diff --git a/custom-score-build/action.yml b/custom-score-build/action.yml
index b99625d..c885a76 100644
--- a/custom-score-build/action.yml
+++ b/custom-score-build/action.yml
@@ -1,194 +1,199 @@
-name: Custom score build
-description: "Create a custom ossia score build"
-inputs:
-  cmake-options:
-    description: 'Additional CMake options'
-    required: true
-  cmake-cache:
-    description: 'Custom CMake cache file'
-    required: false
-  score-repo:
-    description: 'Custom ossia score repo'
-    required: true
-    default: 'ossia/score'
-  score-ref:
-    description: 'Custom ref to use'
-    required: true
-    default: 'master'
-  target-arch:
-    description: 'Override target architecture: x86_64 or aarch64. If empty, inferred from RUNNER_ARCH. Use to cross-compile (e.g. Intel macOS on an ARM runner).'
-    required: false
-    default: ''
-  target-platform:
-    description: 'Target platform: empty builds for the runner itself, "wasm" cross-compiles to WebAssembly. wasm requires an ubuntu-24.04 runner, which is the image the wasm SDK is built on.'
-    required: false
-    default: ''
-  macos-certificate-base64:
-    description: 'Base64-encoded P12 certificate for macOS code signing (optional)'
-    required: false
-    default: ''
-  macos-certificate-password:
-    description: 'Password for macOS P12 certificate (optional)'
-    required: false
-    default: ''
-  macos-notarize-team-id:
-    description: 'Apple Developer Team ID for notarization (optional)'
-    required: false
-    default: ''
-  macos-notarize-apple-id:
-    description: 'Apple ID for notarization (optional)'
-    required: false
-    default: ''
-  macos-notarize-password:
-    description: 'App-specific password for notarization (optional)'
-    required: false
-    default: ''
-
-outputs:
-  artifact-id:
-    description: "Output artifact id containing built score release"
-    value: ${{ steps.upload.outputs.artifact-id }}
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Long path support
-      if: runner.os == 'Windows'
-      shell: bash
-      run: git config --global core.longpaths true
-
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        repository: ${{ inputs.score-repo }}
-        path: score-src
-        ref: ${{ inputs.score-ref }}
-        submodules: 'recursive'
-
-    - uses: maxim-lobanov/setup-xcode@v1
-      if: runner.os == 'macOS'
-      with:
-        xcode-version: '>=16'
-
-    - uses: Apple-Actions/import-codesign-certs@v7
-      if: runner.os == 'macOS' && inputs.macos-certificate-base64 != ''
-      with:
-        p12-file-base64: ${{ inputs.macos-certificate-base64 }}
-        p12-password: ${{ inputs.macos-certificate-password }}
-
-    - name: Dependencies
-      shell: bash
-      working-directory: score-src
-      run: |
-        if [[ -n "${TARGET_ARCH}" ]]; then
-          export CPU_ARCH="$TARGET_ARCH"
-        elif [[ "$RUNNER_ARCH" == "ARM64" ]]; then
-          export CPU_ARCH=aarch64
-        else
-          export CPU_ARCH=x86_64
-        fi
-        export MACOS_ARCH=$CPU_ARCH
-
-        if [[ "$TARGET_PLATFORM" == "wasm" ]]; then
-          if [[ "$RUNNER_OS" != "Linux" ]]; then
-            echo "Error: target-platform: wasm needs a Linux runner (ubuntu-24.04), got $RUNNER_OS"
-            exit 1
-          fi
-          ./ci/wasm.deps.sh
-        elif [[ "$RUNNER_OS" == "Linux" ]]; then
-          ./ci/appimage.deps.sh
-        elif [[ "$RUNNER_OS" == "Windows" ]]; then
-          ./ci/win32.deps.sh
-        elif [[ "$RUNNER_OS" == "macOS" ]]; then
-          ./ci/osx.package.deps.sh
-        fi
-
-      env:
-        TARGET_ARCH: ${{ inputs.target-arch }}
-        TARGET_PLATFORM: ${{ inputs.target-platform }}
