diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 259e901d..950e84ba 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: GoogleOAuth2
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: "1.93.0"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fa0dd4c6..8fb8c04c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,22 +8,28 @@ on:
 jobs:
   build:
     name: Build (${{ matrix.target }})
-    runs-on: macos-14
+    runs-on: ${{ matrix.os }}
     environment: GoogleOAuth2
     strategy:
+      fail-fast: false
       matrix:
-        target:
-          - aarch64-apple-darwin
-          - x86_64-apple-darwin
+        include:
+          - target: aarch64-apple-darwin
+            os: macos-14
+          - target: x86_64-apple-darwin
+            os: macos-14
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-22.04
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-22.04-arm
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: "1.93.0"
 
-      - name: Install cross-compilation target
-        if: matrix.target != 'aarch64-apple-darwin'
+      - name: Install Rust target
         run: rustup target add ${{ matrix.target }}
 
       - uses: Swatinem/rust-cache@v2
@@ -60,7 +66,7 @@ jobs:
 
           tar -C dist -czf "dist/${PACKAGE_NAME}.tar.gz" "${PACKAGE_NAME}"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: artifact-${{ matrix.target }}
           path: dist/*.tar.gz
@@ -71,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           pattern: artifact-*
           path: dist
@@ -83,7 +89,7 @@ jobs:
           shasum -a 256 *.tar.gz > checksums.txt
           cat checksums.txt
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: checksums
           path: dist/checksums.txt
@@ -96,15 +102,15 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           pattern: artifact-*
           path: dist
           merge-multiple: true
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           name: checksums
           path: dist
@@ -152,8 +158,16 @@ jobs:
             echo "xattr -d com.apple.quarantine ok"
             echo '```'
             echo ""
+            echo "### Linux Requirements"
+            echo ""
+            echo "Linux builds target glibc 2.35 or newer (Ubuntu 22.04+, Debian 12+, Fedora, RHEL/Rocky/Alma 9+, Arch, openSUSE). They do not cover Alpine (musl) or older glibc releases such as Debian 11."
+            echo ""
+            echo "ok locks secrets in memory with mlock. Most distributions default to a low RLIMIT_MEMLOCK (often 64 KiB), which can cause vault creation or unlock to fail. Raise it before running ok, for example: ulimit -l unlimited, a /etc/security/limits.conf entry, a systemd LimitMEMLOCK=infinity directive, or setcap cap_ipc_lock=ep. See INSTALL.md for details."
+            echo ""
             echo "### Install"
             echo ""
+            echo "Available targets: aarch64-apple-darwin, x86_64-apple-darwin, x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu."
+            echo ""
             echo '```bash'
             echo "tar -xzf ok-v${VERSION}-<target>.tar.gz"
             echo "sudo mv ok-v${VERSION}-<target>/ok /usr/local/bin/"
@@ -200,15 +214,15 @@ jobs:
     needs: build
     environment: NPM
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           pattern: artifact-*
           path: dist
           merge-multiple: true
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
@@ -225,6 +239,8 @@ jobs:
         run: |
           npm --prefix npm/ok-darwin-arm64 version "$VERSION" --no-git-tag-version
           npm --prefix npm/ok-darwin-x64 version "$VERSION" --no-git-tag-version
+          npm --prefix npm/ok-linux-x64 version "$VERSION" --no-git-tag-version
+          npm --prefix npm/ok-linux-arm64 version "$VERSION" --no-git-tag-version
           npm --prefix npm/ok version "$VERSION" --no-git-tag-version
           # Update optionalDependencies to match
           node -e "
@@ -243,6 +259,8 @@ jobs:
         run: |
           npm pack ./npm/ok-darwin-arm64 --dry-run
           npm pack ./npm/ok-darwin-x64 --dry-run
+          npm pack ./npm/ok-linux-x64 --dry-run
+          npm pack ./npm/ok-linux-arm64 --dry-run
           npm pack ./npm/ok --dry-run
 
       - name: Publish @openkeyring/ok-darwin-arm64
@@ -255,6 +273,16 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Publish @openkeyring/ok-linux-x64
+        run: npm publish ./npm/ok-linux-x64
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish @openkeyring/ok-linux-arm64
+        run: npm publish ./npm/ok-linux-arm64
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
       - name: Publish @openkeyring/ok
         run: npm publish ./npm/ok
         env:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e63be55b..9b18a3b4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,8 +6,9 @@ This project is in first-preview status. Preview releases may change local vault
 
