diff --git a/docs/operations.md b/docs/operations.md
index b4e53d5..0073983 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -12,7 +12,7 @@
 - `internal/codex`: the `codex app-server` JSON-RPC client, with types generated from the CLI's schema by `go generate ./internal/codex` (see `docs/codex-protocol.md`).
 - `internal/tailscale`: `tailscale serve` for task previews (see "Previews").
 - `internal/workflow`: validating workflow definitions and reading and writing their YAML files (see "Workflows").
-- `web/`: the SPA, frameworkless TypeScript compiled file-by-file to ES modules (no bundler). `web/src/*.ts` is the source; `web/src/api.gen.ts` holds types generated from `api/openapi.yaml`, and `web/src/api.ts` is the typed client over them. `go generate ./web` runs `npm ci`, regenerates the types and compiles `web/dist/`, which is committed so `go install` needs no Node. The binary embeds `index.html`, `style.css`, `favicon.svg` (a lead dot in the accent colour with spokes to five task-coloured dots; its colours are copies of the `web/style.css` palette, switching with the light/dark scheme), `dist/`, `src/` (for source maps), `fonts/` and `vendor/` (Mermaid, see "Inbox"; xterm.js, see "Terminals"). `byre serve --dev` serves `./web` from disk instead (run from the repo root); pair it with `npm --prefix web exec tsc -- --watch`.
+- `web/`: the SPA, frameworkless TypeScript compiled file-by-file to ES modules (no bundler). `web/src/*.ts` is the source; `web/src/api.gen.ts` holds types generated from `api/openapi.yaml`, and `web/src/api.ts` is the typed client over them. `go generate ./web` runs `npm ci`, regenerates the types and compiles `web/dist/`, which is committed so `go install` needs no Node. The binary embeds `index.html`, `style.css`, `favicon.svg` (a lead dot in the accent colour with spokes to five task-coloured dots; its colours are copies of the `web/style.css` palette, switching with the light/dark scheme), `favicon.png` (the same icon in its light colours at 180×180, linked as a second icon and as the `apple-touch-icon`, which Orion prefers over the SVG for its tab icon; Orion's icon store (`~/Library/Application Support/Orion/Defaults/website_icons`, kept apart from its cache) keys icons by hostname without the port, so another server on the same hostname can supply byre's tab icon; regenerate it after changing the SVG with `rsvg-convert --width 180 --height 180 --output web/favicon.png web/favicon.svg`), `dist/`, `src/` (for source maps), `fonts/` and `vendor/` (Mermaid, see "Inbox"; xterm.js, see "Terminals"). `byre serve --dev` serves `./web` from disk instead (run from the repo root); pair it with `npm --prefix web exec tsc -- --watch`.
 
 ## Data
 
diff --git a/web/embed.go b/web/embed.go
index 71b44f2..8e704d5 100644
--- a/web/embed.go
+++ b/web/embed.go
@@ -5,5 +5,5 @@ import "embed"
 //go:generate npm ci --silent
 //go:generate npm run --silent generate
 
-//go:embed index.html style.css favicon.svg dist src fonts vendor
+//go:embed index.html style.css favicon.svg favicon.png dist src fonts vendor
 var FS embed.FS
diff --git a/web/favicon.png b/web/favicon.png
new file mode 100644
index 0000000..2729847
Binary files /dev/null and b/web/favicon.png differ
diff --git a/web/index.html b/web/index.html
index 5b9f70f..85acf47 100644
--- a/web/index.html
+++ b/web/index.html
@@ -5,6 +5,8 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>byre</title>
 <link rel="icon" href="/favicon.svg" type="image/svg+xml">
+<link rel="icon" href="/favicon.png" type="image/png" sizes="180x180">
+<link rel="apple-touch-icon" href="/favicon.png">
 <link rel="stylesheet" href="/style.css">
 <script type="module" src="/dist/app.js"></script>
 </head>