diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..a62c792
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,77 @@
+name: Build distributables
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  windows:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Cache CMake FetchContent dependencies
+        uses: actions/cache@v4
+        with:
+          path: build/_deps
+          key: win-deps-${{ hashFiles('CMakeLists.txt') }}
+
+      - name: Configure
+        run: cmake -B build -A x64
+
+      - name: Build (Release)
+        run: cmake --build build --target neo-processing -j --config Release
+
+      - name: Locate Release output
+        id: locate
+        shell: bash
+        run: |
+          if [ -f "build/Release/neo-processing.exe" ]; then
+            echo "dir=build/Release" >> "$GITHUB_OUTPUT"
+          else
+            echo "dir=build" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Upload distributable
+        uses: actions/upload-artifact@v4
+        with:
+          name: neo-processing-windows
+          path: ${{ steps.locate.outputs.dir }}
+          if-no-files-found: error
+
+  linux:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential cmake git libgtk-3-dev libwebkit2gtk-4.1-dev
+
+      - name: Cache CMake FetchContent dependencies
+        uses: actions/cache@v4
+        with:
+          path: build/_deps
+          key: linux-deps-${{ hashFiles('CMakeLists.txt') }}
+
+      - name: Configure
+        run: cmake -B build
+
+      - name: Build (Release)
+        run: cmake --build build --target neo-processing -j --config Release
+
+      - name: Assemble distributable
+        run: |
+          mkdir -p dist/icons
+          cp build/neo-processing dist/
+          cp icons/app_icon.ico icons/app_icon_small.ico dist/icons/
+
+      - name: Upload distributable
+        uses: actions/upload-artifact@v4
+        with:
+          name: neo-processing-linux
+          path: dist
+          if-no-files-found: error
diff --git a/AGENTS.md b/AGENTS.md
index 3dd5438..d19edb8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -19,7 +19,9 @@ The whole product is a single C++ executable that:
    that local server (WebView2 on Windows, WebKitGTK on Linux).
 
 There is no separate backend process and no external network dependency at
-runtime.
+runtime — the only optional exception is choosing an online p5.js build from
+the Libraries panel, which loads that build from a CDN (see "Libraries"
+below). The default, bundled build keeps the app fully offline.
 
 ## Architecture
 
@@ -55,7 +57,10 @@ runtime.
     version, url, isLocal }`); see the Libraries section below.
   - `script.js` — all UI logic: editor setup, menus, file open/save, panel
     splitter, the sketch runner, and the capture/fullscreen controls.
-  - `style.css` — styling.
+  - `style.css` — styling. The `html` element is set to `zoom: 0.8` so the app
+    starts at 80% of its natural size (more editor/preview space in the same
+    window); this scales fonts, paddings, and controls together instead of
+    tuning each dimension by hand.
   - `libs/` — vendored third-party JS (Ace editor, p5.js). These are committed.
     The bundled p5 version is declared once as `P5_VERSION` in `script.js`, which
     drives both the version label and the `<script>` URL the sketch iframe loads;
@@ -63,8 +68,15 @@ runtime.
 - **`outputs/`** — where saved sketches are written at runtime
   (`POST /api/save-script`). Treated as scratch output; safe to clear.
 - **`icons/`** — `.ico` files copied next to the executable on Windows and loaded
-  at runtime for the window/taskbar icon.
+  at runtime for the window/taskbar icon (`app_icon.ico` large, `app_icon_small.ico`
+  small/title-bar). `icons/app.rc` is a Win32 resource script that embeds
+  `app_icon.ico` into the `.exe` itself at build time (Windows only), so
+  Explorer/Alt+Tab show it as the file's own icon — separate from, and in
+  addition to, the runtime `LoadImageW`/`WM_SETICON` calls in `main.cpp` that
+  set the *window* icon from the same files.
 - **`assets/`** — screenshots for the README only.
+- **`.github/workflows/build.yml`** — CI: builds Release distributables for
+  Windows and Linux on push/PR to `main`, uploaded as workflow artifacts.
 
 ### Request/response contract
 
@@ -182,7 +194,16 @@ cmake --build build --target neo-processing -j --config Debug
 
 `build_and_distribute.bat` (Windows) builds Release and copies the resulting
 `build\Release` folder (executable, icons, runtime DLLs) to
-`%USERPROFILE%\Desktop\neo-processing`.
+`%USERPROFILE%\Desktop\neo-processing`. The `.exe`'s own file icon is embedded
+by the CMake build itself (`icons/app.rc`, see above), so this script does not
+need a separate icon-injection step.
+
+### CI
+
+`.github/workflows/build.yml` builds Release distributables for Windows
+(MSVC) and Linux (GCC + GTK3/WebKit2GTK) on every push/PR to `main`, uploading
+each as a workflow artifact. There is no test suite to run in CI — it only
+verifies the project configures and builds cleanly on both platforms.
 