 ## Unreleased
 
+- Added Linux x86_64/ARM64 (glibc 2.35+) release builds, distribution, and documentation support: release workflow now builds `x86_64-unknown-linux-gnu` and `aarch64-unknown-linux-gnu` targets; npm ships `@openkeyring/ok-linux-x64` and `@openkeyring/ok-linux-arm64`; Homebrew formula adds an `on_linux` block; INSTALL documents `mlock`/`RLIMIT_MEMLOCK` requirements.
 - Added first-preview installation, support, contribution, security, and issue-reporting documentation.
-- Clarified the preview boundary: macOS Apple Silicon and Intel only; Linux and Windows are not supported yet.
+- Updated the preview boundary: macOS Apple Silicon/Intel and Linux x86_64/ARM64 (glibc 2.35+) are supported; Alpine (musl) and Windows are not yet.
 - Clarified that preview builds are unsigned and not notarized, with best-effort community support and no formal SLA.
 
 ## 0.8.0-preview.1
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 83dd8642..a1c76716 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -7,7 +7,7 @@ Thanks for helping improve oak-keyring. The project is in a first-preview phase,
 - Reproducible bug reports with environment details.
 - Documentation fixes for install, support, or troubleshooting gaps.
 - Small code fixes with clear tests.
-- Preview packaging feedback for macOS Apple Silicon and Intel.
+- Preview packaging feedback for macOS Apple Silicon/Intel and Linux x86_64/ARM64.
 
 Avoid large roadmap proposals, broad architecture rewrites, or speculative platform work in a first contribution. Open a discussion first for anything that changes user-visible behavior or security-sensitive code.
 
@@ -33,4 +33,4 @@ Local builds need `OAK_GOOGLE_CLIENT_ID` and `OAK_GOOGLE_CLIENT_SECRET` in the e
 
 ## Preview Scope
 
-The current preview supports macOS on Apple Silicon and Intel only. Linux and Windows are not supported yet, preview builds are unsigned and not notarized, data formats may change, and support is best effort without a formal SLA.
+The current preview supports macOS on Apple Silicon/Intel and Linux x86_64/ARM64 (glibc 2.35+). Alpine (musl) and Windows are not supported yet; preview builds are unsigned and not notarized, data formats may change, and support is best effort without a formal SLA.
diff --git a/INSTALL-ZH.md b/INSTALL-ZH.md
index 2efddb6f..ea116dcd 100644
--- a/INSTALL-ZH.md
+++ b/INSTALL-ZH.md
@@ -4,8 +4,8 @@ oak-keyring 是 OpenKeyring 项目的 privacy-first、local-first 预览版密
 
 ## 预览版支持边界
 
-- 支持的操作系统：Apple Silicon 和 Intel 芯片的 macOS。
-- 暂不支持 Linux 和 Windows。
+- 支持的操作系统：Apple Silicon 和 Intel 芯片的 macOS，以及 glibc 2.35 及以上版本的 Linux x86_64/ARM64（Ubuntu 22.04+、Debian 12+、Fedora、RHEL/Rocky/Alma 9+、Arch、openSUSE）。暂不支持 Alpine（musl）和 Windows。
+- 在 Linux 上，内存锁定（`mlock`）可能需要调高 `RLIMIT_MEMLOCK`，详见下文「Linux 内存锁定」章节。
 - 预览版构建未签名、未公证。macOS Gatekeeper 可能会在首次运行前提示风险。
 - 本地 vault 和同步数据格式在稳定版前可能变化。预览版数据不提供兼容性保证。
 - 社区支持通过 GitHub Issues 和 Discussions 尽力提供，不提供正式 SLA。
@@ -14,10 +14,10 @@ oak-keyring 是 OpenKeyring 项目的 privacy-first、local-first 预览版密
 
 ## GitHub Release 未签名构建
 
-GitHub Release 是主要用户安装路径。Release 提供 Apple Silicon 和 Intel macOS 的未签名构建产物。
+GitHub Release 是主要用户安装路径。Release 提供 macOS（Apple Silicon 和 Intel）与 Linux（x86_64 和 ARM64，glibc 2.35+）的未签名构建产物。
 
 1. 打开最新 release：`https://github.com/OpenKeyring/oak-keyring/releases`。
-2. 下载与你的 Mac 架构匹配的产物。
+2. 下载与你的操作系统和架构匹配的产物。
 3. 解压后，把 `ok` 移动到 `PATH` 中的目录，例如 `/usr/local/bin` 或 `~/.local/bin`。
 4. 验证安装：
 
