diff --git a/pkgbuilds/t3code-bin/.omarchy/upstream.sh b/pkgbuilds/t3code-bin/.omarchy/upstream.sh
index c146c18a..6bc010c9 100755
--- a/pkgbuilds/t3code-bin/.omarchy/upstream.sh
+++ b/pkgbuilds/t3code-bin/.omarchy/upstream.sh
@@ -23,6 +23,15 @@ if [[ -n "$current" ]] && [[ "$(vercmp "$version" "$current")" -le 0 ]]; then
   exit 0
 fi
 
+# The PKGBUILD builds one fixed asset name, so a feed naming anything else --
+# a rename, or an arm64 build reaching the Linux feed first -- has to stop the
+# sync rather than pin that file's checksum to a URL nobody will fetch.
+expected="T3-Code-${version}-x86_64.AppImage"
+if [[ "$asset" != "$expected" ]]; then
+  echo "Upstream feed names $asset, but the PKGBUILD builds $expected" >&2
+  exit 1
+fi
+
 sha256=$(curl -fsSL "$RELEASE_URL/v${version}/${asset}" | sha256sum | cut -d' ' -f1)
 
 jq -n --arg pkgver "$version" --arg sha256 "$sha256" \
diff --git a/pkgbuilds/t3code-bin/PKGBUILD b/pkgbuilds/t3code-bin/PKGBUILD
index 3bc0d4cd..dbcc9034 100644
--- a/pkgbuilds/t3code-bin/PKGBUILD
+++ b/pkgbuilds/t3code-bin/PKGBUILD
@@ -73,6 +73,17 @@ package() {
 
   # The AppImage's usr/ tree is compatibility libraries for distributions that
   # lack them, and Arch is not one; its icons are the only part worth keeping.
+  # A release that starts shipping something else there stops the build rather
+  # than having it deleted quietly on the way past.
+  local unexpected
+  unexpected=$(find usr \( -type f -o -type l \) | grep -vE \
+    '^usr/share/icons/hicolor/[0-9]+x[0-9]+/apps/t3code\.png$|^usr/lib/lib(Xss\.so\.1|Xtst\.so\.6|appindicator\.so\.1|gconf-2\.so\.4|indicator\.so\.7|notify\.so\.4)$' || true)
+  if [[ -n "${unexpected}" ]]; then
+    echo "Unexpected files in the AppImage's usr/ tree:" >&2
+    echo "${unexpected}" >&2
+    return 1
+  fi
+
   local icon size
   for icon in usr/share/icons/hicolor/*/apps/t3code.png; do
     size="${icon#usr/share/icons/hicolor/}"
@@ -91,6 +102,11 @@ package() {
   cp -a . "${pkgdir}/usr/lib/t3code/"
   chmod -R a+rX "${pkgdir}/usr/lib/t3code"
 
+  # Arch ships Chromium's and Electron's own sandbox helper setuid, which is
+  # what keeps the sandbox up on a kernel that denies unprivileged user
+  # namespaces -- linux-hardened, mainly -- instead of aborting the app.
+  chmod 4755 "${pkgdir}/usr/lib/t3code/chrome-sandbox"
+
   install -Dm755 "${srcdir}/t3code-launcher.sh" "${pkgdir}/usr/bin/t3code"
   install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }