diff --git a/services/wolf.sh b/services/wolf.sh
index 30c926b..50191af 100644
--- a/services/wolf.sh
+++ b/services/wolf.sh
@@ -1742,7 +1742,16 @@ CATALOG = {
                 f'{games}/retro-home-data:/home/retro/.local/share:rw',
                 f'{games}/emulators:/mnt/games/emulators:rw',
                 f'{games}/emulators:/home/retro/Applications:rw'],
-        env=STD_ENV, cap_add=STD_CAP, security_opt=[], ipc_mode='host',
+        # ghcr.io/games-on-whales/xfce has no libfuse2/libfuse3 at all (checked
+        # against its own Dockerfile) and, unlike es-de's own Dockerfile
+        # (which sets this exact env var for the same reason), no fallback
+        # either — confirmed live: launching an AppImage (Cemu) straight from
+        # this container failed outright with the standard "AppImages require
+        # FUSE to run" error. APPIMAGE_EXTRACT_AND_RUN=1 makes every AppImage
+        # self-extract into a temp dir and run from there instead of trying
+        # to FUSE-mount itself, matching what already makes AppImages work
+        # fine when ES-DE launches them.
+        env=STD_ENV + ['APPIMAGE_EXTRACT_AND_RUN=1'], cap_add=STD_CAP, security_opt=[], ipc_mode='host',
         ulimits=[], privileged=False,
     ),
 }
@@ -3194,7 +3203,16 @@ CATALOG = {
                 f'{games}/retro-home-data:/home/retro/.local/share:rw',
                 f'{games}/emulators:/mnt/games/emulators:rw',
                 f'{games}/emulators:/home/retro/Applications:rw'],
-        env=STD_ENV, cap_add=STD_CAP, security_opt=[], ipc_mode='host',
+        # ghcr.io/games-on-whales/xfce has no libfuse2/libfuse3 at all (checked
+        # against its own Dockerfile) and, unlike es-de's own Dockerfile
+        # (which sets this exact env var for the same reason), no fallback
+        # either — confirmed live: launching an AppImage (Cemu) straight from
+        # this container failed outright with the standard "AppImages require
+        # FUSE to run" error. APPIMAGE_EXTRACT_AND_RUN=1 makes every AppImage
+        # self-extract into a temp dir and run from there instead of trying
+        # to FUSE-mount itself, matching what already makes AppImages work
+        # fine when ES-DE launches them.
+        env=STD_ENV + ['APPIMAGE_EXTRACT_AND_RUN=1'], cap_add=STD_CAP, security_opt=[], ipc_mode='host',
         ulimits=[], privileged=False,
     ),
 }
@@ -3359,7 +3377,13 @@ PYEOF
         # Nothing else to do for Steam storage: Wolf's state folder lives on the
         # game drive, so Steam installs, games, and Proton prefixes land there
         # automatically the first time you connect. No fix-perms, no symlinks.
-        if echo "$APP_KEYS" | grep -qw steam; then
+        # _APP_KEYS, not APP_KEYS — this install-time copy uses the
+        # underscore-prefixed name (set earlier in install_wolf()); APP_KEYS
+        # is manage.sh's own copy's variable name. Confirmed live: this was
+        # a silent no-op under 'set -u' without 'set -e' (bash prints
+        # "APP_KEYS: unbound variable" and just continues), so the Steam
+        # storage-location message never printed but nothing else broke.
+        if echo "$_APP_KEYS" | grep -qw steam; then
             log_success "Steam will install games to $WOLF_STATE_DIR (on the game drive)"
         fi
     else