": "Kestrove native messaging host",
+  "path": "/usr/bin/kestrove-nmh",
+  "type": "stdio",
+  "allowed_origins": ["chrome-extension://pmhfoafjoogobhfadaicklhkldgnafmk/", "chrome-extension://kogapfibnnpeapfcjkkpgjddbhnjfein/"]
+}
diff --git a/src-tauri/linux/app.kestrove.nmh.firefox.json b/src-tauri/linux/app.kestrove.nmh.firefox.json
new file mode 100644
index 0000000..6bbc1a9
--- /dev/null
+++ b/src-tauri/linux/app.kestrove.nmh.firefox.json
@@ -0,0 +1,7 @@
+{
+  "name": "app.kestrove.nmh",
+  "description": "Kestrove native messaging host",
+  "path": "/usr/bin/kestrove-nmh",
+  "type": "stdio",
+  "allowed_extensions": ["browser@kestrove.app"]
+}
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 5afe974..f6b8f74 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -41,6 +41,24 @@
       "icons/icon.ico",
       "icons/icon.png"
     ],
+    "linux": {
+      "deb": {
+        "files": {
+          "/usr/lib/mozilla/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.firefox.json",
+          "/etc/opt/chrome/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json",
+          "/etc/chromium/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json",
+          "/etc/opt/edge/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json"
+        }
+      },
+      "rpm": {
+        "files": {
+          "/usr/lib/mozilla/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.firefox.json",
+          "/etc/opt/chrome/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json",
+          "/etc/chromium/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json",
+          "/etc/opt/edge/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json"
+        }
+      }
+    },
     "windows": {
       "nsis": {
         "installerHooks": "windows/hooks.nsh",