diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8543ccd..079325d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,6 +87,32 @@ jobs:
           fi
           echo "every row goes through the helper"
 
+      # The desktop draws this file through gdk-pixbuf, which recognises a format by sniffing the first
+      # bytes of it: the SVG loader looks for `<svg` near the start. A comment written above the element
+      # pushed `<svg` 501 bytes in, and every consumer answered "couldn't recognize the image file format"
+      # while the file stayed perfectly valid SVG — so the dock, the app grid and the window all drew
+      # nothing, and nothing anywhere said why.
+      #
+      # It has to be this tool. `rsvg-convert` parses the file directly, accepts the broken one and exits 0,
+      # so a check built on it proves nothing. And the thumbnailer warns and *also* exits 0, so the check
+      # has to look at what came out rather than at the exit status. Both were tried against the broken
+      # file before this was written.
+      - name: The icon is an icon as far as the desktop is concerned
+        run: |
+          set -euo pipefail
+          sudo apt-get install -y -qq libgdk-pixbuf2.0-bin librsvg2-common
+          icon=packaging/desktop/com.xinbetween.Flowlight.svg
+          at=$(grep -abo '<svg' "$icon" | head -1 | cut -d: -f1)
+          echo "<svg starts at byte $at"
+          rm -f /tmp/icon.png
+          gdk-pixbuf-thumbnailer -s 64 "$icon" /tmp/icon.png || true
+          if [ ! -s /tmp/icon.png ]; then
+            echo "gdk-pixbuf cannot draw this file, so no desktop will either."
+            echo "<svg is $at bytes in; the loader sniffs the start of the file. Keep comments inside the element."
+            exit 1
+          fi
+          echo "the icon draws: $(stat -c %s /tmp/icon.png) bytes of PNG"
+
       - name: A row shows the text it was given
         run: |
           set -euo pipefail
diff --git a/Cargo.lock b/Cargo.lock
index fe54c86..800bd55 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -540,7 +540,7 @@ checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
 [[package]]
 name = "flowlight-agents"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "serde",
@@ -550,11 +550,11 @@ dependencies = [
 
 [[package]]
 name = "flowlight-alerts"
-version = "0.5.14"
+version = "0.5.15"
 
 [[package]]
 name = "flowlight-ask"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "flowlight-store",
@@ -565,14 +565,14 @@ dependencies = [
 
 [[package]]
 name = "flowlight-common"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "aya",
 ]
 
 [[package]]
 name = "flowlight-daemon"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "aya",
@@ -598,14 +598,14 @@ dependencies = [
 
 [[package]]
 name = "flowlight-devices"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "anyhow",
 ]
 
 [[package]]
 name = "flowlight-ebpf"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "aya-ebpf",
  "flowlight-common",
@@ -613,7 +613,7 @@ dependencies = [
 
 [[package]]
 name = "flowlight-gui"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -625,14 +625,14 @@ dependencies = [
 
 [[package]]
 name = "flowlight-owners"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "anyhow",
 ]
 
 [[package]]
 name = "flowlight-platform"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "libc",
@@ -640,7 +640,7 @@ dependencies = [
 
 [[package]]
 name = "flowlight-proxy"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "flowlight-agents",
@@ -656,7 +656,7 @@ dependencies = [
 
 [[package]]
 name = "flowlight-rules"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "serde",
  "serde_json",
@@ -664,7 +664,7 @@ dependencies = [
 
 [[package]]
 name = "flowlight-store"
-version = "0.5.14"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "flowlight-alerts",
@@ -677,7 +677,7 @@ dependencies = [
 
 [[package]]
 name = "flowlight-text"
-version = "0.5.14"
+version = "0.5.15"
 
 [[package]]
 name = "foldhash"
diff --git a/Cargo.toml b/Cargo.toml
index 2627d5b..4b3e59e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,7 +36,7 @@ default-members = [
 ]
 
 [workspace.package]
-version = "0.5.14"
+version = "0.5.15"
 edition = "2024"
 license = "GPL-3.0-only"
 repository = "https://github.com/xinbetween/flowlight-linux"
diff --git a/README.md b/README.md
index 2957c64..943b53b 100644
--- a/README.md
+++ b/README.md
@@ -108,6 +108,13 @@ including an installation from it with a throwaway key, and goes live once a sig
 [`packaging/apt/README.md`](packaging/apt/README.md) says why that key is not something this code can create for
 you. Until it is, the commands above have nothing to answer them.
 
+**The application icon.** It is one SVG, at
+`/usr/share/icons/hicolor/scalable/apps/com.xinbetween.Flowlight.svg`, and the desktop draws it through
+gdk-pixbuf — which recognises the format by sniffing the first bytes of the file. Keep `<svg` near the start.
+Until v0.5.15 a comment sat above it, `<svg` began 501 bytes in, and every desktop answered "couldn't
+recognize the image file format" and drew no icon, with the file remaining valid SVG throughout. CI now draws
+the icon through the same loader on every push.
+
 **An empty Live page says which kind of empty it is.** Payload capture runs for a session — eight hours by
 default — and stops when that session ends. Until v0.5.14 the window then showed "Nothing read in this
 window", which reads as "your machine was quiet" when it means "Flowlight stopped reading". It now says the
diff --git a/packaging/desktop/com.xinbetween.Flowlight.svg b/packaging/desktop/com.xinbetween.Flowlight.svg
index 1370ace..15dce97 100644
--- a/packaging/desktop/com.xinbetween.Flowlight.svg
+++ b/packaging/desktop/com.xinbetween.Flowlight.svg
@@ -1,14 +1,20 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!--
-  A plain mark rather than a logo: three flows crossing a lens, and one of them stopped.
-
-  That is the program — traffic read as it passes, and one connection refused — and it is drawn with four
-  shapes so that it still reads at 16 pixels, where anything with detail in it becomes a smudge. Replace it
-  with something better whenever there is something better; nothing in the packaging depends on what is in
-  here, only on the name of the file.
--->
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128"
      role="img" aria-label="Flowlight">
+  <!--
+    The comment goes inside the element, and has to.
+
+    gdk-pixbuf recognises a file by sniffing its first bytes, and the SVG loader looks for `<svg` near the
+    start. This file used to open with a nine-line comment, which put `<svg` 501 bytes in, past where
+    anything looks — so every consumer of it answered "couldn't recognize the image file format" and the
+    desktop drew no icon at all. The file was valid SVG the whole time. Nothing warns about this.
+
+    A plain mark rather than a logo: three flows crossing a lens, and one of them stopped. That is the
+    program — traffic read as it passes, and one connection refused — drawn with four shapes so that it
+    still reads at 16 pixels, where anything with detail in it becomes a smudge. Replace it with something
+    better whenever there is something better; nothing in the packaging depends on what is in here, only on
+    the name of the file and on `<svg` staying where it is.
+  -->
   <rect width="128" height="128" rx="28" fill="#16181d"/>
 
   <!-- Two flows that pass. The gap in the middle is the lens, and the lines stop at its edge rather than