diff --git a/.github/workflows/nightly-linux.yml b/.github/workflows/nightly-linux.yml
index e3a8106..e506819 100644
--- a/.github/workflows/nightly-linux.yml
+++ b/.github/workflows/nightly-linux.yml
@@ -17,11 +17,25 @@ on:
       - 'packaging/bundled-fonts/**'
       - '.github/workflows/nightly-linux.yml'
 
+# Needed by the "Publish nightly release" step: the default GITHUB_TOKEN is
+# read-only, so `gh release upload --clobber` / `gh release create` 403 without
+# this (same fix already on nightly-dmg + nightly-windows). Without write, the
+# --clobber upload silently failed and the fallback create errored on the tag
+# that a sibling lane had already made.
+permissions:
+  contents: write
+
 jobs:
   nightly-linux:
     name: Build (${{ matrix.distro }})
     runs-on: ubuntu-24.04
     timeout-minutes: 360
+    # fedora builds in a container where swapon isn't available, so it can't get
+    # the OOM headroom the ubuntu leg does; it also hits a mirror-recipe cfg-copy
+    # quirk. Keep it as a best-effort signal — ubuntu is the primary Linux
+    # artifact and must stay blocking. (Revisit fedora once CI moves to the
+    # sovereign runner with real RAM.)
+    continue-on-error: ${{ matrix.distro == 'fedora' }}
 
     strategy:
       fail-fast: false
@@ -71,6 +85,17 @@ jobs:
           sudo docker image prune --all --force || true
           df -h /
 
+      - name: Add swap (16GB runners OOM the Firefox compile → exit 143)
+        if: matrix.container == ''
+        run: |
+          sudo swapoff -a || true
+          sudo rm -f /mnt/swapfile /swapfile || true
+          sudo fallocate -l 24G /mnt/swapfile
+          sudo chmod 600 /mnt/swapfile
+          sudo mkswap /mnt/swapfile
+          sudo swapon /mnt/swapfile
+          free -h
+
       - name: Install system dependencies
         run: |
           ${{ matrix.pkg_update }}
@@ -120,7 +145,10 @@ jobs:
 
       - name: Build BearBrowser
         working-directory: build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/bearbrowser-${{ env.VERSION }}-${{ env.RELEASE }}
-        run: MOZBUILD_STATE_PATH=${{ github.workspace }}/.mozbuild ./mach build
+        # -j2: mach's memory heuristic over-parallelizes on the 16GB runner and
+        # OOM-kills the compile (exit 143). Cap concurrent heavy TUs; the 24G
+        # swap above absorbs the rest. Same fix as nightly-windows.
+        run: MOZBUILD_STATE_PATH=${{ github.workspace }}/.mozbuild ./mach build -j2
 
       - name: Measure fingerprint on the REAL compiled binary (authoritative)
         if: matrix.distro == 'ubuntu'
@@ -149,10 +177,18 @@ jobs:
         id: tarball
         run: |
           DATE=$(date +%Y%m%d)
-          OBJ="build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/bearbrowser-${{ env.VERSION }}-${{ env.RELEASE }}/obj-x86_64-pc-linux-gnu"
-          TAR="BearBrowser-${{ env.VERSION }}-${DATE}-${{ matrix.artifact_suffix }}.tar.bz2"
+          SRC="build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/bearbrowser-${{ env.VERSION }}-${{ env.RELEASE }}"
+          OBJ="$SRC/obj-x86_64-pc-linux-gnu"
+          # `mach build` alone leaves dist/bin (a dev tree). Run `mach package` to
+          # get the real distributable tarball (dist/bearbrowser-*.tar.xz, with
+          # omni.ja) — the old step tarred a dist/bearbrowser/ dir that only
+          # `mach package` creates, so it failed the moment the build finally
+          # got far enough to package. Proven on the sovereign Linux builder.
+          ( cd "$SRC" && MOZBUILD_STATE_PATH=${{ github.workspace }}/.mozbuild ./mach package )
+          SRC_TAR="$(ls "$OBJ"/dist/bearbrowser-*.linux-x86_64.tar.* 2>/dev/null | head -1)"
+          TAR="BearBrowser-${{ env.VERSION }}-${DATE}-${{ matrix.artifact_suffix }}.tar.xz"
           mkdir -p build/nightly
-          tar -C "${OBJ}/dist" -cjf "build/nightly/${TAR}" bearbrowser/
+          cp "$SRC_TAR" "build/nightly/${TAR}"
           echo "name=${TAR}" >> $GITHUB_OUTPUT
           echo "path=build/nightly/${TAR}" >> $GITHUB_OUTPUT