-        MAC_CERT_B64: ${{ inputs.macos-certificate-base64 }}
-        MAC_CODESIGN_PASSWORD:  ${{ inputs.macos-certificate-password }}
-
-    - name: Build
-      shell: bash
-      working-directory: score-src
-      run: |
-        if [[ -n "${TARGET_ARCH}" ]]; then
-          export CPU_ARCH="$TARGET_ARCH"
-        elif [[ "$RUNNER_ARCH" == "ARM64" ]]; then
-          export CPU_ARCH=aarch64
-        else
-          export CPU_ARCH=x86_64
-        fi
-        export MACOS_ARCH=$CPU_ARCH
-
-        if [[ "$TARGET_PLATFORM" == "wasm" ]]; then
-          ./ci/wasm.build.sh
-        elif [[ "$RUNNER_OS" == "Linux" ]]; then
-          ./ci/appimage.build.sh
-        elif [[ "$RUNNER_OS" == "Windows" ]]; then
-          ./ci/win32.build.sh
-        elif [[ "$RUNNER_OS" == "macOS" ]]; then
-          ./ci/osx.package.build.sh
-        fi
-      env:
-        TARGET_ARCH: ${{ inputs.target-arch }}
-        TARGET_PLATFORM: ${{ inputs.target-platform }}
-        SCORE_EXTRA_CMAKE_ARGS: ${{ inputs.cmake-options }}
-        SCORE_CMAKE_CACHE: ${{ inputs.cmake-cache }}
-
-    - name: Deploy
-      id: deploy
-      shell: bash
-      working-directory: score-src
-      run: |
-        if [[ -n "${TARGET_ARCH}" ]]; then
-          export CPU_ARCH="$TARGET_ARCH"
-        elif [[ "$RUNNER_ARCH" == "ARM64" ]]; then
-          export CPU_ARCH=aarch64
-        else
-          export CPU_ARCH=x86_64
-        fi
-        export MACOS_ARCH=$CPU_ARCH
-        export CI_IS_AZURE=0
-
-        export GITTAGNOV=$(echo "$GITHUB_REF" | sed "s/.*\///;s/^v//")
-        export BUILD_ARTIFACTSTAGINGDIRECTORY="$PWD/staging"
-        mkdir -p "$BUILD_ARTIFACTSTAGINGDIRECTORY"
-
-        if [[ "$TARGET_PLATFORM" == "wasm" ]]; then
-          BUNDLE="$PWD/wasm-bundle"
-          rm -rf "$BUNDLE"
-          mkdir -p "$BUNDLE"
-
-          cp /build/*.js "$BUNDLE/"
-          cp /build/ossia-score.wasm "$BUNDLE/"
-          if [[ -f /build/ossia-score.data ]]; then
-            cp /build/ossia-score.data "$BUNDLE/"
-          fi
-          cp cmake/Deployment/WASM/* "$BUNDLE/"
-
-          ( cd "$BUNDLE" && zip -r -q "$BUILD_ARTIFACTSTAGINGDIRECTORY/ossia.score-wasm.zip" . )
-          echo "release-name=wasm" >> $GITHUB_OUTPUT
-        elif [[ "$RUNNER_OS" == "Linux" ]]; then
-          ./ci/appimage.deploy.sh
-          echo "release-name=appimage-$CPU_ARCH" >> $GITHUB_OUTPUT
-        elif [[ "$RUNNER_OS" == "Windows" ]]; then
-          ./ci/win32.deploy.sh
-          echo "release-name=windows-$CPU_ARCH" >> $GITHUB_OUTPUT
-        elif [[ "$RUNNER_OS" == "macOS" ]]; then
-          ./ci/osx.package.deploy.sh
-          echo "release-name=macos-$CPU_ARCH" >> $GITHUB_OUTPUT
-        fi
-      env:
-        TARGET_ARCH: ${{ inputs.target-arch }}
-        TARGET_PLATFORM: ${{ inputs.target-platform }}
-        MAC_ALTOOL_PASSWORD: ${{ inputs.macos-notarize-password }}
-
-    - name: Upload build
-      id: upload
-      uses: actions/upload-artifact@v4
-      with:
-        name: ${{ steps.deploy.outputs.release-name }}
-        path: |
-          score-src/staging/*.*
+name: Custom score build
+description: "Create a custom ossia score build"
+inputs:
+  cmake-options:
+    description: 'Additional CMake options'
+    required: true
+  cmake-cache:
+    description: 'Custom CMake cache file'
+    required: false
+  score-repo:
+    description: 'Custom ossia score repo'
+    required: true
+    default: 'ossia/score'
+  score-ref:
+    description: 'Custom ref to use'
+    required: true
+    default: 'master'
+  target-arch:
+    description: 'Override target architecture: x86_64 or aarch64. If empty, inferred from RUNNER_ARCH. Use to cross-compile (e.g. Intel macOS on an ARM runner).'
