diff --git a/.github/workflows/linux-build.yml b/.github/workflows/linux-build.yml
index 4f768cb..a58ffdc 100644
--- a/.github/workflows/linux-build.yml
+++ b/.github/workflows/linux-build.yml
@@ -159,6 +159,7 @@ jobs:
           (
             cd "$appimage_dir"
             "./$appimage_name" --appimage-extract
+            find squashfs-root -type d -exec chmod 755 {} +
             mv "$appimage_name" "$appimage_name.electron-builder"
             if [ -n "$UPDATE_INFORMATION" ]; then
               ARCH=x86_64 APPIMAGE_EXTRACT_AND_RUN=1 "$APPIMAGETOOL_PATH" \
@@ -190,26 +191,58 @@ jobs:
               exit 1
             fi
           fi
+          squashfs_listing="$RUNNER_TEMP/appimage-filesystem.txt"
+          unsquashfs -lln -o "$("$APPIMAGE_PATH" --appimage-offset)" "$APPIMAGE_PATH" > "$squashfs_listing"
+          awk '$1 ~ /^d/ { found = 1; if ($1 != "drwxr-xr-x") { print "AppImage directory must have mode 0755: " $0 > "/dev/stderr"; exit 1 } } END { if (!found) exit 1 }' "$squashfs_listing"
           extraction_dir="$(mktemp -d)"
           (cd "$extraction_dir" && "$GITHUB_WORKSPACE/$APPIMAGE_PATH" --appimage-extract >/dev/null)
           test -x "$extraction_dir/squashfs-root/AppRun"
           rm -rf "$extraction_dir"
-      - name: Smoke test AppImage at 800x600
+      - name: Install catalog Firejail test runtime
+        run: |
+          set -euo pipefail
+          catalog_firejail="$RUNNER_TEMP/catalog-firejail"
+          mkdir -p "$catalog_firejail"
+          curl --fail --location --retry 3 \
+            https://github.com/AppImage/appimage.github.io/releases/download/deps/alpine-firejail-git20230825.tar.gz \
+            --output "$catalog_firejail/firejail.tar.gz"
+          echo "e346e52ac7dbff3a3f1e8aad3cbb2f06584afcb51c840de07cb8d50e134492d9  $catalog_firejail/firejail.tar.gz" | sha256sum --check
+          curl --fail --location --retry 3 \
+            https://dl-cdn.alpinelinux.org/alpine/v3.13/main/x86_64/musl-1.2.2-r2.apk \
+            --output "$catalog_firejail/musl.apk"
+          echo "3d459f4f3a83e60c6c260c6aee26745e7aa22697f53e3a01445227d2cfeeae8a  $catalog_firejail/musl.apk" | sha256sum --check
+          tar -xzf "$catalog_firejail/firejail.tar.gz" -C "$catalog_firejail"
+          tar --warning=no-unknown-keyword -xzf "$catalog_firejail/firejail-0_git20230825-r0.apk" -C "$catalog_firejail" etc/firejail usr/bin/firejail usr/lib/firejail
+          tar --warning=no-unknown-keyword -xzf "$catalog_firejail/musl.apk" -C "$catalog_firejail" lib
+          sudo cp -R "$catalog_firejail/lib/." /lib/
+          sudo cp -R "$catalog_firejail/etc/firejail" /etc/
+          sudo cp -R "$catalog_firejail/usr/lib/firejail" /usr/lib/
+          sudo install -o root -g root -m 4755 "$catalog_firejail/usr/bin/firejail" /usr/bin/firejail
+      - name: Smoke test AppImage at 800x600 with extraction and Firejail
         env:
-          APPIMAGE_EXTRACT_AND_RUN: "1"
           SCREENSHOT_PATH: ${{ runner.temp }}/PatchOpsIII-800x600.png
         run: |
           set -euo pipefail
+          for launch_mode in firejail extract; do
+          export LAUNCH_MODE="$launch_mode"
+          echo "Testing AppImage launch mode: $LAUNCH_MODE"
+          export XDG_CONFIG_HOME="$RUNNER_TEMP/patchops-config-$launch_mode"
+          export XDG_CACHE_HOME="$RUNNER_TEMP/patchops-cache-$launch_mode"
+          mkdir -p "$XDG_CONFIG_HOME" "$XDG_CACHE_HOME"
           xvfb-run --auto-servernum --server-args="-screen 0 800x600x24" bash -euo pipefail <<'SMOKE_TEST'
           screen_info="$(xwininfo -root)"
           grep -Eq "Width: +800" <<< "$screen_info"
           grep -Eq "Height: +600" <<< "$screen_info"
 
-          "$GITHUB_WORKSPACE/$APPIMAGE_PATH" --no-sandbox --disable-gpu &
+          if [ "$LAUNCH_MODE" = firejail ]; then
+            setsid firejail --quiet --noprofile --net=none --appimage "$GITHUB_WORKSPACE/$APPIMAGE_PATH" &
+          else
+            APPIMAGE_EXTRACT_AND_RUN=1 setsid "$GITHUB_WORKSPACE/$APPIMAGE_PATH" --no-sandbox --disable-gpu &
+          fi
           app_pid=$!
