@@ -0,0 +1,63 @@
+name: Linux phones
+
+# Builds/validates the Linux-phone packaging (arm64 .deb/.rpm + Ubuntu Touch
+# click) on every relevant push — the release workflow attaches these to a
+# tagged release, this one just proves they build. See docs/mobile-architecture.md.
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'distribution/deb-rpm/**'
+      - 'distribution/ubuntu-touch/**'
+      - 'apps/desktop/**'
+      - '.github/workflows/linux-phones.yml'
+  pull_request:
+    paths:
+      - 'distribution/deb-rpm/**'
+      - 'distribution/ubuntu-touch/**'
+      - 'apps/desktop/**'
+      - '.github/workflows/linux-phones.yml'
+  workflow_dispatch:
+
+jobs:
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Version
+        id: v
+        run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
+
+      - name: Install nfpm
+        run: |
+          curl -sSfL "https://github.com/goreleaser/nfpm/releases/download/v2.41.0/nfpm_2.41.0_amd64.deb" -o /tmp/nfpm.deb
+          sudo dpkg -i /tmp/nfpm.deb
+
+      - name: Build noarch tarball
+        run: bash apps/desktop/scripts/build-release.sh "v${{ steps.v.outputs.version }}" linux
+
+      - name: Build deb + rpm (amd64 + arm64)
+        run: bash distribution/deb-rpm/build.sh "v${{ steps.v.outputs.version }}"
+
+      - name: Verify arm64 .deb (phones)
+        run: |
+          deb="dist/tronbrowser_${{ steps.v.outputs.version }}_arm64.deb"
+          test -f "$deb" || { echo "missing $deb"; exit 1; }
+          arch="$(dpkg-deb -f "$deb" Architecture)"
+          [ "$arch" = "arm64" ] || { echo "bad arch: $arch"; exit 1; }
+          dpkg-deb -c "$deb" | grep -q 'usr/share/applications/tronbrowser.desktop' \
+            || { echo "missing desktop entry"; exit 1; }
+          echo "arm64 .deb OK: $deb"
+
+      - name: Stage + validate Ubuntu Touch click
+        run: bash distribution/ubuntu-touch/build.sh "v${{ steps.v.outputs.version }}" arm64
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: linux-phone-packages
+          path: |
+            dist/*.deb
+            dist/*.rpm
+            dist/*.click
+          if-no-files-found: warn
@@ -67,9 +67,18 @@ jobs:
           curl -sSfL "https://github.com/goreleaser/nfpm/releases/download/v2.41.0/nfpm_2.41.0_amd64.deb" -o /tmp/nfpm.deb
           sudo dpkg -i /tmp/nfpm.deb
           sudo apt-get update -qq && sudo apt-get install -y -qq librsvg2-bin
+          # deb + rpm for amd64 AND arm64 (arm64 = Librem 5 / PinePhone / postmarketOS)
           bash distribution/deb-rpm/build.sh "v${{ needs.create-release.outputs.version }}"
           bash distribution/appimage/build.sh "v${{ needs.create-release.outputs.version }}"
 
+      - name: Package (Ubuntu Touch click)
+        if: matrix.platform == 'linux'
+        continue-on-error: true   # non-fatal: never block a release on the UT click
+        run: |
+          pip install --user clickable-ut || true
+          export PATH="$HOME/.local/bin:$PATH"
+          bash distribution/ubuntu-touch/build.sh "v${{ needs.create-release.outputs.version }}" arm64 || true
+
       - name: Package (windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -90,7 +99,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           shopt -s nullglob
-          assets=(dist/tronbrowser-*.tar.gz dist/tronbrowser-*.zip dist/*.deb dist/*.rpm dist/*.AppImage)
+          assets=(dist/tronbrowser-*.tar.gz dist/tronbrowser-*.zip dist/*.deb dist/*.rpm dist/*.AppImage dist/*.click)
           gh release upload "${{ needs.create-release.outputs.tag }}" "${assets[@]}" --clobber
 
   # 3) Publish (un-draft) once every platform has uploaded.
 
@@ -20,3 +20,7 @@ coverage/
 
 # Bundled at build time (fetched, GPL — not vendored)
 apps/desktop/extensions/ublock-origin/
+
+# Ubuntu Touch click staging (assembled from the release tarball)
+distribution/ubuntu-touch/install/
+distribution/ubuntu-touch/build/
@@ -74,6 +74,28 @@ stage() { # dest dir
   cp -L "$REPO_ROOT/apps/web/public/icons/icon-512x512.png" "$s/tronbrowser.png" 2>/dev/null || true
   printf '%s\n' "$VERSION" > "$s/VERSION"
 
