diff --git a/apps/desktop/scripts/bundle-electron-main.mjs b/apps/desktop/scripts/bundle-electron-main.mjs
index 135843f..0cce6d0 100644
--- a/apps/desktop/scripts/bundle-electron-main.mjs
+++ b/apps/desktop/scripts/bundle-electron-main.mjs
@@ -10,9 +10,10 @@
 // `electron` and `node-pty` are external (provided by the runtime / staged
 // separately via stage-native-deps).
 import { build } from 'esbuild'
+import { createRequire } from 'node:module'
 import { resolve, dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { mkdirSync, cpSync } from 'node:fs'
+import { mkdirSync, cpSync, existsSync } from 'node:fs'
 
 const here = dirname(fileURLToPath(import.meta.url))
 const root = resolve(here, '..')
@@ -70,7 +71,18 @@ mkdirSync(resolve(distDir, 'mobile'), { recursive: true })
 for (const name of ['transport.mjs', 'peer-identity.mjs', 'style.css', 'qr.mjs']) {
   cpSync(resolve(root, '../mobile/src', name), resolve(distDir, 'mobile', name))
 }
+// A clean `npm ci` hoists the mobile vendor packages to the workspace root, so
+// look them up along Node's resolution path from apps/mobile instead of
+// assuming apps/mobile/node_modules exists.
+const mobileRequire = createRequire(resolve(root, '../mobile/package.json'))
+function mobilePackageDir(name) {
+  for (const base of mobileRequire.resolve.paths(name) ?? []) {
+    const dir = resolve(base, name)
+    if (existsSync(resolve(dir, 'package.json'))) return dir
+  }
+  throw new Error(`${name} is not installed for apps/mobile; run npm ci at the repository root`)
+}
 mkdirSync(resolve(distDir, 'mobile/vendor'), { recursive: true })
-cpSync(resolve(root, '../mobile/node_modules/qrcode-generator/dist/qrcode.mjs'), resolve(distDir, 'mobile/vendor/qrcode.mjs'))
-cpSync(resolve(root, '../mobile/node_modules/jsqr/dist/jsQR.js'), resolve(distDir, 'mobile/vendor/jsQR.js'))
-cpSync(resolve(root, '../mobile/node_modules/jsqr/LICENSE'), resolve(distDir, 'mobile/vendor/jsQR-LICENSE.txt'))
+cpSync(resolve(mobilePackageDir('qrcode-generator'), 'dist/qrcode.mjs'), resolve(distDir, 'mobile/vendor/qrcode.mjs'))
+cpSync(resolve(mobilePackageDir('jsqr'), 'dist/jsQR.js'), resolve(distDir, 'mobile/vendor/jsQR.js'))
+cpSync(resolve(mobilePackageDir('jsqr'), 'LICENSE'), resolve(distDir, 'mobile/vendor/jsQR-LICENSE.txt'))