 ### Dependencies (fetched at configure time into `build/_deps/`)
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 0161e32..eadee96 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -78,7 +78,14 @@ cpp_embedlib_add(WebAssets
     NAMESPACE Web
 )
 
-add_executable(neo-processing src/main.cpp)
+if(WIN32)
+    # Embeds icons/app_icon.ico as the PE resource icon, so Explorer/taskbar
+    # show it as neo-processing.exe's own file icon (independent of the
+    # runtime window icon main.cpp loads from icons/*.ico at startup).
+    set(APP_ICON_RESOURCE ${CMAKE_CURRENT_SOURCE_DIR}/icons/app.rc)
+endif()
+
+add_executable(neo-processing src/main.cpp ${APP_ICON_RESOURCE})
 
 target_link_libraries(neo-processing PRIVATE
     httplib::httplib
diff --git a/README.md b/README.md
index 87ff61d..553130c 100644
--- a/README.md
+++ b/README.md
@@ -24,8 +24,10 @@ full-screen deployment.
   PNG frame, both rendered at the sketch's declared size and saved to `outputs/`.
 - **Fullscreen preview** — present the sketch centred at its exact size on a
   white backdrop; press Esc to exit.
-- **Local-first & offline** — the frontend and p5.js are embedded into the
-  binary and served from a loopback HTTP server; nothing is fetched at runtime.
+- **Local-first & offline** — the frontend and the bundled p5.js build are
+  embedded into the binary and served from a loopback HTTP server. No internet
+  access is required to run the app, **unless** you opt into an online p5.js
+  build from the Libraries panel, which loads that build from a CDN.
 - **Save to disk** — export the current sketch to a timestamped `.js` file under
   `outputs/`.
 
@@ -61,7 +63,7 @@ For a deeper description of the codebase, see [AGENTS.md](./AGENTS.md).
 | CMake ≥ 3.20     | Build system. |
 | C++20 compiler   | Windows: Visual Studio 2022 Build Tools (MSVC). Linux: GCC or Clang. |
 | Git              | Required — CMake `FetchContent` downloads dependencies from Git. |
-| Internet access  | Needed on the **first** configure to download dependencies. |
+| Internet access  | Needed on the **first** configure to download build dependencies (see below). Not needed at runtime — see "Local-first & offline" above. |
 
 **Windows runtime:** Microsoft Edge WebView2 Runtime.
 
@@ -100,7 +102,17 @@ Use `--config Debug` (and the `Debug` output folder) for a debug build.
 
 To produce a distributable build, run `.\build_and_distribute.bat` (Windows): it
 builds Release and copies the `build\Release` folder (executable, icons, and any
-runtime DLLs) to `%USERPROFILE%\Desktop\neo-processing`.
+runtime DLLs) to `%USERPROFILE%\Desktop\neo-processing`. The Windows executable's
+own file icon (as shown in Explorer, the taskbar, and Alt+Tab) is embedded at
+build time from `icons/app_icon.ico` via `icons/app.rc` — no separate
+post-processing step is needed.
+
+### Continuous integration
+
+[`.github/workflows/build.yml`](./.github/workflows/build.yml) builds Release
+distributables for Windows and Linux on every push/PR to `main` (and on manual
+trigger), and uploads each as a workflow artifact
+(`neo-processing-windows`, `neo-processing-linux`).
 
 ## Dependencies
 
@@ -126,8 +138,9 @@ public/             Frontend, embedded into the binary at build time
   style.css         Styling
   libs/             Vendored Ace + p5.js
 outputs/            Saved sketches (runtime output)
-icons/              Application icons
+icons/              Application icons (+ app.rc, embedded as the .exe's file icon on Windows)
 assets/             README images
+.github/workflows/  CI: builds Windows + Linux distributables
 CMakeLists.txt      Build configuration
 AGENTS.md           Detailed guide for contributors and AI agents
 ```
diff --git a/icons/app.rc b/icons/app.rc
new file mode 100644
index 0000000..f8f5dbe
--- /dev/null
+++ b/icons/app.rc
@@ -0,0 +1,4 @@
+// Embeds the app icon as a Win32 PE resource so Explorer, the taskbar
+// shortcut, and Alt+Tab show it as the file icon of neo-processing.exe
+// (independent of the runtime icon loaded from icons/*.ico by main.cpp).
+IDI_APP_ICON ICON "app_icon.ico"
diff --git a/icons/app_icon_small.ico b/icons/app_icon_small.ico
index 1b11468..b3e25ca 100644
Binary files a/icons/app_icon_small.ico and b/icons/app_icon_small.ico differ
diff --git a/public/style.css b/public/style.css
index 65372d7..0df64ba 100644
--- a/public/style.css
+++ b/public/style.css
@@ -37,6 +37,13 @@ body {
   scrollbar-color: var(--border-strong) transparent;
 }
 
+html {
+  /* App starts at 80% zoom so the editor/preview get more effective screen
+     space; a plain CSS zoom keeps every element (fonts, paddings, controls)
+     scaled together instead of hand-tuning individual sizes. */
+  zoom: 0.8;
+}
+
 body {
   background: var(--bg);
 }