@@ -36,7 +36,7 @@ brew install ok
 
 ## npm 内置二进制包
 
-npm 包会为 macOS 安装内置的 `ok` 二进制文件：
+npm 包会为 macOS 和 Linux 安装内置的 `ok` 二进制文件：
 
 ```bash
 npm install -g @openkeyring/ok
@@ -45,15 +45,50 @@ ok --version
 
 如果 npm 包暂时不支持你的架构，请改用 GitHub Release。
 
+## Linux 内存锁定
+
+`ok` 使用 `mlock` 把机密数据（主密钥、派生密钥等）锁定在内存中，使其不会被交换到磁盘。在 Linux 上，默认的 `RLIMIT_MEMLOCK` 通常只有 64 KiB，太小了。当 `mlock` 失败时，`ok` 会显式报错：创建或解锁 vault 会返回错误，而不是在没有内存保护的情况下静默运行。
+
+在运行 `ok` 之前调高该限制。请根据你的环境选择合适的方式：
+
+**交互式会话（临时）：**
+
+```bash
+ulimit -l unlimited
+ok
+```
+
+**通过 PAM 持久化** — 在 `/etc/security/limits.conf` 中添加，然后重新登录：
+
+```
+*  soft  memlock  unlimited
+*  hard  memlock  unlimited
+```
+
+**systemd 服务** — 在 unit 文件中添加：
+
+```
+[Service]
+LimitMEMLOCK=infinity
+```
+
+**Capability（无需调整 ulimit）** — 一次性授予，重启后仍生效：
+
+```bash
+sudo setcap cap_ipc_lock=ep "$(command -v ok)"
+```
+
+macOS 不需要对普通用户施加同样的 `mlock` 配额，因此该步骤在 macOS 上不需要。
+
 ## 开发者源码构建
 
 源码构建不是预览版的主要分发方式，因为当前构建会把用于同步的 Google OAuth2 配置编译进二进制。这个路径适合开发或源码审查。
 
 前置条件：
 
-- Apple Silicon 或 Intel 芯片的 macOS
+- Apple Silicon 或 Intel 芯片的 macOS，或 Linux x86_64/ARM64（glibc 2.35+）
 - 通过 `rustup` 安装的 Rust 工具链
-- Xcode Command Line Tools
+- macOS 上：Xcode Command Line Tools。Linux 上：C 编译器和构建工具（`build-essential`/`gcc`/`make`）
 - 本地构建需要 Google OAuth 值，可以放在环境变量或 `.env` 中
 
 ```bash
diff --git a/INSTALL.md b/INSTALL.md
index 485aeec3..fad56f85 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -4,8 +4,8 @@ oak-keyring is a privacy-first, local-first preview password manager for the Ope
 
 ## Preview Support Boundary
 
-- Supported operating systems: macOS on Apple Silicon and Intel.
-- Linux and Windows are not yet supported.
+- Supported operating systems: macOS on Apple Silicon and Intel, and Linux x86_64/ARM64 with glibc 2.35 or newer (Ubuntu 22.04+, Debian 12+, Fedora, RHEL/Rocky/Alma 9+, Arch, openSUSE). Alpine (musl) and Windows are not supported yet.
+- On Linux, memory locking (`mlock`) may require raising `RLIMIT_MEMLOCK`; see the Linux Memory Locking section below.
 - Preview builds are unsigned and not notarized. macOS Gatekeeper may warn before first launch.
 - The local vault and sync data formats may change before a stable release. Preview data does not carry a compatibility guarantee.
 - Community support is best effort through GitHub Issues and Discussions. There is no formal SLA.
@@ -14,10 +14,10 @@ Back up any vault data before upgrading between preview builds.
 
 ## GitHub Release Builds
 
-GitHub Release assets are the primary user installation path. Assets are unsigned macOS builds for Apple Silicon and Intel.
+GitHub Release assets are the primary user installation path. Assets are unsigned builds for macOS (Apple Silicon and Intel) and Linux (x86_64 and ARM64, glibc 2.35+).
 