           cleanup() {
             if kill -0 "$app_pid" 2>/dev/null; then
-              kill "$app_pid" 2>/dev/null || true
+              kill -- "-$app_pid" 2>/dev/null || true
               wait "$app_pid" 2>/dev/null || true
             fi
           }
@@ -244,11 +277,14 @@ jobs:
           fi
 
           sleep 2
-          import -window root "$SCREENSHOT_PATH"
+          if [ "$LAUNCH_MODE" = firejail ]; then
+            import -window root "$SCREENSHOT_PATH"
+          fi
           test -s "$SCREENSHOT_PATH"
           sleep 20
           kill -0 "$app_pid"
           SMOKE_TEST
+          done
       - name: Upload AppImage visual review screenshot
         uses: actions/upload-artifact@v4
         with:
diff --git a/Release Notes/PatchOpsIII v1.3.4.md b/Release Notes/PatchOpsIII v1.3.4.md
new file mode 100644
index 0000000..142079d
--- /dev/null
+++ b/Release Notes/PatchOpsIII v1.3.4.md	
@@ -0,0 +1,40 @@
+# PatchOpsIII v1.3.4 Release Notes
+
+## Overview
+
+PatchOpsIII v1.3.4 fixes Linux AppImage startup in sandboxed environments, including the AppImage catalog's Firejail test.
+
+## Highlights
+
+- Correct directory permissions inside the AppImage so Firejail can access the application.
+- Verify the packaged filesystem's directory permissions before release.
+- Test the AppImage at 800×600 using both Firejail and extraction-based launch.
+
+## Detailed Changes
+
+### Linux & Steam Deck
+
+- Normalize all AppImage directories to mode `0755` before repacking. The v1.3.3 AppImage stored its directories as root-owned `0700`, which prevented Firejail from launching it.
+- Inspect the stored SquashFS filesystem to catch inaccessible directories.
+- Run the automated GUI smoke test with the AppImage catalog's Firejail runtime and with extraction-based startup.
+
+## Upgrade Notes
+
+- Linux users affected by the v1.3.3 AppImage launch failure should install v1.3.4.
+- No settings migration is required.
+
+## Downloads & Verification
+
+The release workflow fills in the download URLs, SHA-256 hashes, and VirusTotal links below when publishing.
+
+- **Windows MSI**
+  - Download: [PatchOpsIII v1.3.4 for Windows]({{WINDOWS_DOWNLOAD_URL}})
+  - SHA256: `{{WINDOWS_SHA256}}`
+  - VirusTotal: [Windows MSI scan]({{WINDOWS_VT_URL}})
+  - Older updater compatibility: [PatchOpsIII.exe](https://github.com/boggedbrush/PatchOpsIII/releases/download/v1.3.4/PatchOpsIII.exe)
+
+- **Linux & Steam Deck**
+  - Download: [PatchOpsIII v1.3.4 for Linux & Steam Deck]({{LINUX_DOWNLOAD_URL}})
+  - SHA256: `{{LINUX_SHA256}}`
+  - VirusTotal: [Linux scan]({{LINUX_VT_URL}})
+  - Stable AppImages include update information and a matching zsync file.
diff --git a/package.json b/package.json
index 5981c28..7bda4cf 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "patchopsiii-electron",
-  "version": "v1.3.3",
+  "version": "v1.3.4",
   "description": "Electron control center for Call of Duty: Black Ops III maintenance, mod setup, and performance tuning.",
   "author": "boggedbrush",
   "private": true,