+    required: false
+    default: ''
+  target-platform:
+    description: 'Target platform: empty builds for the runner itself, "wasm" cross-compiles to WebAssembly. wasm requires an ubuntu-24.04 runner, which is the image the wasm SDK is built on.'
+    required: false
+    default: ''
+  macos-certificate-base64:
+    description: 'Base64-encoded P12 certificate for macOS code signing (optional)'
+    required: false
+    default: ''
+  macos-certificate-password:
+    description: 'Password for macOS P12 certificate (optional)'
+    required: false
+    default: ''
+  macos-notarize-team-id:
+    description: 'Apple Developer Team ID for notarization (optional)'
+    required: false
+    default: ''
+  macos-notarize-apple-id:
+    description: 'Apple ID for notarization (optional)'
+    required: false
+    default: ''
+  macos-notarize-password:
+    description: 'App-specific password for notarization (optional)'
+    required: false
+    default: ''
+
+outputs:
+  artifact-id:
+    description: "Output artifact id containing built score release"
+    value: ${{ steps.upload.outputs.artifact-id }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Long path support
+      if: runner.os == 'Windows'
+      shell: bash
+      run: git config --global core.longpaths true
+
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        repository: ${{ inputs.score-repo }}
+        path: score-src
+        ref: ${{ inputs.score-ref }}
+        submodules: 'recursive'
+
+    - uses: maxim-lobanov/setup-xcode@v1
+      if: runner.os == 'macOS'
+      with:
+        xcode-version: '>=16'
+
+    - uses: Apple-Actions/import-codesign-certs@v7
+      if: runner.os == 'macOS' && inputs.macos-certificate-base64 != ''
+      with:
+        p12-file-base64: ${{ inputs.macos-certificate-base64 }}
+        p12-password: ${{ inputs.macos-certificate-password }}
+
+    - name: Dependencies
+      shell: bash
+      working-directory: score-src
+      run: |
+        if [[ -n "${TARGET_ARCH}" ]]; then
+          export CPU_ARCH="$TARGET_ARCH"
+        elif [[ "$RUNNER_ARCH" == "ARM64" ]]; then
+          export CPU_ARCH=aarch64
+        else
+          export CPU_ARCH=x86_64
+        fi
+        export MACOS_ARCH=$CPU_ARCH
+
+        if [[ "$TARGET_PLATFORM" == "wasm" ]]; then
+          if [[ "$RUNNER_OS" != "Linux" ]]; then
+            echo "Error: target-platform: wasm needs a Linux runner (ubuntu-24.04), got $RUNNER_OS"
+            exit 1
+          fi
+          ./ci/wasm.deps.sh
+        elif [[ "$RUNNER_OS" == "Linux" ]]; then
+          ./ci/appimage.deps.sh
+        elif [[ "$RUNNER_OS" == "Windows" ]]; then
+          ./ci/win32.deps.sh
+        elif [[ "$RUNNER_OS" == "macOS" ]]; then
+          ./ci/osx.package.deps.sh
+        fi
+
+      env:
+        TARGET_ARCH: ${{ inputs.target-arch }}
+        TARGET_PLATFORM: ${{ inputs.target-platform }}
+        MAC_CERT_B64: ${{ inputs.macos-certificate-base64 }}
+        MAC_CODESIGN_PASSWORD:  ${{ inputs.macos-certificate-password }}
+
+    - name: Build
+      shell: bash
+      working-directory: score-src
+      run: |
+        if [[ -n "${TARGET_ARCH}" ]]; then
+          export CPU_ARCH="$TARGET_ARCH"
+        elif [[ "$RUNNER_ARCH" == "ARM64" ]]; then
+          export CPU_ARCH=aarch64
+        else
+          export CPU_ARCH=x86_64
+        fi
+        export MACOS_ARCH=$CPU_ARCH
+
+        if [[ "$TARGET_PLATFORM" == "wasm" ]]; then
+          ./ci/wasm.build.sh
+        elif [[ "$RUNNER_OS" == "Linux" ]]; then
+          ./ci/appimage.build.sh
+        elif [[ "$RUNNER_OS" == "Windows" ]]; then
+          ./ci/win32.build.sh
+        elif [[ "$RUNNER_OS" == "macOS" ]]; then
+          ./ci/osx.package.build.sh
+        fi
+      env:
+        TARGET_ARCH: ${{ inputs.target-arch }}
+        TARGET_PLATFORM: ${{ inputs.target-platform }}
+        SCORE_EXTRA_CMAKE_ARGS: ${{ inputs.cmake-options }}
+        SCORE_CMAKE_CACHE: ${{ inputs.cmake-cache }}
+        # appimage.build.sh runs appimagetool, which is itself an AppImage;
+        # extract-and-run avoids FUSE, unavailable under rootless docker on the
+        # self-hosted host. score's own appimage.yml sets this on the job, so a
+        # caller going through this action has to set it too.