 1. Open the latest release at `https://github.com/OpenKeyring/oak-keyring/releases`.
-2. Download the asset that matches your Mac architecture.
+2. Download the asset that matches your OS and architecture.
 3. Unpack it and move `ok` into a directory on your `PATH`, such as `/usr/local/bin` or `~/.local/bin`.
 4. Verify it:
 
@@ -36,7 +36,7 @@ brew install ok
 
 ## npm Bundled Binary Package
 
-The npm package installs a bundled `ok` binary for macOS:
+The npm package installs a bundled `ok` binary for macOS and Linux:
 
 ```bash
 npm install -g @openkeyring/ok
@@ -45,15 +45,50 @@ ok --version
 
 Use the GitHub Release path if the npm package is not available for your architecture yet.
 
+## Linux Memory Locking
+
+`ok` locks secrets (master key, derived keys) in RAM with `mlock` so they cannot be swapped to disk. On Linux, the default `RLIMIT_MEMLOCK` is often only 64 KiB, which is too small. When `mlock` fails, `ok` fails loudly: vault creation or unlock surfaces an error rather than silently running without memory protection.
+
+Raise the limit before running `ok`. Pick whichever fits your setup:
+
+**Interactive session (temporary):**
+
+```bash
+ulimit -l unlimited
+ok
+```
+
+**Persistent via PAM** — add to `/etc/security/limits.conf`, then log out and back in:
+
+```
+*  soft  memlock  unlimited
+*  hard  memlock  unlimited
+```
+
+**systemd service** — add to the unit file:
+
+```
+[Service]
+LimitMEMLOCK=infinity
+```
+
+**Capability (no ulimit needed)** — grant once, persists across reboots:
+
+```bash
+sudo setcap cap_ipc_lock=ep "$(command -v ok)"
+```
+
+This step is not needed on macOS, which does not impose the same `mlock` quota on regular users.
+
 ## Developer Source Build
 
 Source builds are not the primary preview distribution path because the current build embeds Google OAuth2 configuration for sync. Use this path for development or source inspection.
 
 Prerequisites:
 
-- macOS on Apple Silicon or Intel
+- macOS on Apple Silicon or Intel, or Linux x86_64/ARM64 (glibc 2.35+)
 - Rust toolchain from `rustup`
-- Xcode Command Line Tools
+- On macOS: Xcode Command Line Tools. On Linux: a C compiler and build tools (`build-essential`/`gcc`/`make`)
 - Google OAuth values for local builds, either in the environment or `.env`
 
 ```bash
diff --git a/README-ZH.md b/README-ZH.md
index 7f34f744..059fd179 100644
--- a/README-ZH.md
+++ b/README-ZH.md
@@ -27,12 +27,13 @@ oak-keyring 是一个 privacy-first、local-first 的密码管理器，提供键
 - **自动锁定** — 不活动后自动锁定密码库
 - **密码健康** — 泄露密码指示器和健康检查
 - **macOS** — Apple Silicon 和 Intel 构建（预览）
+- **Linux** — x86_64 和 ARM64 构建，glibc 2.35+（预览）
 
 ## 安装
 
 ### GitHub Release（推荐）
 
-1. 下载与你的 Mac 架构匹配的 tarball。
+1. 下载与你的操作系统和架构匹配的 tarball。
 2. 校验 `checksums.txt`。
 3. 解压后运行 `ok --version`。
 
@@ -97,7 +98,7 @@ oak-keyring 会打开一个全屏终端界面。主要使用流程是：
 
 oak-keyring 仍处于 pre-1.0 预览阶段（v0.8.0-preview.1）。
 
-- 当前构建仅支持 macOS（Apple Silicon 和 Intel）；暂不提供 Linux 和 Windows 构建。
+- 当前构建支持 macOS（Apple Silicon 和 Intel）和 Linux（x86_64/ARM64，glibc 2.35+）；暂不提供 Windows 构建。Linux 上可能需要调高 `mlock` 的 `RLIMIT_MEMLOCK`（见 INSTALL-ZH.md）。
 - macOS 二进制未签名，也未 notarize。
 - 密码库数据、配置和发布打包方式在后续稳定版之前可能变化。
 - 没有正式支持 SLA。
diff --git a/README.md b/README.md
index 365e90e0..2a7b183f 100644
--- a/README.md
+++ b/README.md
@@ -35,12 +35,13 @@ The command-line binary is `ok`.
 - **Auto-lock** — lock the vault after inactivity
 - **Password health** — leaked password indicators and health checks
 - **macOS** — Apple Silicon and Intel builds (preview)
+- **Linux** — x86_64 and ARM64 builds, glibc 2.35+ (preview)
 
 ## Install
 
 ### GitHub Release (recommended)
 
-1. Download the tarball matching your Mac architecture.
+1. Download the tarball matching your OS and architecture.
 2. Verify `checksums.txt`.
 3. Unpack and run `ok --version`.
 
