diff --git a/packaging/linux/flatpak/ai.storyteller.gridcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.gridcraft.bundle.yml
index 5126f035d..913ac159e 100644
--- a/packaging/linux/flatpak/ai.storyteller.gridcraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.gridcraft.bundle.yml
@@ -26,6 +26,14 @@ finish-args:
   - --share=network
   # GPU access for rendering.
   - --device=dri
+  # Printing: lpstat/lp (the cups-client module) reach the host's CUPS through its socket and
+  # find driverless network printers through Avahi (`lpstat -e`). Without these the Print
+  # dialog lists no printers.
+  - --socket=cups
+  - --system-talk-name=org.freedesktop.Avahi
+  # The user's CUPS settings, read-only: their default printer and saved options (lpoptions)
+  # and a print server named in their client.conf, which lp reaches over the network.
+  - --filesystem=~/.cups:ro
   # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
   # portal, so broad filesystem access isn't needed. Documents and Downloads are granted for
   # opening workbooks by path from the command line.
@@ -33,6 +41,50 @@ finish-args:
   - --filesystem=xdg-download
   # Network: update checks reach GitHub. Home/host filesystem access is deliberately not granted.
 modules:
+  # CUPS client tools for craft-print: the runtime has libcups but not lpstat/lp/lpoptions.
+  # Linked statically against this release's libcups, so a runtime update can't break them;
+  # the socket path matches the host's, which --socket=cups mounts.
+  - name: cups-client
+    buildsystem: simple
+    build-commands:
+      - ./configure --prefix=/app --sysconfdir=/etc --localstatedir=/var --with-rundir=/run/cups
+        --with-domainsocket=/run/cups/cups.sock --disable-shared --with-components=libcups
+        --with-dnssd=avahi --with-tls=gnutls --disable-pam --disable-dbus
+      - make -C cups libs
+      - make -C systemv lp lpoptions lpstat
+      - install -Dm755 -t /app/libexec/cups systemv/lp systemv/lpoptions systemv/lpstat
+      - for tool in lp lpoptions lpstat; do install -Dm755 cups-socket.sh "/app/bin/$tool"; done
+      - install -Dm644 -t /app/share/licenses/cups LICENSE NOTICE
+    sources:
+      - type: archive
+        url: https://github.com/OpenPrinting/cups/releases/download/v2.4.20/cups-2.4.20-source.tar.gz
+        sha256: ab4d9cd7f3e58060091d2b24972223d6401675f11c49b65abf4f6ef31dea22ff
+      # Runs each tool. Flatpak mounts the host's CUPS socket at /var/run/cups/cups.sock, choosing
+      # it as flatpak-run-cups.c does from the host's CUPS_SERVER, else the first line spelled
+      # exactly `ServerName /path` in ~/.cups/client.conf, else the default; it mounts nothing
+      # when that socket is missing. CUPS reads the keyword in any case and takes the last
+      # ServerName. When CUPS' socket from client.conf is the one Flatpak chose, it is pointed at
+      # the mount; when it isn't, the tool fails rather than reach a different server. A
+      # CUPS_SERVER is left alone: one set by `flatpak run --env` may not be what was mounted.
+      - type: script
+        dest-filename: cups-socket.sh
+        commands:
+          - 'conf="$HOME/.cups/client.conf"'
+          - 'if [ -z "${CUPS_SERVER:-}" ] && [ -r "$conf" ]; then'
+          - '  server=$(sed -n ''s/^[[:space:]]*[Ss][Ee][Rr][Vv][Ee][Rr][Nn][Aa][Mm][Ee][[:space:]]\{1,\}\([^[:space:]]*\).*/\1/p'' "$conf" | tail -n 1)'
+          - '  case "$server" in'
+          - '    /*)'
+          - '      mounted=$(sed -n ''s/^[[:space:]]*ServerName \(.*\)$/\1/p'' "$conf" | sed ''s/^[[:space:]]*//'' | grep -m 1 ''^/[^:]*$'')'
+          - '      if [ "$mounted" = "$server" ]; then'
+          - '        export CUPS_SERVER=/var/run/cups/cups.sock'
+          - '      else'
+          - '        echo "${0##*/}: ~/.cups/client.conf names the CUPS socket $server, but Flatpak gave this app ${mounted:-a different one}; give each socket one ServerName line, spelled ServerName" >&2'
+          - '        exit 1'
+          - '      fi'
+          - '      ;;'
+          - '  esac'
+          - 'fi'
+          - 'exec "/app/libexec/cups/${0##*/}" "$@"'
   - name: gridcraft
     buildsystem: simple
     build-commands:
diff --git a/packaging/linux/flatpak/ai.storyteller.gridcraft.yml b/packaging/linux/flatpak/ai.storyteller.gridcraft.yml
index f2b177839..4fcd1a1a4 100644
--- a/packaging/linux/flatpak/ai.storyteller.gridcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.gridcraft.yml
@@ -27,6 +27,14 @@ finish-args:
   - --share=network
   # GPU access for rendering.
   - --device=dri
+  # Printing: lpstat/lp (the cups-client module) reach the host's CUPS through its socket and
+  # find driverless network printers through Avahi (`lpstat -e`). Without these the Print
+  # dialog lists no printers.
