diff --git a/cmake/install_desktop_entry.cmake b/cmake/install_desktop_entry.cmake
index ae71f33..22a41c7 100644
--- a/cmake/install_desktop_entry.cmake
+++ b/cmake/install_desktop_entry.cmake
@@ -16,6 +16,14 @@ else()
   set(data_home "$ENV{HOME}/.local/share")
 endif()
 
+# Fail visibly if both fallback paths are unusable. The script needs a directory to install into;
+# a missing $HOME in a sandboxed CI environment should not silently install to the filesystem root.
+if(NOT DEFINED ENV{XDG_DATA_HOME} OR "$ENV{XDG_DATA_HOME}" STREQUAL "")
+  if(NOT DEFINED ENV{HOME} OR "$ENV{HOME}" STREQUAL "")
+    message(FATAL_ERROR "XDG_DATA_HOME and HOME are both unset or empty; cannot determine install directory")
+  endif()
+endif()
+
 set(apps_dir "${data_home}/applications")
 set(icon_dir "${data_home}/icons/hicolor/scalable/apps")
 set(sym_dir "${data_home}/icons/hicolor/symbolic/apps")
diff --git a/docs/superpowers/plans/2026-10-04-app-icon-and-desktop-entry.md b/docs/superpowers/plans/2026-10-04-app-icon-and-desktop-entry.md
index 9bd4313..52457c7 100644
--- a/docs/superpowers/plans/2026-10-04-app-icon-and-desktop-entry.md
+++ b/docs/superpowers/plans/2026-10-04-app-icon-and-desktop-entry.md
@@ -1030,13 +1030,13 @@ cp data/org.udpscope.app.desktop.in /tmp/entry-backup.in
 sed -i 's/^Type=Application$/Type=Nonsense/' data/org.udpscope.app.desktop.in
 cmake -S . -B build -G Ninja >/dev/null
 cmake --build build --target desktop-entry >/tmp/de.log 2>&1; echo "--- exit=$?"
-tail -4 /tmp/de.log
+grep "desktop-file-validate rejected" /tmp/de.log
 cp /tmp/entry-backup.in data/org.udpscope.app.desktop.in
 cmp /tmp/entry-backup.in data/org.udpscope.app.desktop.in && echo "restore exact"
 rm /tmp/entry-backup.in /tmp/de.log
 ```
 
-Expected: a **non-zero** `exit=`, `desktop-file-validate rejected ...` in the tail, and
+Expected: a **non-zero** `exit=`, the `grep` printing the `desktop-file-validate rejected` message, and
 `restore exact`. If `exit=0` the `RESULT_VARIABLE` check is wrong. The file is untracked at this
 point, so `git diff` cannot verify the restore — `cmp` against the backup is what can.