@@ -132,8 +133,7 @@ Support is community-style and best effort. There is no formal SLA.
 
 oak-keyring is pre-1.0 preview software (v0.8.0-preview.1).
 
-- Current builds target macOS (Apple Silicon and Intel); Linux and Windows
-  are not yet available.
+- Current builds target macOS (Apple Silicon and Intel) and Linux (x86_64/ARM64, glibc 2.35+); Windows is not yet available. On Linux, `mlock` may need `RLIMIT_MEMLOCK` raised (see INSTALL.md).
 - macOS binaries are unsigned and not notarized.
 - Vault data, configuration, and packaging may change before a stable release.
 - There is no formal support SLA.
diff --git a/RELEASE.md b/RELEASE.md
index 96e7722f..bc5f6bed 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -9,6 +9,8 @@ This checklist is for preparing the first OKI-0012 preview release of `ok`.
 - Install the Rust targets:
   - `aarch64-apple-darwin`
   - `x86_64-apple-darwin`
+  - `x86_64-unknown-linux-gnu`
+  - `aarch64-unknown-linux-gnu`
 - Run the release gate checks before packaging:
   - `cargo fmt --check`
   - `cargo clippy --all-targets -- -D warnings`
@@ -16,23 +18,27 @@ This checklist is for preparing the first OKI-0012 preview release of `ok`.
   - Any release-specific smoke test for the packaged `ok` binary.
 - Set `OAK_GOOGLE_CLIENT_ID` and `OAK_GOOGLE_CLIENT_SECRET` as required by the build environment. Dummy local values are acceptable for local verification only.
 
-## macOS Artifacts
+## Build Artifacts
 
-Build and package both macOS targets:
+The release workflow (`.github/workflows/release.yml`) builds all four targets on tag push:
 
-- Apple Silicon: `aarch64-apple-darwin`
-- Intel: `x86_64-apple-darwin`
+- Apple Silicon: `aarch64-apple-darwin` (macos-14 runner)
+- Intel: `x86_64-apple-darwin` (macos-14 runner)
+- Linux x86_64: `x86_64-unknown-linux-gnu` (ubuntu-22.04 runner, glibc 2.35 baseline)
+- Linux ARM64: `aarch64-unknown-linux-gnu` (ubuntu-22.04-arm runner, glibc 2.35 baseline)
 
-Use:
+For a local macOS preview build only:
 
 ```bash
 scripts/package-preview.sh
 ```
 
-Expected archives:
+Expected archives (the release workflow produces all four; local preview produces only the two macOS archives):
 
 - `dist/ok-v<version>-aarch64-apple-darwin.tar.gz`
 - `dist/ok-v<version>-x86_64-apple-darwin.tar.gz`
+- `dist/ok-v<version>-x86_64-unknown-linux-gnu.tar.gz`
+- `dist/ok-v<version>-aarch64-unknown-linux-gnu.tar.gz`
 - `dist/checksums.txt`
 
 Each archive contains the `ok` binary and project docs that are present in the repo root, currently `README.md` and `LICENSE`.
@@ -50,9 +56,11 @@ Self-signing or ad-hoc signing can be done locally for testing, but it is not eq
 - Use artifact names exactly matching the packaging output:
   - `ok-v<version>-aarch64-apple-darwin.tar.gz`
   - `ok-v<version>-x86_64-apple-darwin.tar.gz`
+  - `ok-v<version>-x86_64-unknown-linux-gnu.tar.gz`
+  - `ok-v<version>-aarch64-unknown-linux-gnu.tar.gz`
   - `checksums.txt`
 - Include the checksum file contents in the release notes or link directly to the uploaded file.
-- Call out that this is a preview build and that macOS artifacts are unsigned and not notarized.
+- Call out that this is a preview build, that macOS artifacts are unsigned and not notarized, and that Linux artifacts require glibc 2.35+ and may need `RLIMIT_MEMLOCK` raised (see INSTALL.md).
 
