diff --git a/packages/desktop/scripts/after-pack.js b/packages/desktop/scripts/after-pack.js
index e876f5e3e..ad92f7f5b 100644
--- a/packages/desktop/scripts/after-pack.js
+++ b/packages/desktop/scripts/after-pack.js
@@ -1,6 +1,12 @@
 const fs = require("fs");
 const path = require("path");
 
+const EXECUTABLE_NAME = "Paseo";
+const WRAPPER_MODE = 0o755;
+const WRAPPER_SCRIPT = `#!/bin/bash
+exec "$(dirname "$(readlink -f "$0")")/${EXECUTABLE_NAME}.bin" --no-sandbox "$@"
+`;
+
 exports.default = async function afterPack(context) {
   if (context.electronPlatformName !== "linux") return;
 
@@ -9,4 +15,20 @@ exports.default = async function afterPack(context) {
     fs.unlinkSync(chromeSandbox);
     console.log("Removed chrome-sandbox from Linux build");
   }
+
+  const executablePath = path.join(context.appOutDir, EXECUTABLE_NAME);
+  const wrappedBinaryPath = path.join(context.appOutDir, `${EXECUTABLE_NAME}.bin`);
+
+  if (!fs.existsSync(wrappedBinaryPath)) {
+    if (!fs.existsSync(executablePath)) {
+      throw new Error(`Expected Linux executable at ${executablePath}`);
+    }
+
+    fs.renameSync(executablePath, wrappedBinaryPath);
+    console.log(`Renamed ${EXECUTABLE_NAME} to ${EXECUTABLE_NAME}.bin for Linux wrapper`);
+  }
+
+  fs.writeFileSync(executablePath, WRAPPER_SCRIPT, { mode: WRAPPER_MODE });
+  fs.chmodSync(executablePath, WRAPPER_MODE);
+  console.log(`Created Linux wrapper for ${EXECUTABLE_NAME} with --no-sandbox`);
 };
diff --git a/packages/desktop/src/main.ts b/packages/desktop/src/main.ts
index a7d5d00e2..23cc7eb3b 100644
--- a/packages/desktop/src/main.ts
+++ b/packages/desktop/src/main.ts
@@ -21,10 +21,6 @@ import {
 import { registerOpenerHandlers } from "./features/opener.js";
 import { setupApplicationMenu } from "./features/menu.js";
 
-if (process.platform === "linux") {
-  app.commandLine.appendSwitch("no-sandbox");
-}
-
 const DEV_SERVER_URL = process.env.EXPO_DEV_URL ?? "http://localhost:8081";
 const APP_SCHEME = "paseo";
 app.setName("Paseo");