diff --git a/lighthouserc.js b/lighthouserc.js
index 9d44732..d8a2575 100644
--- a/lighthouserc.js
+++ b/lighthouserc.js
@@ -23,6 +23,16 @@ module.exports = {
         // Slow-4G profile so scores are stable across CI runners and
         // comparable to industry public benchmarks.
         preset: 'desktop',
+        // Chrome's user-namespace sandbox is disabled inside the act
+        // runner container (AppArmor restriction on the host kernel),
+        // so Chrome fails to launch with a "No usable sandbox" zygote
+        // error. `--no-sandbox` is the standard Lighthouse / Puppeteer
+        // / Playwright workaround for containerised CI: the residual
+        // risk is acceptable because Chrome only loads our own freshly
+        // built bundle from http://localhost:4200/ inside an ephemeral
+        // self-hosted runner container — no untrusted content reaches
+        // the browser process.
+        chromeFlags: '--no-sandbox',
       },
     },
     assert: {