 ## npm Packages
 
@@ -63,6 +71,8 @@ Package names:
 - `@openkeyring/ok`
 - `@openkeyring/ok-darwin-arm64`
 - `@openkeyring/ok-darwin-x64`
+- `@openkeyring/ok-linux-x64`
+- `@openkeyring/ok-linux-arm64`
 
 Dry-run before publishing:
 
@@ -70,14 +80,18 @@ Dry-run before publishing:
 npm/stage-binaries.sh
 cd npm/ok-darwin-arm64 && npm pack --dry-run
 cd ../ok-darwin-x64 && npm pack --dry-run
+cd ../ok-linux-x64 && npm pack --dry-run
+cd ../ok-linux-arm64 && npm pack --dry-run
 cd ../ok && npm pack --dry-run
 ```
 
-Publish order:
+Publish order (platform packages first, main wrapper last):
 
 1. `@openkeyring/ok-darwin-arm64`
 2. `@openkeyring/ok-darwin-x64`
-3. `@openkeyring/ok`
+3. `@openkeyring/ok-linux-x64`
+4. `@openkeyring/ok-linux-arm64`
+5. `@openkeyring/ok`
 
 Publishing platform packages first prevents the main wrapper package from depending on package versions that are not available yet.
 
@@ -88,6 +102,7 @@ Update the Homebrew tap formula after the GitHub Release is published:
 ```bash
 cd homebrew-oak-keyring
 # Update the formula with the new version, URL, and SHA256
+# Update both on_macos and on_linux blocks (4 url/sha256 entries total)
 # Push to the tap repository
 ```
 
diff --git a/SECURITY.md b/SECURITY.md
index 3217166f..65b6c303 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -18,14 +18,16 @@ Only the latest preview release is supported for security fixes. Older preview b
 
 ## Supported Platforms
 
-The current preview supports macOS on Apple Silicon and Intel.
+The current preview supports macOS on Apple Silicon and Intel, and Linux x86_64/ARM64 with glibc 2.35 or newer.
 
-| Platform            | Status            |
-| ------------------- | ----------------- |
-| macOS Apple Silicon | Supported         |
-| macOS Intel         | Supported         |
-| Linux               | Not supported yet |
-| Windows             | Not supported yet |
+| Platform            | Status                    |
+| ------------------- | ------------------------- |
+| macOS Apple Silicon | Supported                 |
+| macOS Intel         | Supported                 |
+| Linux x86_64        | Supported (glibc 2.35+)   |
+| Linux ARM64         | Supported (glibc 2.35+)   |
+| Linux (Alpine/musl) | Not supported yet         |
+| Windows             | Not supported yet         |
 
 Preview builds are currently unsigned and not notarized. Before running oak-keyring, verify that downloads come from the official OpenKeyring GitHub release or package channel.
 
@@ -47,7 +49,7 @@ Please include as much of the following as possible:
 * A short description of the issue and likely impact.
 * Steps to reproduce, proof-of-concept details, or affected commands.
 * The oak-keyring version from `ok --version`.
-* Your macOS version and Mac architecture.
+* Your OS, version, and architecture (for example: macOS Apple Silicon, Linux x86_64 on Ubuntu 22.04, Linux ARM64).
 * Whether the issue involves a new vault, restored vault, imported data, or synced data.
 * Any logs or screenshots with secrets removed.
 
diff --git a/SUPPORT.md b/SUPPORT.md
index 9bdcb803..9df62a3c 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -12,8 +12,8 @@ oak-keyring is in first-preview status. Support is community-style and best effo
 
 For bugs or install problems, include:
 
-- macOS version and Mac architecture: Apple Silicon or Intel.
-- Install method: GitHub Release build, npm bundled binary package, or developer source build.
+- OS, version, and architecture (for example: macOS Apple Silicon, Linux x86_64 on Ubuntu 22.04).
+- Install method: GitHub Release build, npm bundled binary package, Homebrew, or developer source build.