+        APPIMAGE_EXTRACT_AND_RUN: 1
+
+    - name: Deploy
+      id: deploy
+      shell: bash
+      working-directory: score-src
+      run: |
+        if [[ -n "${TARGET_ARCH}" ]]; then
+          export CPU_ARCH="$TARGET_ARCH"
+        elif [[ "$RUNNER_ARCH" == "ARM64" ]]; then
+          export CPU_ARCH=aarch64
+        else
+          export CPU_ARCH=x86_64
+        fi
+        export MACOS_ARCH=$CPU_ARCH
+        export CI_IS_AZURE=0
+
+        export GITTAGNOV=$(echo "$GITHUB_REF" | sed "s/.*\///;s/^v//")
+        export BUILD_ARTIFACTSTAGINGDIRECTORY="$PWD/staging"
+        mkdir -p "$BUILD_ARTIFACTSTAGINGDIRECTORY"
+
+        if [[ "$TARGET_PLATFORM" == "wasm" ]]; then
+          BUNDLE="$PWD/wasm-bundle"
+          rm -rf "$BUNDLE"
+          mkdir -p "$BUNDLE"
+
+          cp /build/*.js "$BUNDLE/"
+          cp /build/ossia-score.wasm "$BUNDLE/"
+          if [[ -f /build/ossia-score.data ]]; then
+            cp /build/ossia-score.data "$BUNDLE/"
+          fi
+          cp cmake/Deployment/WASM/* "$BUNDLE/"
+
+          ( cd "$BUNDLE" && zip -r -q "$BUILD_ARTIFACTSTAGINGDIRECTORY/ossia.score-wasm.zip" . )
+          echo "release-name=wasm" >> $GITHUB_OUTPUT
+        elif [[ "$RUNNER_OS" == "Linux" ]]; then
+          ./ci/appimage.deploy.sh
+          echo "release-name=appimage-$CPU_ARCH" >> $GITHUB_OUTPUT
+        elif [[ "$RUNNER_OS" == "Windows" ]]; then
+          ./ci/win32.deploy.sh
+          echo "release-name=windows-$CPU_ARCH" >> $GITHUB_OUTPUT
+        elif [[ "$RUNNER_OS" == "macOS" ]]; then
+          ./ci/osx.package.deploy.sh
+          echo "release-name=macos-$CPU_ARCH" >> $GITHUB_OUTPUT
+        fi
+      env:
+        TARGET_ARCH: ${{ inputs.target-arch }}
+        TARGET_PLATFORM: ${{ inputs.target-platform }}
+        MAC_ALTOOL_PASSWORD: ${{ inputs.macos-notarize-password }}
+
+    - name: Upload build
+      id: upload
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.deploy.outputs.release-name }}
+        path: |
+          score-src/staging/*.*
diff --git a/package-custom-app/action.yml b/package-custom-app/action.yml
index f233918..b26f7b0 100644
--- a/package-custom-app/action.yml
+++ b/package-custom-app/action.yml
@@ -364,6 +364,11 @@ runs:
         echo "Command: $CMD"
 
         eval "$CMD"
+      env:
+        # create-app-linux.sh runs appimagetool to write the app's AppImage, and
+        # appimagetool is itself an AppImage; extract-and-run avoids FUSE, which
+        # is unavailable under rootless docker on the self-hosted host.
+        APPIMAGE_EXTRACT_AND_RUN: 1
 
     - name: Set output path
       id: set-output