diff --git a/pkgs/tome-deps.json b/pkgs/tome-deps.json
index 5c356a1..945a4aa 100644
--- a/pkgs/tome-deps.json
+++ b/pkgs/tome-deps.json
@@ -41,23 +41,23 @@
   },
   {
     "pname": "Microsoft.AspNetCore.App.Ref",
-    "version": "8.0.27",
-    "hash": "sha256-nwBrMFATFwpJS1iq9Bf+vvWQ1dDGergMuY809tUqo60="
+    "version": "8.0.29",
+    "hash": "sha256-0wK5Lsa4a1ani/gvSzsqyuY3R4MBuH/9XOyZeWCUWoU="
   },
   {
     "pname": "Microsoft.AspNetCore.App.Ref",
-    "version": "9.0.16",
-    "hash": "sha256-lBbgyPyZOrPsRMtd0UOHJuB5dbMQFysVIk4RAFx2Rk0="
+    "version": "9.0.18",
+    "hash": "sha256-0qkb9Gbxlyyw8rKxDTm9OqdW89DIi1qolGK85HLwc2k="
   },
   {
     "pname": "Microsoft.AspNetCore.App.Runtime.linux-x64",
-    "version": "8.0.27",
-    "hash": "sha256-7DX4XBTx8a6sFRnTrJ3zJhJzQVC81OwzOZnYOo+nO20="
+    "version": "8.0.29",
+    "hash": "sha256-iiDWZa7MkybKwozVKIV4Eq0PGzirxeyjFLnoxPyAHiQ="
   },
   {
     "pname": "Microsoft.AspNetCore.App.Runtime.linux-x64",
-    "version": "9.0.16",
-    "hash": "sha256-JDdPuh01rffoWnKekJU34/QKWFFnyTljmqq6DM5vYs8="
+    "version": "9.0.18",
+    "hash": "sha256-ETNi+pMo8nNSgHMLKgi/VFMla/duHI2CQlJlm1FdyKc="
   },
   {
     "pname": "Microsoft.Bcl.TimeProvider",
@@ -216,33 +216,33 @@
   },
   {
     "pname": "Microsoft.NETCore.App.Host.linux-x64",
-    "version": "8.0.27",
-    "hash": "sha256-ZI5ByoSqJIcQAnH1dyGcK8uyvPB7yUNznD6BLY2V8Hs="
+    "version": "8.0.29",
+    "hash": "sha256-T/eXkzT3V3T1Yasc1cUZ/jLOWJY3zp/GxJTCT24gnAw="
   },
   {
     "pname": "Microsoft.NETCore.App.Host.linux-x64",
-    "version": "9.0.16",
-    "hash": "sha256-HaIx6pwpKUwdseu3tOhuVtqnpGCubhWbi9BEvijHd+M="
+    "version": "9.0.18",
+    "hash": "sha256-h36uAGfY36RKon6QU3lP3tsVlMVZ842lvdGiLcHO7Ko="
   },
   {
     "pname": "Microsoft.NETCore.App.Ref",
-    "version": "8.0.27",
-    "hash": "sha256-F/FL0ptluwCfxN4S93/UAKs4fRtyL+D4NoSPc5CGyJo="
+    "version": "8.0.29",
+    "hash": "sha256-dxAuEUU1VOElQ4CpL9HLhV4KVFtRDAcZS8W0GT2Di6g="
   },
   {
     "pname": "Microsoft.NETCore.App.Ref",
-    "version": "9.0.16",
-    "hash": "sha256-VLwChaPID3roiQw6qU8IuPaUOPAHl3wzCIjVtG4D6ZM="
+    "version": "9.0.18",
+    "hash": "sha256-ZFU4lXz/BjJiqU4sykZEYR5j5e745KMf4ZPo0GHnicU="
   },
   {
     "pname": "Microsoft.NETCore.App.Runtime.linux-x64",
-    "version": "8.0.27",
-    "hash": "sha256-GejthwcyJAmNTFvWEZXis6lRM2sJyNrKHYsq79Fn/WI="
+    "version": "8.0.29",
+    "hash": "sha256-eA5x9NMfCg6JhRmOKKqfBL8+TwtQW/1ONvJeANPJOFA="
   },
   {
     "pname": "Microsoft.NETCore.App.Runtime.linux-x64",
-    "version": "9.0.16",
-    "hash": "sha256-3nDEdBN1jHIy2PiLffnE4+Snt7MiGP2hEDEi924DXww="
+    "version": "9.0.18",
+    "hash": "sha256-DV5iYmqH8j7JIcem8Qu/HLbZuHPVmaTTQuZc8OoDZBk="
   },
   {
     "pname": "Microsoft.SourceLink.Common",
diff --git a/pkgs/tome.nix b/pkgs/tome.nix
index 6d03595..7ca758d 100644
--- a/pkgs/tome.nix
+++ b/pkgs/tome.nix
@@ -3,11 +3,13 @@
 , buildNpmPackage
 , importNpmLock
 , dotnetCorePackages
+, glib
 , gtk3
 , webkitgtk_4_1
 , libnotify
 , makeDesktopItem
 , copyDesktopItems
+, wrapGAppsHook3
 , src
 }:
 
@@ -45,15 +47,29 @@ buildDotnetModule (finalAttrs: {
   nugetDeps = ./tome-deps.json;
 
   dotnet-sdk = dotnetCorePackages.sdk_10_0;
-  dotnet-runtime = dotnetCorePackages.runtime_10_0;
+  # aspnetcore_10_0, not runtime_10_0: Tome.App's runtimeconfig.json requires
+  # both Microsoft.NETCore.App AND Microsoft.AspNetCore.App (Photino hosts a
+  # local Kestrel server), and only the aspnetcore bundle ships the latter.
+  dotnet-runtime = dotnetCorePackages.aspnetcore_10_0;
 
   dotnetFlags = [ "-p:SkipNpmBuild=true" ];
 
   executables = [ "Tome.App" ];
 
-  nativeBuildInputs = [ copyDesktopItems ];
+  # wrapGAppsHook3: buildDotnetModule sets dontWrapGApps = true by default (to
+  # avoid double-wrapping) but its own wrap step still splices gappsWrapperArgs
+  # in when the hook is present (see nixpkgs' libation package, same pattern).
+  # Without it the binary never gets XDG_DATA_DIRS/GSETTINGS_SCHEMA_DIR set, so
+  # GTK/WebKitGTK can't find the icon theme or GTK settings from the desktop
+  # session — symptoms: missing icons and a denser default UI font/size than
+  # when launched from an already-fully-initialized session (e.g. via Rider).
+  nativeBuildInputs = [ copyDesktopItems wrapGAppsHook3 ];
 
   runtimeDeps = [
+    # glib: not pulled in via gtk3/webkitgtk's own RPATH here, because the
+    # thing that needs it — Photino.Native.so — is a prebuilt binary shipped
+    # in the Photino.Native nuget package, not something Nix built/patched.
+    glib
     gtk3
     webkitgtk_4_1
     libnotify