 - oak-keyring version from `ok --version`.
 - What you expected to happen.
 - What actually happened.
@@ -22,7 +22,7 @@ For bugs or install problems, include:
 
 ## Preview Limitations
 
-- Only macOS Apple Silicon and Intel are supported in the first preview.
-- Linux and Windows are not supported yet.
+- macOS Apple Silicon/Intel and Linux x86_64/ARM64 (glibc 2.35+) are supported.
+- Alpine (musl) and Windows are not supported yet.
 - Preview builds are unsigned and not notarized.
 - Preview data formats may change before stable releases.
diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
index 30cb75c3..d031409c 100644
--- a/THREAT_MODEL.md
+++ b/THREAT_MODEL.md
@@ -203,8 +203,8 @@ Current known limitations include:
 
 * Pre-1.0 preview status
 * No external security audit yet
-* macOS-first platform support
-* Linux and Windows not supported yet
+* macOS and Linux (glibc 2.35+) platform support
+* Windows and Linux Alpine/musl not supported yet
 * Unsigned and non-notarized preview binaries
 * Optional sync is preview-stage
 * No hosted account recovery
diff --git a/npm/ok-linux-arm64/README.md b/npm/ok-linux-arm64/README.md
new file mode 100644
index 00000000..588b5a93
--- /dev/null
+++ b/npm/ok-linux-arm64/README.md
@@ -0,0 +1,5 @@
+# @openkeyring/ok-linux-arm64
+
+Bundled Open-Keyring `ok` binary for Linux ARM64 (glibc 2.35+).
+
+This package is installed as an optional dependency of `@openkeyring/ok`. It does not download binaries during installation.
diff --git a/npm/ok-linux-arm64/package.json b/npm/ok-linux-arm64/package.json
new file mode 100644
index 00000000..e2461334
--- /dev/null
+++ b/npm/ok-linux-arm64/package.json
@@ -0,0 +1,22 @@
+{
+  "name": "@openkeyring/ok-linux-arm64",
+  "version": "0.7.3",
+  "description": "Open-Keyring ok binary for Linux ARM64 (glibc 2.35+)",
+  "scripts": {
+    "prepack": "node ../check-binary.js"
+  },
+  "files": [
+    "bin",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT",
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "arm64"
+  ]
+}
diff --git a/npm/ok-linux-x64/README.md b/npm/ok-linux-x64/README.md
new file mode 100644
index 00000000..6f117135
--- /dev/null
+++ b/npm/ok-linux-x64/README.md
@@ -0,0 +1,5 @@
+# @openkeyring/ok-linux-x64
+
+Bundled Open-Keyring `ok` binary for Linux x86_64 (glibc 2.35+).
+
+This package is installed as an optional dependency of `@openkeyring/ok`. It does not download binaries during installation.
diff --git a/npm/ok-linux-x64/package.json b/npm/ok-linux-x64/package.json
new file mode 100644
index 00000000..f736fbcd
--- /dev/null
+++ b/npm/ok-linux-x64/package.json
@@ -0,0 +1,22 @@
+{
+  "name": "@openkeyring/ok-linux-x64",
+  "version": "0.7.3",
+  "description": "Open-Keyring ok binary for Linux x86_64 (glibc 2.35+)",
+  "scripts": {
+    "prepack": "node ../check-binary.js"
+  },
+  "files": [
+    "bin",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT",
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "x64"
+  ]
+}
diff --git a/npm/ok/README.md b/npm/ok/README.md
index 7bada0a1..d351bbae 100644
--- a/npm/ok/README.md
+++ b/npm/ok/README.md
@@ -4,7 +4,9 @@ Node.js wrapper for the Open-Keyring `ok` command.
 
 This package does not download binaries during installation. It selects one of the bundled platform packages installed through optional dependencies:
 
-- `@openkeyring/ok-darwin-arm64`
-- `@openkeyring/ok-darwin-x64`
+- `@openkeyring/ok-darwin-arm64` — macOS Apple Silicon
+- `@openkeyring/ok-darwin-x64` — macOS Intel
+- `@openkeyring/ok-linux-x64` — Linux x86_64 (glibc 2.35+)
+- `@openkeyring/ok-linux-arm64` — Linux ARM64 (glibc 2.35+)
 
