diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d2a6b94b..5567c4f2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -86,6 +86,15 @@ jobs:
           PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-launcher.py
           PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-plugin-freshness.py
           PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-docs-only.py
+      - name: Allow the unprivileged user namespaces Chromium's sandbox needs
+        run: |
+          # Ubuntu 23.10+ confines unprivileged user namespaces with AppArmor,
+          # so Playwright's Chromium finds no usable sandbox. Lift that on this
+          # throwaway runner rather than rendering with a weakened sandbox.
+          # https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md
+          knob=/proc/sys/kernel/apparmor_restrict_unprivileged_userns
+          test -e "${knob}" || exit 0
+          echo 0 | sudo tee "${knob}" > /dev/null
       - name: Verify optional dashboard runtime and repeat rendering
         run: |
           plugins/screenrig/skills/screenrig-dashboard/scripts/screenrig-dashboard setup > "${RUNNER_TEMP}/dashboard-setup.json"
diff --git a/components.lock.json b/components.lock.json
index 81bc162b..c7640c27 100644
--- a/components.lock.json
+++ b/components.lock.json
@@ -6,7 +6,7 @@
     "commit": "ce737dde6dd179fa5bcbfe2bb2a59ddb266bfa5c",
     "artifact": {
       "file": "screenrig-cli.tgz",
-      "sha256": "e0e06065ee8c44edf094df6174c153b26be5c239677f5d06e78afe406a33ce9c"
+      "sha256": "f5feb909b96467573819bfd6569630e74fdaf708cf22eb74f6de52e8883823e1"
     }
   }
 }
diff --git a/plugins/screenrig/.github/workflows/ci.yml b/plugins/screenrig/.github/workflows/ci.yml
index d2a6b94b..5567c4f2 100644
--- a/plugins/screenrig/.github/workflows/ci.yml
+++ b/plugins/screenrig/.github/workflows/ci.yml
@@ -86,6 +86,15 @@ jobs:
           PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-launcher.py
           PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-plugin-freshness.py
           PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-docs-only.py
+      - name: Allow the unprivileged user namespaces Chromium's sandbox needs
+        run: |
+          # Ubuntu 23.10+ confines unprivileged user namespaces with AppArmor,
+          # so Playwright's Chromium finds no usable sandbox. Lift that on this
+          # throwaway runner rather than rendering with a weakened sandbox.
+          # https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md
+          knob=/proc/sys/kernel/apparmor_restrict_unprivileged_userns
+          test -e "${knob}" || exit 0
+          echo 0 | sudo tee "${knob}" > /dev/null
       - name: Verify optional dashboard runtime and repeat rendering
         run: |
           plugins/screenrig/skills/screenrig-dashboard/scripts/screenrig-dashboard setup > "${RUNNER_TEMP}/dashboard-setup.json"
diff --git a/plugins/screenrig/skills/screenrig-dashboard/references/runtime.md b/plugins/screenrig/skills/screenrig-dashboard/references/runtime.md
index f812d6b8..092c74e0 100644
--- a/plugins/screenrig/skills/screenrig-dashboard/references/runtime.md
+++ b/plugins/screenrig/skills/screenrig-dashboard/references/runtime.md
@@ -33,6 +33,13 @@ SQLite version; an actual render is the browser capability test. Supported-host
 claims require a successful local run. Normal screenRIG commands do not depend
 on this runtime.
 
+Rendering always keeps Chromium's sandbox on. Linux hosts that confine
+unprivileged user namespaces, including Ubuntu 23.10+ under AppArmor and many
+containers, fail at launch with `No usable sandbox`. Grant that browser binary
+user namespaces, through an AppArmor profile or by clearing
+`kernel.apparmor_restrict_unprivileged_userns` on a disposable machine, rather
+than rendering without a sandbox.
+
 Snapshots include a payload digest and separate metadata file. Pass its
 `*.meta.json` path to render for replay. Snapshot queries use one SQLite read
 transaction; corrections are append-only, retaining older record revisions.
diff --git a/skills/screenrig-dashboard/references/runtime.md b/skills/screenrig-dashboard/references/runtime.md
index f812d6b8..092c74e0 100644
--- a/skills/screenrig-dashboard/references/runtime.md
+++ b/skills/screenrig-dashboard/references/runtime.md
@@ -33,6 +33,13 @@ SQLite version; an actual render is the browser capability test. Supported-host
 claims require a successful local run. Normal screenRIG commands do not depend
 on this runtime.
 
+Rendering always keeps Chromium's sandbox on. Linux hosts that confine
+unprivileged user namespaces, including Ubuntu 23.10+ under AppArmor and many
+containers, fail at launch with `No usable sandbox`. Grant that browser binary
+user namespaces, through an AppArmor profile or by clearing
+`kernel.apparmor_restrict_unprivileged_userns` on a disposable machine, rather
+than rendering without a sandbox.
+
 Snapshots include a payload digest and separate metadata file. Pass its
 `*.meta.json` path to render for replay. Snapshot queries use one SQLite read
 transaction; corrections are append-only, retaining older record revisions.