diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 2dde93b..45028d3 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -42,20 +42,25 @@ jobs:
           tar czf ahfail-linux-x86_64.tar.gz -C dist .
 
       - name: Create Gitea release and upload asset
+        # Requires a GITEA_TOKEN secret with write:repository scope.
+        # Create it in repo Settings → Secrets.
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_URL: https://gitea.weircon.dk
           REPO: agw/gtk-ahfail
           TAG: ${{ github.ref_name }}
         run: |
-          RELEASE_ID=$(curl -s -X POST \
+          set -euo pipefail
+          RELEASE_ID=$(curl -f -X POST \
             "${GITEA_URL}/api/v1/repos/${REPO}/releases" \
             -H "Authorization: token ${GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
             -d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\",\"draft\":false}" \
             | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
 
-          curl -s -X POST \
+          [ -n "${RELEASE_ID}" ] || { echo "ERROR: empty RELEASE_ID from API"; exit 1; }
+
+          curl -f -X POST \
             "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets" \
             -H "Authorization: token ${GITEA_TOKEN}" \
             -F "attachment=@ahfail-linux-x86_64.tar.gz"
diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index b9345b0..c8ce983 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -21,7 +21,8 @@ jobs:
             libpam0g-dev \
             ninja-build \
             python3-pip \
-            libglib2.0-dev
+            libglib2.0-dev \
+            xvfb
           pip3 install meson
 
       - name: Install Rust stable
@@ -36,4 +37,4 @@ jobs:
           meson compile -C builddir
 
       - name: Meson tests
-        run: meson test -C builddir --verbose
+        run: xvfb-run meson test -C builddir --verbose
diff --git a/readme.md b/readme.md
index ecb4a0e..41bdb18 100644
--- a/readme.md
+++ b/readme.md
@@ -81,22 +81,22 @@ sudo cp builddir/ahfail-display /usr/local/lib/ahfail/
 
 ### Configure PAM (macOS)
 
-Add to `/etc/pam.d/screensaver` (requires `sudo`):
+Find your screen locker's PAM service file. On macOS 13+ the screensaver uses `/etc/pam.d/screensaverui`; on older versions it may be `/etc/pam.d/screensaver`. Add the following line after the existing `auth` entries (requires `sudo`):
 
 ```
 auth optional /usr/local/lib/ahfail/libahfail_pam.so
 ```
 
-Place it after the existing `auth` line(s) so it observes the real auth result.
-
 ### Configure PAM (Linux/X11)
 
-Add to `/etc/pam.d/gtklock` (or `i3lock`, `xscreensaver`, etc.):
+Add to `/etc/pam.d/gtklock` (or `i3lock`, `xscreensaver`, etc.). Use the full path because `$(libdir)/ahfail` is not in PAM's default search path:
 
 ```
-auth optional ahfail-pam.so
+auth optional /usr/lib/ahfail/libahfail_pam.so
 ```
 
+On Fedora/RHEL replace `/usr/lib` with `/usr/lib64`.
+
 ## Development
 
 *   **Run Tests:** `cargo test`