diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d24aed0..bacaced 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,5 +98,20 @@ jobs:
       - name: Set up Chrome
         uses: browser-actions/setup-chrome@v1
 
+      # Ubuntu 24.04 (current ubuntu-latest) restricts unprivileged user
+      # namespaces via AppArmor, which stops headless Chrome from starting even
+      # with --no-sandbox: the process launches but never opens its DevTools
+      # socket. Re-enable them so the driver's Chrome can come up.
+      - name: Allow Chrome under unprivileged user namespaces
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+
+      # Fail here with Chrome's own stderr if the browser can't launch, instead
+      # of letting the driver report an opaque DevTools timeout downstream.
+      - name: Verify headless Chrome starts
+        run: |
+          chrome --version
+          chrome --headless --no-sandbox --disable-gpu --disable-dev-shm-usage \
+            --dump-dom 'data:text/html,<title>ok</title>'
+
       - name: Drive web fixtures through headless Chrome
         run: make test-browser