diff --git a/README.md b/README.md
index 1c68e3d05..ebc06f90f 100644
--- a/README.md
+++ b/README.md
@@ -133,17 +133,21 @@ These were confirmed by inspecting the v26.05 package (`opt/O3DE/26.05/…`):
   home path, so it can only be created at runtime.
 - **The editable-install patch.** O3DE installs its own `o3de` CLI with
   `pip install -e`, which writes an `egg-info` next to the source under read-only
-  `/app` and fails. The build patches `cmake/LYPython.cmake` to use a normal
-  (non-editable) install, which builds in a temp dir and lands in the `~/.o3de`
-  venv. If a future O3DE release renames that variable, the build prints a warning
-  and Python setup will fail at runtime — that's the line to re-check.
+  `/app` and fails. The build patches `cmake/LYPython.cmake` to drop the `-e`, so
+  it's a normal install (built in a temp dir, landing in the writable `~/.o3de`
+  venv). If a future O3DE release changes that pip command, the build prints a
+  warning and Python setup will fail at runtime — that's the line to re-check.
 - **Other runtime writes into the install tree may still fail.** Anything else
   O3DE tries to generate *inside* `/opt/O3DE/...` at runtime (e.g. certain per-gem
   Python deps, or the engine-level asset cache) hits the read-only `/app`. Project
   data lives in your writable home dir, so normal project work should be fine;
   this is the main remaining open risk.
-- **Launcher icon** is shipped as `org.o3de.O3DE.png` (the `.deb` itself contains
-  only in-editor asset icons, none suitable as an app icon).
+- **Launcher icon.** Shipped as `org.o3de.O3DE.png` (the `.deb` itself has only
+  in-editor asset icons). It's kept *inside* the app so the running window/taskbar
+  shows it, but removed from the *exported* set because `flatpak build-export`
+  validates exported icons in a bwrap sandbox that fails in an unprivileged
+  container. Consequence: the host menu launcher icon is generic. A privileged
+  runner would let us export it properly.
 - **GPU / drivers:** the renderer needs working GPU access. The manifest grants
   `--device=dri`/`--device=all`; on some setups you may also want the matching
   GPU driver extension from Flathub.
diff --git a/org.o3de.O3DE.yaml b/org.o3de.O3DE.yaml
index 0956020cc..367d45679 100644
--- a/org.o3de.O3DE.yaml
+++ b/org.o3de.O3DE.yaml
@@ -43,10 +43,10 @@ modules:
       - |
         set -e
         LYPYTHON=$(find "${FLATPAK_DEST}/opt/O3DE" -path '*/cmake/LYPython.cmake' | head -n1)
-        if [ -n "$LYPYTHON" ] && grep -q 'set(_pip_install_mode_args "-e")' "$LYPYTHON"; then
-          sed -i 's/set(_pip_install_mode_args "-e")/set(_pip_install_mode_args "")/' "$LYPYTHON"
+        if [ -n "$LYPYTHON" ] && grep -qF -- '-m pip install -e ' "$LYPYTHON"; then
+          sed -i 's/-m pip install -e /-m pip install /g' "$LYPYTHON"
         else
-          echo "::warning:: editable-install line not found in LYPython.cmake"
+          echo "::warning:: 'pip install -e' not found in LYPython.cmake"
         fi
       # Launcher + AppStream + desktop entry under the Flatpak app-id.
       - install -Dm755 o3de-wrapper.sh "${FLATPAK_DEST}/bin/o3de-wrapper.sh"
diff --git a/scripts/make-flatpak.sh b/scripts/make-flatpak.sh
index e0a6f19a4..c73321261 100755
--- a/scripts/make-flatpak.sh
+++ b/scripts/make-flatpak.sh
@@ -37,11 +37,11 @@ echo ">> patching the editable pip install (read-only /app workaround)"
 # and installs into the writable ~/.o3de venv. (Nothing Python-related needs to
 # be baked into the image; it all lives per-user under ~/.o3de.)
 LYPYTHON=$(find "$DEST/opt/O3DE" -path '*/cmake/LYPython.cmake' | head -n1)
-if [ -n "$LYPYTHON" ] && grep -q 'set(_pip_install_mode_args "-e")' "$LYPYTHON"; then
-  sed -i 's/set(_pip_install_mode_args "-e")/set(_pip_install_mode_args "")/' "$LYPYTHON"
+if [ -n "$LYPYTHON" ] && grep -qF -- '-m pip install -e ' "$LYPYTHON"; then
+  sed -i 's/-m pip install -e /-m pip install /g' "$LYPYTHON"
   echo "   patched: $LYPYTHON"
 else
-  echo "   WARNING: editable-install line not found in LYPython.cmake; O3DE layout may have changed" >&2
+  echo "   WARNING: 'pip install -e' not found in LYPython.cmake; O3DE layout may have changed" >&2
 fi
 
 echo ">> installing launcher + metadata"
@@ -65,6 +65,12 @@ flatpak build-finish build-dir \
   --env=QT_QPA_PLATFORM=xcb
 
 echo ">> export to OSTree repo"
+# flatpak build-export validates exported app icons in a bwrap sandbox, which
+# fails in an unprivileged container ("is not a valid icon: bwrap ..."). The
+# icon stays inside the app (so the running window/taskbar shows it); we just
+# drop it from the *exported* set so export skips validation. Trade-off: the
+# host menu launcher icon is generic. (A privileged runner would avoid this.)
+rm -rf build-dir/export/share/icons
 flatpak build-export repo build-dir "$BRANCH"
 flatpak build-update-repo repo --title="O3DE (unofficial Flatpak)" --prune --prune-depth=1