+  # Freedesktop .desktop entry so TronBrowser appears in app grids/menus —
+  # notably the Linux-phone shells (Phosh on Librem 5, Phosh/Plasma Mobile on
+  # PinePhone). The .deb installs this to /usr/share/applications; harmless in
+  # the tarball. StartupWMClass matches the isolated-profile Chromium window.
+  cat > "$s/tronbrowser.desktop" <<'DESKTOP'
+[Desktop Entry]
+Type=Application
+Name=TronBrowser
+GenericName=Web Browser
+Comment=Privacy-first, AI-native browser (Ungoogled Chromium)
+Exec=tron %U
+TryExec=tron
+Icon=tronbrowser
+Terminal=false
+Categories=Network;WebBrowser;
+MimeType=text/html;x-scheme-handler/http;x-scheme-handler/https;
+Keywords=web;browser;privacy;tor;ai;
+StartupNotify=true
+StartupWMClass=tronbrowser
+X-Purism-FormFactor=Workstation;Mobile;
+DESKTOP
+
   # NOTE: we no longer bundle NeverDecaf's chromium-web-store. Its manifest's
   # web_accessible_resources is rejected by some Chromium builds (macOS), which
   # aborts startup when loaded unpacked via --load-extension. Chrome Web Store
 
@@ -23,8 +23,10 @@ release assets. Goal: every major OS + open-source platform.
 | Universal Linux | Flatpak | [`flatpak/`](flatpak/) | 🟡 manifest ready (Flathub PR) |
 | Universal Linux | AppImage | [`appimage/`](appimage/) | ✅ built in CI |
 | FreeBSD | port | [`freebsd/`](freebsd/) | 🟡 port ready |
+| Librem 5 / PinePhone / postmarketOS | apt (arm64 .deb) | [`deb-rpm/`](deb-rpm/) (nfpm) | ✅ built in CI |
 | Librem 5 / PinePhone / Ubuntu Touch | `curl \| sh` (arm64) | install.sh | ✅ noarch launcher |
-| iOS / Android | Expo / EAS | [`apps/mobile`](../apps/mobile) | 🚧 Phase 2 |
+| Ubuntu Touch | click (Libertine) | [`ubuntu-touch/`](ubuntu-touch/) | 🟡 skeleton + CI-validated |
+| iOS / Android | Expo / EAS | [`apps/mobile`](../apps/mobile) | ✅ companion app |
 
 ## CI/CD (per platform, one repo)
 
@@ -43,8 +45,10 @@ channel — gated on that channel's secret, dry-run by default.
 ## Build a single channel locally
 
 ```bash
-bash apps/desktop/scripts/build-release.sh v0.1.1 linux   # tar.gz
-bash distribution/deb-rpm/build.sh v0.1.1                  # .deb + .rpm (needs nfpm)
+bash apps/desktop/scripts/build-release.sh v0.1.1 linux   # tar.gz (noarch)
+bash distribution/deb-rpm/build.sh v0.1.1                 # .deb + .rpm, amd64 + arm64 (needs nfpm)
+bash distribution/deb-rpm/build.sh v0.1.1 arm64           # arm64 only (phones)
+bash distribution/ubuntu-touch/build.sh v0.1.1 arm64      # Ubuntu Touch .click (needs Clickable)
 bash distribution/appimage/build.sh v0.1.1                # .AppImage
 node scripts/submit-packages.mjs -v 0.1.1 -p all --dry-run
 ```
 
@@ -1,9 +1,17 @@
 #!/usr/bin/env bash
 # Build .deb and .rpm from the linux release tarball using nfpm.
-# Usage: distribution/deb-rpm/build.sh <version>   (expects dist/tronbrowser-linux-x64.tar.gz)
+#
+# Usage: distribution/deb-rpm/build.sh <version> [arch ...]
+#   arch defaults to "amd64 arm64" (arm64 is what Linux phones install).
+#   Valid archs: amd64 arm64  (expects dist/tronbrowser-linux-x64.tar.gz)
+#
+# The staged tree is noarch, so every arch is packaged from the same tarball;
+# only the package's Architecture field (and deb/rpm arch tag) changes.
 set -euo pipefail
 
-VERSION="${1:?usage: build.sh <version>}"
+VERSION="${1:?usage: build.sh <version> [arch ...]}"; shift || true
+ARCHES=("$@"); [ ${#ARCHES[@]} -gt 0 ] || ARCHES=(amd64 arm64)
+
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TARBALL="$ROOT/dist/tronbrowser-linux-x64.tar.gz"
@@ -16,12 +24,16 @@ tar -xzf "$TARBALL" -C "$work"            # -> $work/tronbrowser
 TB_VERSION="${VERSION#v}"
 TB_ROOT="$work/tronbrowser"
 