+  - --socket=cups
+  - --system-talk-name=org.freedesktop.Avahi
+  # The user's CUPS settings, read-only: their default printer and saved options (lpoptions)
+  # and a print server named in their client.conf, which lp reaches over the network.
+  - --filesystem=~/.cups:ro
   # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
   # portal, so broad filesystem access isn't needed. Documents and Downloads are granted for
   # opening workbooks by path from the command line.
@@ -36,6 +44,50 @@ finish-args:
 build-options:
   append-path: /usr/lib/sdk/rust-stable/bin
 modules:
+  # CUPS client tools for craft-print: the runtime has libcups but not lpstat/lp/lpoptions.
+  # Linked statically against this release's libcups, so a runtime update can't break them;
+  # the socket path matches the host's, which --socket=cups mounts.
+  - name: cups-client
+    buildsystem: simple
+    build-commands:
+      - ./configure --prefix=/app --sysconfdir=/etc --localstatedir=/var --with-rundir=/run/cups
+        --with-domainsocket=/run/cups/cups.sock --disable-shared --with-components=libcups
+        --with-dnssd=avahi --with-tls=gnutls --disable-pam --disable-dbus
+      - make -C cups libs
+      - make -C systemv lp lpoptions lpstat
+      - install -Dm755 -t /app/libexec/cups systemv/lp systemv/lpoptions systemv/lpstat
+      - for tool in lp lpoptions lpstat; do install -Dm755 cups-socket.sh "/app/bin/$tool"; done
+      - install -Dm644 -t /app/share/licenses/cups LICENSE NOTICE
+    sources:
+      - type: archive
+        url: https://github.com/OpenPrinting/cups/releases/download/v2.4.20/cups-2.4.20-source.tar.gz
+        sha256: ab4d9cd7f3e58060091d2b24972223d6401675f11c49b65abf4f6ef31dea22ff
+      # Runs each tool. Flatpak mounts the host's CUPS socket at /var/run/cups/cups.sock, choosing
+      # it as flatpak-run-cups.c does from the host's CUPS_SERVER, else the first line spelled
+      # exactly `ServerName /path` in ~/.cups/client.conf, else the default; it mounts nothing
+      # when that socket is missing. CUPS reads the keyword in any case and takes the last
+      # ServerName. When CUPS' socket from client.conf is the one Flatpak chose, it is pointed at
+      # the mount; when it isn't, the tool fails rather than reach a different server. A
+      # CUPS_SERVER is left alone: one set by `flatpak run --env` may not be what was mounted.
+      - type: script
+        dest-filename: cups-socket.sh
+        commands:
+          - 'conf="$HOME/.cups/client.conf"'
+          - 'if [ -z "${CUPS_SERVER:-}" ] && [ -r "$conf" ]; then'
+          - '  server=$(sed -n ''s/^[[:space:]]*[Ss][Ee][Rr][Vv][Ee][Rr][Nn][Aa][Mm][Ee][[:space:]]\{1,\}\([^[:space:]]*\).*/\1/p'' "$conf" | tail -n 1)'
+          - '  case "$server" in'
+          - '    /*)'
+          - '      mounted=$(sed -n ''s/^[[:space:]]*ServerName \(.*\)$/\1/p'' "$conf" | sed ''s/^[[:space:]]*//'' | grep -m 1 ''^/[^:]*$'')'
+          - '      if [ "$mounted" = "$server" ]; then'
+          - '        export CUPS_SERVER=/var/run/cups/cups.sock'
+          - '      else'
+          - '        echo "${0##*/}: ~/.cups/client.conf names the CUPS socket $server, but Flatpak gave this app ${mounted:-a different one}; give each socket one ServerName line, spelled ServerName" >&2'
+          - '        exit 1'
+          - '      fi'
+          - '      ;;'
+          - '  esac'
+          - 'fi'
+          - 'exec "/app/libexec/cups/${0##*/}" "$@"'
   - name: gridcraft
     buildsystem: simple
     build-options: