diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1968779f..32d4daa4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -75,6 +75,18 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+      # rfd rides into the tree on tauri-plugin-dialog, which pins ^0.16, and we
+      # declare it directly only for the fatal-startup dialog in lib.rs (there is
+      # no AppHandle yet, so the plugin API is unusable at that point). Cargo
+      # unifies features only within a semver-compatible group, so bumping our
+      # direct dep to 0.17 forks rfd in two: the plugin keeps 0.16 with its
+      # backend features, ours gets 0.17 with none, and rfd 0.17's build.rs then
+      # aborts the Linux build demanding `gtk3` or `xdg-portal` (PR #1405). Even
+      # where it links, it just builds rfd twice. Our version must track the
+      # plugin's -- drop this entry once tauri-plugin-dialog moves to 0.17.
+      # Patch updates within 0.16.x still flow through.
+      - dependency-name: "rfd"
+        update-types: ["version-update:semver-minor"]
 
   # GitHub Actions
   - package-ecosystem: github-actions
diff --git a/Client/tauri-client/src-tauri/Cargo.toml b/Client/tauri-client/src-tauri/Cargo.toml
index 99b4cb83..023ff21b 100644
--- a/Client/tauri-client/src-tauri/Cargo.toml
+++ b/Client/tauri-client/src-tauri/Cargo.toml
@@ -93,6 +93,14 @@ zeroize = "1"
 # Encodes the DPAPI ciphertext for the JSON fallback store. Already in the tree
 # via the tauri/rustls stack, so this costs no extra build.
 base64 = "0.22"
+# Native message box for the fatal-startup path in lib.rs, where the Tauri app
+# never built and tauri-plugin-dialog has no AppHandle to run through. Already
+# in the tree via that same plugin, so this costs no extra build -- but only
+# while the versions match: the plugin pins ^0.16, and Cargo unifies features
+# only within a semver-compatible group. Moving this to 0.17 forks rfd into two
+# crates, and the copy without the plugin's backend features fails rfd 0.17's
+# build.rs on Linux. Pinned to the plugin in .github/dependabot.yml; bump both
+# together or neither.
 rfd = { version = "0.16", default-features = false }
 
 # Desktop-only plugins (no mobile bundle target). single-instance carries the