diff --git a/scripts/install-session.sh b/scripts/install-session.sh
index 3417b1b..c892eb6 100755
--- a/scripts/install-session.sh
+++ b/scripts/install-session.sh
@@ -20,11 +20,13 @@ if [ -x "/opt/local/bin/singularity-labwc-session" ]; then
 else
     BIN="$TARGET_HOME/.local/singularity/bin"
     LIB="$TARGET_HOME/.local/singularity/lib"
+    LIBEXEC="$TARGET_HOME/.local/singularity/libexec"
     LAUNCHER="$BIN/singularity-session"
 
     cat > "$LAUNCHER" << LAUNCHER_EOF
 #!/bin/bash
 BIN="$BIN"
+LIBEXEC="$LIBEXEC"
 export PATH="\$BIN:\$PATH"
 export LD_LIBRARY_PATH="$LIB\${LD_LIBRARY_PATH:+:\$LD_LIBRARY_PATH}"
 STATE="\${XDG_STATE_HOME:-\$HOME/.local/state}/singularity"
@@ -34,7 +36,16 @@ LOG="\$STATE/session.log"
 exec > "\$LOG" 2>&1
 echo "[\$(date)] Starting Singularity session"
 
-nohup "\$BIN/singularity-polkit-agent" >> "\$STATE/polkit.log" 2>&1 &
+# meson installs the polkit agent to libexecdir; deploy-to-host.sh flattens it
+# into bindir. Prefer libexec, fall back to bin, then to \$PATH.
+if [ -x "\$LIBEXEC/singularity-polkit-agent" ]; then
+    _polkit_agent="\$LIBEXEC/singularity-polkit-agent"
+elif [ -x "\$BIN/singularity-polkit-agent" ]; then
+    _polkit_agent="\$BIN/singularity-polkit-agent"
+else
+    _polkit_agent="\$(command -v singularity-polkit-agent 2>/dev/null || printf '%s' "\$LIBEXEC/singularity-polkit-agent")"
+fi
+nohup "\$_polkit_agent" >> "\$STATE/polkit.log" 2>&1 &
 
 if [ -n "\$GDM_SESSION_DBUS_ADDRESS" ] && [ -x "/usr/libexec/gdm-wayland-session" ]; then
     echo "GDM detected - wrapping with gdm-wayland-session"
diff --git a/src/singularity-desktop-session b/src/singularity-desktop-session
index 6a602e1..3a7eb53 100755
--- a/src/singularity-desktop-session
+++ b/src/singularity-desktop-session
@@ -4,6 +4,20 @@ BIN="$(dirname "$SELF")"
 PREFIX="$(dirname "$BIN")"
 LIB="$PREFIX/lib"
 SHARE="$PREFIX/share"
+LIBEXEC="$PREFIX/libexec"
+
+# Resolve an installed helper. meson installs some helpers (the polkit agent and
+# its auth helper) to libexecdir, while scripts/deploy-to-host.sh flattens them
+# into bindir. Prefer libexec, fall back to bin, then to $PATH.
+singularity_helper() {
+    if [ -x "$LIBEXEC/$1" ]; then
+        printf '%s\n' "$LIBEXEC/$1"
+    elif [ -x "$BIN/$1" ]; then
+        printf '%s\n' "$BIN/$1"
+    else
+        command -v "$1" 2>/dev/null || printf '%s\n' "$LIBEXEC/$1"
+    fi
+}
 
 export LD_LIBRARY_PATH="$LIB${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
 export PATH="$BIN:$PATH"
@@ -57,7 +71,7 @@ pkill -TERM -x singularity-desktop 2>/dev/null || true
 pkill -x singularity-polkit-agent 2>/dev/null || true
 pkill -TERM -x ush-broker 2>/dev/null || true
 sleep 0.3
-nohup "$BIN/singularity-polkit-agent" >> "$_STATE/polkit.log" 2>&1 &
+nohup "$(singularity_helper singularity-polkit-agent)" >> "$_STATE/polkit.log" 2>&1 &
 if [ -x "$BIN/ush-broker" ]; then
     nohup "$BIN/ush-broker" >> "$_STATE/ush-broker.log" 2>&1 &
 fi