diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b52068..1012d4f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -91,10 +91,11 @@ jobs:
       - name: Cache cargo build
         uses: Swatinem/rust-cache@v2
 
-      # aws-lc-sys (pulled transitively by the rustls stack) needs cmake +
-      # nasm to build its assembly on Linux x86_64.
+      # aws-lc-sys (rustls stack) needs cmake + nasm; libdbus-1-dev +
+      # pkg-config are needed by libdbus-sys, pulled in by the keyring
+      # Secret Service backend on Linux.
       - name: Install build tools
-        run: sudo apt-get update && sudo apt-get install -y cmake nasm
+        run: sudo apt-get update && sudo apt-get install -y cmake nasm libdbus-1-dev pkg-config
 
       - name: Build CLI (lean, no GUI)
         run: cargo build --release -p tutabridge
diff --git a/packaging/aur/PKGBUILD b/packaging/aur/PKGBUILD
index 0d7006f..699819d 100644
--- a/packaging/aur/PKGBUILD
+++ b/packaging/aur/PKGBUILD
@@ -11,8 +11,8 @@ pkgdesc="Local IMAP/SMTP bridge for Tuta encrypted email (headless CLI/daemon)"
 arch=('x86_64' 'aarch64')
 url="https://github.com/spartanz51/tutabridge"
 license=('GPL-3.0-or-later')
-depends=('gcc-libs')
-makedepends=('rust' 'cargo' 'git' 'cmake' 'nasm')
+depends=('gcc-libs' 'dbus')
+makedepends=('rust' 'cargo' 'git' 'cmake' 'nasm' 'dbus' 'pkgconf')
 optdepends=('gnome-keyring: persist the Tuta session across reboots (Secret Service)'
             'kwallet: alternative Secret Service provider')
 provides=('tutabridge')
diff --git a/packaging/aur/README.md b/packaging/aur/README.md
index 31fd381..c845ab0 100644
--- a/packaging/aur/README.md
+++ b/packaging/aur/README.md
@@ -45,7 +45,10 @@ git commit -m "Initial import" && git push
 
 - `pkgver()` derives `0.r<commits>.<short-sha>` from git; `makepkg` rewrites the
   `pkgver=` line on each build.
-- Linux secret-service (keyring persistence) needs a running provider
+- The keyring Secret Service backend links system `libdbus` (via
+  `libdbus-sys`), so `dbus` is a build + runtime dependency. It's present on
+  essentially every Linux desktop already.
+- Keyring *persistence* additionally needs a running Secret Service provider
   (gnome-keyring / kwallet) — listed as optdepends. Without one the daemon
   still works but will ask for the Tuta password on every start.
 - A future tagged release can add a non-`-git` `tutabridge` package built from