diff --git a/public-docs/index.md b/public-docs/index.md
index bb735a7cb4..54bd56b7b4 100644
--- a/public-docs/index.md
+++ b/public-docs/index.md
@@ -16,27 +16,6 @@ Download from [paseo.sh/download](https://paseo.sh/download) or the [GitHub rele
 
 The desktop app bundles its own daemon and starts it automatically, no separate install required. On first launch you'll see a brief startup screen, then connect from your phone using **Settings → your host → Pair Device**.
 
-### Linux
-
-Use the `.deb` on Debian/Ubuntu or the `.rpm` on Fedora to keep Chromium's sandbox available even when your distribution restricts user namespaces. The installer configures the bundled sandbox helper; you do not need to change system security settings.
-
-For an AppImage, make the download executable and open it:
-
-```bash
-chmod +x Paseo-x86_64.AppImage
-./Paseo-x86_64.AppImage
-```
-
-If it reports `error loading libfuse.so.2`, run without FUSE:
-
-```bash
-./Paseo-x86_64.AppImage --appimage-extract-and-run
-```
-
-Alternatively, install `libfuse2t64` on Ubuntu 24.04 or newer (`sudo apt install libfuse2t64`), or your distribution's FUSE 2 compatibility package. This dependency belongs to the AppImage runtime, before Paseo starts.
-
-Paseo checks sandbox availability each time it launches. AppImage and extracted tar archives retain sandboxing when user namespaces work. On a restricted host without a usable installed helper, they launch with Chromium's sandbox disabled. Prefer the installed package if you require OS process isolation. **Settings → Diagnostics → App Diagnostics** reports the sandbox state and reason; the desktop log records the same decision. An explicit `--no-sandbox` argument overrides the automatic choice.
-
 ## Server / CLI
 
 For headless machines, dev boxes, or any setup where you want the daemon running without the desktop UI:
diff --git a/public-docs/security.md b/public-docs/security.md
index a935a75878..d1b6ee229a 100644
--- a/public-docs/security.md
+++ b/public-docs/security.md
@@ -121,6 +121,14 @@ The image runs the daemon and launched agents as the non-root `paseo` user, but
 
 See [Docker](/docs/docker) for Compose and reverse proxy examples.
 
+## Linux desktop sandbox
+
+Paseo checks Chromium sandbox availability each time the desktop app launches on Linux. It keeps sandboxing enabled when user namespaces work or an installed sandbox helper is usable. The `.deb` and `.rpm` installers configure that helper.
+
+AppImage and extracted tar archives launch with Chromium's sandbox disabled when neither is available. Use the `.deb` or `.rpm` package if you require Chromium process isolation. Passing `--no-sandbox` explicitly disables it.
+
+Open **Settings → Diagnostics → App Diagnostics** to check the sandbox state and reason. The [desktop log](/docs/troubleshooting#reading-the-logs) records the same decision.
+
 ## Agent authentication
 
 Paseo wraps agent CLIs (Claude Code, Codex, OpenCode, Muse Code) but does not manage their authentication. Each agent provider handles its own credentials:
diff --git a/public-docs/troubleshooting.md b/public-docs/troubleshooting.md
index 77b2497e03..420c3363aa 100644
--- a/public-docs/troubleshooting.md
+++ b/public-docs/troubleshooting.md
@@ -1,6 +1,6 @@
 ---
 title: Troubleshooting
-description: Why Paseo can't find a provider you've installed, and how to fix the PATH and environment mismatches behind most setup issues.
+description: Fix Linux AppImage launch errors, missing providers, and environment mismatches.
 nav: Common problems
 order: 90
 category: Troubleshooting
@@ -8,7 +8,22 @@ category: Troubleshooting
 
 # Troubleshooting
 
-Almost every "it works in my terminal but not in Paseo" problem is the same thing: Paseo and your terminal aren't searching the same `PATH`. This page covers how to spot that and fix it.
+## AppImage won't open on Linux
+
+Make the downloaded AppImage executable, then launch it from a terminal to see any error:
+
+```bash
+chmod +x Paseo-x86_64.AppImage
+./Paseo-x86_64.AppImage
+```
+
+If it reports `error loading libfuse.so.2`, run without FUSE:
+
+```bash
+./Paseo-x86_64.AppImage --appimage-extract-and-run
+```
+
+The Paseo window should open. You can also install the `.deb` on Debian/Ubuntu or the `.rpm` on Fedora from the [download page](https://paseo.sh/download).
 
 ## Paseo can't find my provider