-Current preview support is limited to macOS Apple Silicon and Intel.
+Current preview support covers macOS Apple Silicon/Intel and Linux x86_64/ARM64 (glibc 2.35+). Windows is not supported yet.
diff --git a/npm/ok/bin/ok.js b/npm/ok/bin/ok.js
index 687208f7..01540191 100755
--- a/npm/ok/bin/ok.js
+++ b/npm/ok/bin/ok.js
@@ -4,16 +4,28 @@
 const { spawn } = require("node:child_process");
 
 const platformPackage = (() => {
-  if (process.platform !== "darwin") {
+  if (process.platform === "darwin") {
+    if (process.arch === "arm64") {
+      return "@openkeyring/ok-darwin-arm64/bin/ok";
+    }
+
+    if (process.arch === "x64") {
+      return "@openkeyring/ok-darwin-x64/bin/ok";
+    }
+
     return null;
   }
 
-  if (process.arch === "arm64") {
-    return "@openkeyring/ok-darwin-arm64/bin/ok";
-  }
+  if (process.platform === "linux") {
+    if (process.arch === "arm64") {
+      return "@openkeyring/ok-linux-arm64/bin/ok";
+    }
 
-  if (process.arch === "x64") {
-    return "@openkeyring/ok-darwin-x64/bin/ok";
+    if (process.arch === "x64") {
+      return "@openkeyring/ok-linux-x64/bin/ok";
+    }
+
+    return null;
   }
 
   return null;
diff --git a/npm/ok/package.json b/npm/ok/package.json
index 6ed432b6..9003f73d 100644
--- a/npm/ok/package.json
+++ b/npm/ok/package.json
@@ -11,7 +11,9 @@
   ],
   "optionalDependencies": {
     "@openkeyring/ok-darwin-arm64": "0.7.3",
-    "@openkeyring/ok-darwin-x64": "0.7.3"
+    "@openkeyring/ok-darwin-x64": "0.7.3",
+    "@openkeyring/ok-linux-x64": "0.7.3",
+    "@openkeyring/ok-linux-arm64": "0.7.3"
   },
   "engines": {
     "node": ">=18"
@@ -21,6 +23,7 @@
   },
   "license": "MIT",
   "os": [
-    "darwin"
+    "darwin",
+    "linux"
   ]
 }
diff --git a/npm/stage-binaries.sh b/npm/stage-binaries.sh
index 63cf21e6..57503af0 100755
--- a/npm/stage-binaries.sh
+++ b/npm/stage-binaries.sh
@@ -50,5 +50,7 @@ stage_binary() {
 
 stage_binary "aarch64-apple-darwin" "npm/ok-darwin-arm64"
 stage_binary "x86_64-apple-darwin" "npm/ok-darwin-x64"
+stage_binary "x86_64-unknown-linux-gnu" "npm/ok-linux-x64"
+stage_binary "aarch64-unknown-linux-gnu" "npm/ok-linux-arm64"
 
 echo "Staged npm binaries for ok v$VERSION"
diff --git a/tests/scripts/stage_binaries_test.sh b/tests/scripts/stage_binaries_test.sh
index f921a8d3..54c0be16 100644
--- a/tests/scripts/stage_binaries_test.sh
+++ b/tests/scripts/stage_binaries_test.sh
@@ -36,6 +36,8 @@ make_archive() {
 
 make_archive "aarch64-apple-darwin" "arm64 binary"
 make_archive "x86_64-apple-darwin" "x64 binary"
+make_archive "x86_64-unknown-linux-gnu" "linux x64 binary"
+make_archive "aarch64-unknown-linux-gnu" "linux arm64 binary"
 
 mkdir -p "$TMP_DIR/fakebin"
 cat > "$TMP_DIR/fakebin/tar" <<'EOF'
@@ -63,6 +65,10 @@ if len(sys.argv) >= 4 and sys.argv[1] == "-xOzf":
         print("arm64 binary")
     elif "x86_64-apple-darwin" in archive:
         print("x64 binary")
+    elif "x86_64-unknown-linux-gnu" in archive:
+        print("linux x64 binary")
+    elif "aarch64-unknown-linux-gnu" in archive:
+        print("linux arm64 binary")
     else:
         sys.stderr.write(f"unexpected archive: {archive}\n")
         sys.exit(2)
@@ -79,5 +85,9 @@ bash "$TMP_DIR/npm/stage-binaries.sh"
 
 test -x "$TMP_DIR/npm/ok-darwin-arm64/bin/ok"
 test -x "$TMP_DIR/npm/ok-darwin-x64/bin/ok"
+test -x "$TMP_DIR/npm/ok-linux-x64/bin/ok"
+test -x "$TMP_DIR/npm/ok-linux-arm64/bin/ok"
 grep -q "arm64 binary" "$TMP_DIR/npm/ok-darwin-arm64/bin/ok"
 grep -q "x64 binary" "$TMP_DIR/npm/ok-darwin-x64/bin/ok"
+grep -q "linux x64 binary" "$TMP_DIR/npm/ok-linux-x64/bin/ok"
+grep -q "linux arm64 binary" "$TMP_DIR/npm/ok-linux-arm64/bin/ok"