diff --git a/apps/extension/e2e/release.e2e.mjs b/apps/extension/e2e/release.e2e.mjs
index 76acd9a..274585e 100644
--- a/apps/extension/e2e/release.e2e.mjs
+++ b/apps/extension/e2e/release.e2e.mjs
@@ -12,9 +12,10 @@
  * as the Chrome Web Store requires) to dist/e2e/.
  *
  * Needs the QA account in the repo's gitignored .env (BRIDGEHOOK_TEST_EMAIL,
- * BRIDGEHOOK_TEST_PASSWORD) or the environment, a Chromium (CHROMIUM_PATH,
- * default /usr/bin/chromium; Google Chrome no longer loads unpacked
- * extensions from the command line) and port 3456 free. Setup and teardown
+ * BRIDGEHOOK_TEST_PASSWORD) or the environment, a Chromium (Playwright's own,
+ * which `pnpm e2e` installs; CHROMIUM_PATH names another; Google Chrome no
+ * longer loads unpacked extensions from the command line) and port 3456 free.
+ * The browser runs sandboxed, so run as a normal user, not root. Setup and teardown
  * revoke the QA account's devices and channels, so runs do not accumulate.
  */
 import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync } from "node:fs";
@@ -96,8 +97,12 @@ const fail = (msg) => {
 };
 const profile = mkdtempSync(join(tmpdir(), "bh-ext-profile-"));
 const launch = () =>
+	// Playwright's full Chromium (channel "chromium": chrome-headless-shell cannot
+	// load extensions) unless CHROMIUM_PATH names another, always sandboxed.
 	chromium.launchPersistentContext(profile, {
-		executablePath: process.env.CHROMIUM_PATH ?? "/usr/bin/chromium",
+		channel: process.env.CHROMIUM_PATH ? undefined : "chromium",
+		executablePath: process.env.CHROMIUM_PATH || undefined,
+		chromiumSandbox: true,
 		headless: true,
 		viewport: { width: 1280, height: 800 },
 		args: [`--disable-extensions-except=${EXT}`, `--load-extension=${EXT}`],
diff --git a/apps/extension/package.json b/apps/extension/package.json
index af31064..7e07c44 100644
--- a/apps/extension/package.json
+++ b/apps/extension/package.json
@@ -5,14 +5,14 @@
 	"description": "BridgeHook browser extension: forward webhooks to localhost",
 	"devDependencies": {
 		"esbuild": "^0.28.2",
-		"playwright": "1.64.0",
+		"playwright": "1.64.1",
 		"vitest": "^5.0.3"
 	},
 	"type": "module",
 	"scripts": {
 		"build:drain": "node scripts/build-drain.mjs",
 		"package": "node scripts/package.mjs",
-		"e2e": "node e2e/release.e2e.mjs",
+		"e2e": "playwright install chromium && node e2e/release.e2e.mjs",
 		"test": "vitest run"
 	}
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 772f045..89ca09b 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -81,8 +81,8 @@ importers:
         specifier: ^0.28.2
         version: 0.28.2
       playwright:
-        specifier: 1.64.0
-        version: 1.64.0
+        specifier: 1.64.1
+        version: 1.64.1
       vitest:
         specifier: ^5.0.3
         version: 5.0.3(@types/node@25.5.2)(vite@6.4.4(@types/node@25.5.2)(jiti@1.21.7)(tsx@4.23.15))
@@ -2556,13 +2556,13 @@ packages:
     resolution: {integrity: sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==}
     engines: {node: '>=16.20.0'}
 
-  playwright-core@1.64.0:
-    resolution: {integrity: sha512-T9r+MZkTECl2+oUcZ26YgZzTrYidTsIhYYkJix+6iDOymOb1FB2RLLSOxRGnZGv5DStt+aduIVbt+E8WygXYpg==}
+  playwright-core@1.64.1:
+    resolution: {integrity: sha512-BC4s8y6SEVA6Q1rSxZTto8hI1KUI3xXlHGZgvGqP4IqPdI/a6FX9H29IDNz7vKo9l21b6LfYosScPL6M3xxyDQ==}
     engines: {node: '>=20'}
     hasBin: true
 
-  playwright@1.64.0:
-    resolution: {integrity: sha512-kVzTnYFYEyQ9RGzBjNCd2+yEqWmVbxl3AHPynv3qQ6JTjv4a+kwRcnqQwIpuP3NnrnIrE/Q6wWAIAvMfIE2/Yg==}
+  playwright@1.64.1:
+    resolution: {integrity: sha512-HCrVhHr5QQuwYoswEUGTb7gGp522yflbv/ST8nF4sFWGuLjQCt17Q/EubpGGSNKYn1tsTCPZxqHhHCfVURu7UA==}
     engines: {node: '>=20'}
     hasBin: true
 
@@ -4890,11 +4890,11 @@ snapshots:
 
   pkce-challenge@5.0.1: {}
 
-  playwright-core@1.64.0: {}
+  playwright-core@1.64.1: {}
 
-  playwright@1.64.0:
+  playwright@1.64.1:
     dependencies:
-      playwright-core: 1.64.0
+      playwright-core: 1.64.1
 
   postal-mime@2.7.4: {}