diff --git a/debian-live-config/config/hooks/normal/9999-wrolpi.hook.chroot b/debian-live-config/config/hooks/normal/9999-wrolpi.hook.chroot
index d20644f2..ed9e7d4f 100644
--- a/debian-live-config/config/hooks/normal/9999-wrolpi.hook.chroot
+++ b/debian-live-config/config/hooks/normal/9999-wrolpi.hook.chroot
@@ -207,6 +207,53 @@ autologin-session=xfce
 EOF
 
 mkdir -p /home/wrolpi/Desktop
+
+# Desktop shortcuts to WROLPi's HTTPS services and the on-drive media
+# directory.  Type=Link entries dispatch via xdg-open, which sidesteps
+# XFCE's executable-launcher trust check (the check only applies to
+# Type=Application entries with an Exec field).  All URLs go through
+# Caddy on localhost, configured in /etc/caddy/Caddyfile.
+cat > /home/wrolpi/Desktop/wrolpi-app.desktop <<'EOF'
+[Desktop Entry]
+Encoding=UTF-8
+Name=WROLPi
+Type=Link
+URL=https://localhost/
+Icon=/opt/wrolpi/icon.png
+EOF
+cat > /home/wrolpi/Desktop/wrolpi-controller.desktop <<'EOF'
+[Desktop Entry]
+Encoding=UTF-8
+Name=WROLPi Controller
+Type=Link
+URL=https://localhost/controller/
+Icon=/opt/wrolpi/etc/raspberrypios/controller-logo.png
+EOF
+cat > /home/wrolpi/Desktop/wrolpi-help.desktop <<'EOF'
+[Desktop Entry]
+Encoding=UTF-8
+Name=WROLPi Help
+Type=Link
+URL=https://localhost:8086/
+Icon=help-browser
+EOF
+cat > /home/wrolpi/Desktop/wrolpi-kiwix.desktop <<'EOF'
+[Desktop Entry]
+Encoding=UTF-8
+Name=Kiwix Library
+Type=Link
+URL=https://localhost:8085/
+Icon=accessories-dictionary
+EOF
+cat > /home/wrolpi/Desktop/wrolpi-files.desktop <<'EOF'
+[Desktop Entry]
+Encoding=UTF-8
+Name=WROLPi Files
+Type=Link
+URL=file:///media/wrolpi/
+Icon=folder
+EOF
+
 chown -R wrolpi:wrolpi /home/wrolpi/Desktop
 
 # Drop the default Postgres cluster created by the postgresql-* package.
diff --git a/debian-live-config/config/includes.chroot/etc/xdg/autostart/wrolpi-trust-desktop-icons.desktop b/debian-live-config/config/includes.chroot/etc/xdg/autostart/wrolpi-trust-desktop-icons.desktop
new file mode 100644
index 00000000..f91ba233
--- /dev/null
+++ b/debian-live-config/config/includes.chroot/etc/xdg/autostart/wrolpi-trust-desktop-icons.desktop
@@ -0,0 +1,11 @@
+[Desktop Entry]
+Type=Application
+Name=WROLPi Trust Desktop Icons
+Comment=Mark all desktop launchers as trusted so XFCE will launch them
+Exec=/usr/local/bin/wrolpi-trust-desktop-icons
+TryExec=/usr/local/bin/wrolpi-trust-desktop-icons
+Icon=dialog-information
+Terminal=false
+Categories=System;
+NoDisplay=true
+X-GNOME-Autostart-enabled=true
diff --git a/debian-live-config/config/includes.chroot/usr/local/bin/wrolpi-trust-desktop-icons b/debian-live-config/config/includes.chroot/usr/local/bin/wrolpi-trust-desktop-icons
new file mode 100755
index 00000000..14b9ffa6
--- /dev/null
+++ b/debian-live-config/config/includes.chroot/usr/local/bin/wrolpi-trust-desktop-icons
@@ -0,0 +1,28 @@
+#!/bin/sh
+# Mark every .desktop file in ~/Desktop as trusted so XFCE will actually
+# launch it on double-click.  XFCE Bookworm requires trust metadata
+# (metadata::trusted + metadata::xfce-exe-checksum) even for Type=Link
+# entries.
+#
+# Runs at user session start via /etc/xdg/autostart/.  Idempotent — safe
+# to re-run; gio set is a no-op if the metadata already matches.
+#
+# Requires gvfs (for the metadata service that `gio set` talks to).
+
+LOG=/tmp/wrolpi-trust-desktop-icons.log
+exec >>"$LOG" 2>&1
+echo "===== $(date) invoked (user=$(id -un)) ====="
+
+DESKTOP="$HOME/Desktop"
+[ -d "$DESKTOP" ] || exit 0
+
+for f in "$DESKTOP"/*.desktop; do
+  [ -f "$f" ] || continue
+  gio set --type=string "$f" metadata::trusted true 2>&1 || true
+  gio set --type=string "$f" metadata::xfce-exe-checksum \
+      "$(sha256sum "$f" | cut -d' ' -f1)" 2>&1 || true
+  touch "$f"
+  echo "trusted: $f"
+done
+
+echo "done"