diff --git a/README.md b/README.md
index d76d8d1..6b936fc 100644
--- a/README.md
+++ b/README.md
@@ -140,6 +140,18 @@ LUKS-encrypted later, this recovery path breaks (nothing starts until
 someone types the disk passphrase locally) unless something like
 `dropbear-initramfs` is added for remote unlock.
 
+## Single remote app: Chromium with your logged-in accounts
+
+`remote-chromium.sh` (run on the travel laptop) closes any Chromium you have
+running on the home machine, then launches it there with its window drawn
+locally via `waypipe` (`--x11` for classic X11 forwarding instead). The close
+step matters: Chromium allows one process per profile, so a still-running
+instance would swallow the new window onto the home machine's own screen.
+Needs `waypipe` on both ends (`setup-local.sh` installs it locally; on the
+home machine: `sudo apt install waypipe`). Untested against Tailscale SSH,
+which may not support the socket/X11 forwarding these rely on - if the
+connection fails, plain OpenSSH is the fix.
+
 ## Gotchas hit while building this (so they don't get re-debugged)
 
 - **`usermod`/`visudo`: command not found** after `su` - not missing, just
diff --git a/remote-chromium.sh b/remote-chromium.sh
new file mode 100755
index 0000000..76326ca
--- /dev/null
+++ b/remote-chromium.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Run on the travel laptop: closes any Chromium running for you on the remote
+# machine (Chromium allows one process per profile, so a running instance
+# would swallow the new window), then launches it there with its window
+# drawn here.
+#
+# Usage: remote-chromium.sh [--x11]     (default: waypipe)
+# Remote host: $REMOTE_HOST, default teemu-thinkpad-ubuntu
+set -euo pipefail
+
+HOST="${REMOTE_HOST:-teemu-thinkpad-ubuntu}"
+MODE="waypipe"
+[ "${1:-}" = "--x11" ] && MODE="x11"
+
+if [ "$MODE" = "waypipe" ] && ! command -v waypipe >/dev/null 2>&1; then
+  echo "waypipe not installed here - run: sudo apt install waypipe (needed on both machines)"
+  exit 1
+fi
+
+ssh "$HOST" bash -s <<'EOF'
+# snap build (Ubuntu) and the Debian package - matches the browser binary only,
+# not shells/editors that merely mention "chromium"
+PAT='chromium-browser/chrome|/usr/lib/chromium/chromium'
+if pgrep -u "$USER" -f "$PAT" >/dev/null; then
+  echo "Chromium is running on $(hostname) - closing it gracefully..."
+  pkill -TERM -u "$USER" -f "$PAT"
+  for _ in $(seq 1 10); do
+    pgrep -u "$USER" -f "$PAT" >/dev/null || break
+    sleep 1
+  done
+  if pgrep -u "$USER" -f "$PAT" >/dev/null; then
+    echo "Still running after 10s - force killing."
+    pkill -KILL -u "$USER" -f "$PAT"
+  fi
+fi
+EOF
+
+case "$MODE" in
+  waypipe) exec waypipe ssh "$HOST" chromium --ozone-platform=wayland ;;
+  x11)     exec ssh -X "$HOST" chromium ;;
+esac
diff --git a/setup-local.sh b/setup-local.sh
index 4214cf6..ecdc568 100755
--- a/setup-local.sh
+++ b/setup-local.sh
@@ -159,7 +159,7 @@ install_packages() {
   fi
 
   if sudo apt-get update -qq && sudo apt-get install -y -qq \
-      vim tmux mosh git curl ca-certificates jq gnupg firefox-esr code >/tmp/apt-install.log 2>&1; then
+      vim tmux mosh git curl ca-certificates jq gnupg firefox-esr code waypipe >/tmp/apt-install.log 2>&1; then
     step_ok "apt packages"
   else
     step_fail "apt packages" "see /tmp/apt-install.log"