-rendered="$work/nfpm.yaml"
-sed -e "s|\${TB_VERSION}|${TB_VERSION}|g" -e "s|\${TB_ROOT}|${TB_ROOT}|g" \
-  "$HERE/nfpm.yaml" > "$rendered"
+for TB_ARCH in "${ARCHES[@]}"; do
+  rendered="$work/nfpm-${TB_ARCH}.yaml"
+  sed -e "s|\${TB_VERSION}|${TB_VERSION}|g" \
+      -e "s|\${TB_ROOT}|${TB_ROOT}|g" \
+      -e "s|\${TB_ARCH}|${TB_ARCH}|g" \
+    "$HERE/nfpm.yaml" > "$rendered"
+  nfpm package -f "$rendered" -p deb -t "$ROOT/dist"
+  nfpm package -f "$rendered" -p rpm -t "$ROOT/dist"
+done
 
-nfpm package -f "$rendered" -p deb -t "$ROOT/dist"
-nfpm package -f "$rendered" -p rpm -t "$ROOT/dist"
 rm -rf "$work"
-echo "built deb + rpm:"
+echo "built deb + rpm (${ARCHES[*]}):"
 ls -lh "$ROOT/dist"/*.deb "$ROOT/dist"/*.rpm 2>/dev/null | awk '{print "  "$9" ("$5")"}'
@@ -1,7 +1,11 @@
 # nfpm config — builds .deb and .rpm from the staged TronBrowser tree.
-# Driven by packaging/build-deb-rpm.sh (sets TB_VERSION + TB_ROOT).
+# Driven by distribution/deb-rpm/build.sh (sets TB_VERSION, TB_ROOT, TB_ARCH).
+#
+# The packaged tree is noarch (POSIX launcher + extensions + SVG/PNG), so the
+# SAME staged tree produces amd64 AND arm64 packages — arm64 is what Linux
+# phones (Librem 5 / PureOS, PinePhone / Mobian, postmarketOS) install.
 name: tronbrowser
-arch: amd64
+arch: ${TB_ARCH}
 platform: linux
 version: ${TB_VERSION}
 section: web
@@ -11,8 +15,13 @@ description: Open-source, privacy-first, AI-native browser (Ungoogled Chromium f
 vendor: Profullstack, Inc.
 homepage: https://tronbrowser.dev
 license: MIT
+# Drives system Ungoogled Chromium / Chromium — accept whichever the distro
+# ships (phone distros vary: Mobian/PureOS ship `chromium`).
 depends:
-  - chromium
+  - chromium | chromium-browser | ungoogled-chromium
+# `tron --tor` needs the tor daemon; optional, so recommend (not depend).
+recommends:
+  - tor
 contents:
   - src: ${TB_ROOT}/
     dst: /usr/lib/tronbrowser
@@ -22,3 +31,9 @@ contents:
   - src: /usr/lib/tronbrowser/tronbrowser
     dst: /usr/bin/tronbrowser
     type: symlink
+  # Desktop entry + icon so TronBrowser shows in the phone app grid
+  # (Phosh on Librem 5, Plasma Mobile / Phosh on PinePhone) and desktops.
+  - src: ${TB_ROOT}/tronbrowser.desktop
+    dst: /usr/share/applications/tronbrowser.desktop
+  - src: ${TB_ROOT}/tronbrowser.png
+    dst: /usr/share/icons/hicolor/512x512/apps/tronbrowser.png
@@ -0,0 +1,58 @@
+# TronBrowser on Ubuntu Touch (click)
+
+Packages the noarch TronBrowser launcher as an Ubuntu Touch **click** app so it
+appears in the app grid and opens `http(s)` links.
+
+## The honest constraint (read this first)
+
+Ubuntu Touch **confines** click apps under AppArmor and ships the Morph/Oxide
+web engine — **not** a desktop Chromium. Running the *real* Ungoogled Chromium
+(the whole point of TronBrowser, incl. `--tor`) therefore needs a **Libertine**
+container, where a normal `chromium` is installed and driven by the bundled
+`tron` shim. This is the same full-parity engine as the desktop build — it just
+runs inside Libertine rather than under strict confinement.
+
+Because Chromium-in-Libertine needs an `unconfined` AppArmor profile
+(`tronbrowser.apparmor`), this click is intended for **sideloading / the
+OpenStore "unconfined" track**, not the confined default. See
+[`../../docs/mobile-architecture.md`](../../docs/mobile-architecture.md) (Track 2).
+
+## One-time device setup (Libertine)
+
+In the Terminal app or over `adb shell`:
+
+```bash
+libertine-container-manager create -i tron -n TronBrowser -t chroot
+libertine-container-manager install-package -i tron -p chromium
+```
+
+The wrapper (`tronbrowser-ut`) then runs `libertine-launch -i tron tron <url>`.
+Override the container id with `TRONBROWSER_LIBERTINE_ID`.
+
+## Build the click
+
+```bash
+# 1) produce the noarch tarball (once)
