diff --git a/.github/workflows/build-flatpak.yml b/.github/workflows/build-flatpak.yml
index 4b46757..d59d271 100644
--- a/.github/workflows/build-flatpak.yml
+++ b/.github/workflows/build-flatpak.yml
@@ -22,6 +22,40 @@ jobs:
           sudo rm -rf /usr/local/lib/android /opt/ghc /usr/share/dotnet /opt/hostedtoolcache/CodeQL
           sudo docker image prune -af || true
 
+      - uses: pnpm/action-setup@v4
+        with: { version: 10 }
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Build frontend and pack tarball
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm build:static
+          tar -czf packaging/frontend-dist.tar.gz -C dist .
+
+      - name: Compute frontend-dist sha256
+        run: |
+          SHA=$(sha256sum packaging/frontend-dist.tar.gz | awk '{print $1}')
+          echo "FRONTEND_SHA=$SHA" >> $GITHUB_ENV
+          echo "frontend-dist.tar.gz sha256: $SHA"
+
+      - name: Patch frontend-dist sha256 in flatpak manifest
+        run: |
+          python3 -c "
+          import re, pathlib, os
+          p = pathlib.Path('io.github.moku_project.Moku.yml')
+          content = p.read_text()
+          # Replace the sha256 line that follows the frontend-dist.tar.gz source entry
+          content = re.sub(
+              r'(path: packaging/frontend-dist\.tar\.gz\n\s+sha256: )[0-9a-f]{64}',
+              r'\g<1>' + os.environ['FRONTEND_SHA'],
+              content
+          )
+          p.write_text(content)
+          "
+
       - name: Install flatpak tooling
         run: |
           sudo apt-get update
@@ -63,14 +97,16 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          for i in $(seq 1 12); do
+          # Poll for up to 10 minutes — the release is created by the Windows workflow
+          # which may still be building when the flatpak bundle finishes.
+          for i in $(seq 1 40); do
             RELEASE_ID=$(curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \
               "https://api.github.com/repos/moku-project/Moku/releases" \
               | jq -r '.[] | select(.tag_name == "v${{ github.event.inputs.version }}") | .id' | head -1)
             [ -n "$RELEASE_ID" ] && break
-            echo "Waiting for release... attempt $i"; sleep 15
+            echo "Waiting for release... attempt $i/40"; sleep 15
           done
-          [ -z "$RELEASE_ID" ] && { echo "ERROR: release not found"; exit 1; }
+          [ -z "$RELEASE_ID" ] && { echo "ERROR: release not found after polling"; exit 1; }
 
           curl -s -X POST \
             -H "Authorization: Bearer $GITHUB_TOKEN" \