diff --git a/debian/rules b/debian/rules
index 10beb6f..ab24138 100755
--- a/debian/rules
+++ b/debian/rules
@@ -23,6 +23,11 @@ override_dh_auto_install:
 	    debian/authforge-gui/usr/share/applications/io.dangerousthings.AuthForge.desktop
 	install -D -m 0644 gui/data/io.dangerousthings.AuthForge.svg \
 	    debian/authforge-gui/usr/share/icons/hicolor/scalable/apps/io.dangerousthings.AuthForge.svg
+	# First-run autostart entry (Phase 10): runs `authforge --first-run`
+	# at GNOME session start; binary exits ~immediately when no pending
+	# flag is set, so the per-session cost is one D-Bus round-trip.
+	install -D -m 0644 gui/data/authforge-firstrun.desktop \
+	    debian/authforge-gui/etc/xdg/autostart/authforge-firstrun.desktop
 	# PAM
 	$(MAKE) -C pam install DESTDIR=$(CURDIR)/debian/authforge-pam
 	# D-Bus activation file
diff --git a/gui/data/authforge-firstrun.desktop b/gui/data/authforge-firstrun.desktop
new file mode 100644
index 0000000..6ed155f
--- /dev/null
+++ b/gui/data/authforge-firstrun.desktop
@@ -0,0 +1,9 @@
+[Desktop Entry]
+Type=Application
+Name=AuthForge First-Run Setup
+Comment=Prompts new users to enroll a security key.
+Exec=authforge --first-run
+NoDisplay=true
+OnlyShowIn=GNOME;
+X-GNOME-Autostart-Phase=Initialization
+X-GNOME-Autostart-enabled=true