+bash apps/desktop/scripts/build-release.sh v3.7.2 linux
+# 2) stage + build the click (arm64 default; also armhf/amd64)
+bash distribution/ubuntu-touch/build.sh v3.7.2 arm64
+```
+
+`build.sh` stages `install/` and, if [Clickable](https://clickable-ut.dev) (or
+the raw `click` tool) is installed, emits a `.click` into `dist/`. Without a
+builder it leaves the validated `install/` tree.
+
+## Install on device
+
+```bash
+clickable install --arch arm64        # from this dir, device in dev mode
+# or push the .click and: pkcon install-local --allow-untrusted dist/*.click
+```
+
+## Files
+
+- `manifest.json` — click manifest (`@CLICK_ARCH@` + version filled by build.sh).
+- `tronbrowser.apparmor` — `unconfined` (required for Chromium-in-Libertine).
+- `tronbrowser.desktop` — app-grid entry (`Exec=tronbrowser-ut %u`).
+- `tronbrowser-ut` — entry wrapper: `libertine-launch` → bundled `tron`.
+- `clickable.yaml` — Clickable `pure` builder config.
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Assemble the TronBrowser Ubuntu Touch click package from the linux release
+# tarball (noarch launcher tree). Usage:
+#   distribution/ubuntu-touch/build.sh <version> [arch]
+#   arch: arm64 (default) | armhf | amd64   (expects dist/tronbrowser-linux-x64.tar.gz)
+#
+# Produces install/ (the click tree) and, if a click builder is available, a
+# .click under dist/. See README.md for the Libertine/confinement story.
+set -euo pipefail
+
+VERSION="${1:?usage: build.sh <version> [arch]}"
+ARCH="${2:-arm64}"
+TB_VERSION="${VERSION#v}"
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TARBALL="$ROOT/dist/tronbrowser-linux-x64.tar.gz"
+[ -f "$TARBALL" ] || { echo "missing $TARBALL — run build-release.sh linux first" >&2; exit 1; }
+
+INSTALL="$HERE/install"
+rm -rf "$INSTALL"; mkdir -p "$INSTALL/assets"
+
+# Noarch launcher tree (the same one the .deb/tarball ship).
+tar -xzf "$TARBALL" -C "$INSTALL"          # -> $INSTALL/tronbrowser
+install -m 0755 "$HERE/tronbrowser-ut" "$INSTALL/tronbrowser-ut"
+cp "$HERE/tronbrowser.apparmor" "$INSTALL/tronbrowser.apparmor"
+cp "$HERE/tronbrowser.desktop" "$INSTALL/tronbrowser.desktop"
+cp "$INSTALL/tronbrowser/tronbrowser.png" "$INSTALL/assets/tronbrowser.png"
+
+# Render manifest (version + arch).
+sed -e "s|\"version\": \"[^\"]*\"|\"version\": \"${TB_VERSION}\"|" \
+    -e "s|@CLICK_ARCH@|${ARCH}|" \
+  "$HERE/manifest.json" > "$INSTALL/manifest.json"
+
+echo "staged click tree at $INSTALL (arch=$ARCH, version=$TB_VERSION)"
+
+# Validate the JSON we just produced.
+for j in manifest.json tronbrowser.apparmor; do
+  python3 -c "import json,sys; json.load(open('$INSTALL/$j'))" \
+    && echo "  ok: $j"
+done
+
+# Build the .click if a builder is available; otherwise leave the staged tree.
+if command -v clickable >/dev/null 2>&1; then
+  ( cd "$HERE" && clickable build --arch "$ARCH" )
+elif command -v click >/dev/null 2>&1; then
+  mkdir -p "$ROOT/dist"
+  click build "$INSTALL" --output "$ROOT/dist"
+  ls -lh "$ROOT/dist"/*.click 2>/dev/null | awk '{print "  built "$9" ("$5")"}'
+else
+  echo "note: no 'clickable' or 'click' found — staged tree only."
+  echo "      install Clickable (https://clickable-ut.dev) then: clickable build --arch $ARCH"
+fi
@@ -0,0 +1,14 @@
+# Clickable config for the TronBrowser Ubuntu Touch click package.
+# https://clickable-ut.dev
+#
+# `pure` builder: no cross-compilation/containers — we ship the noarch launcher
+# tree, so the build just assembles files. `build.sh` stages the release tarball
+# into ./install before `clickable build` zips it into a .click.
+clickable_minimum_required: "8.0.0"
+builder: pure
+kill: tronbrowser-ut
+
+# Default target arch for phones. Override with `clickable build --arch armhf`.
+arch: arm64
+
+install_dir: install