diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index a69608ab5d..ae916bcde5 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -219,16 +219,88 @@ jobs:
           VITE_API_URL: ${{ vars.STAGING_API_URL }}
           VITE_ENVIRONMENT: staging
           VITE_GOOGLE_CLIENT_ID: ${{ vars.GOOGLE_CLIENT_ID }}
+          # winfsp-sys build script checks registry for WinFsp install dir.
+          # MSI install registry writes may not be visible to Cargo process;
+          # set explicit path as reliable fallback.
+          WINFSP_INSTALL_DIR: 'C:\Program Files (x86)\WinFsp'
         with:
           projectPath: apps/desktop
           tauriScript: pnpm tauri
           tagName: ${{ inputs.staging_tag || github.ref_name }}
           releaseName: 'CipherBox Desktop ${{ inputs.staging_tag || github.ref_name }}'
-          releaseBody: 'Staging build for ${{ inputs.staging_tag || github.ref_name }}. macOS (unsigned - right-click > Open to launch) and Windows (unsigned - click "More info" > "Run anyway").'
+          releaseBody: 'Staging build for ${{ inputs.staging_tag || github.ref_name }}. macOS (unsigned - right-click > Open to launch), Windows (unsigned - click "More info" > "Run anyway"), and Linux (AppImage/deb).'
           releaseDraft: false
           prerelease: true
           args: -- --no-default-features --features winfsp
 
+  build-desktop-linux:
+    name: Build Desktop App (Linux)
+    runs-on: ubuntu-22.04
+    environment: staging
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.staging_tag || github.ref_name }}
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            libssl-dev \
+            libxdo-dev \
+            libfuse3-dev \
+            pkg-config \
+            build-essential
+
+      - name: Install Rust toolchain
+        run: rustup default stable
+
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            apps/desktop/src-tauri/target
+          key: linux-cargo-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
+          restore-keys: linux-cargo-
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build crypto package
+        run: pnpm --filter @cipherbox/crypto build
+
+      - uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VITE_WEB3AUTH_CLIENT_ID: ${{ vars.VITE_WEB3AUTH_CLIENT_ID }}
+          VITE_API_URL: ${{ vars.STAGING_API_URL }}
+          VITE_ENVIRONMENT: staging
+          VITE_GOOGLE_CLIENT_ID: ${{ vars.GOOGLE_CLIENT_ID }}
+        with:
+          projectPath: apps/desktop
+          tauriScript: pnpm tauri
+          tagName: ${{ inputs.staging_tag || github.ref_name }}
+          releaseName: 'CipherBox Desktop ${{ inputs.staging_tag || github.ref_name }}'
+          releaseBody: 'Staging build for ${{ inputs.staging_tag || github.ref_name }}. macOS (unsigned - right-click > Open to launch), Windows (unsigned - click "More info" > "Run anyway"), and Linux (AppImage/deb).'
+          releaseDraft: false
+          prerelease: true
+          args: -- --no-default-features --features fuse
+
   deploy-vps:
     name: Deploy to Staging VPS
     needs: [build-api, build-tee, build-web]