diff --git a/.github/workflows/free-tests.yml b/.github/workflows/free-tests.yml
index 81a4dc154..eb9276a9c 100644
--- a/.github/workflows/free-tests.yml
+++ b/.github/workflows/free-tests.yml
@@ -432,32 +432,6 @@ jobs:
           sudo install -T -o root -g root -m 4755 "$helper" "$installed"
           test "$(stat -c '%u:%a' "$installed")" = '0:4755'
           cmp -s "$helper" "$installed"
-      - name: DIAG chromium launch on this image
-        run: |
-          set +e
-          grep -m1 -E 'Version' /etc/os-release; uname -a
-          cat "$RUNNER_TEMP/../../.setup_info" 2>/dev/null | head -20
-          for k in kernel.apparmor_restrict_unprivileged_userns kernel.apparmor_restrict_unprivileged_unconfined kernel.unprivileged_userns_clone user.max_user_namespaces kernel.yama.ptrace_scope; do echo "$k=$(sysctl -n $k 2>&1)"; done
-          findmnt -T "$HOME"; findmnt -T /tmp; findmnt -T /dev/shm
-          chrome=$(bun -e 'import { chromium } from "playwright"; console.log(chromium.executablePath())')
-          ls -l "${chrome%/*}/chrome-sandbox" "$chrome"
-          sudo aa-status 2>&1 | head -40
-          ls /etc/apparmor.d | head -60
-          unshare -Ur true && echo "unshare userns OK" || echo "unshare userns FAILED"
-          d=$(mktemp -d)
-          "$chrome" --headless=new --user-data-dir="$d/a" --dump-dom about:blank 2>&1 | tail -20; echo "plain exit=$?"
-          "$chrome" --headless=new --no-zygote --user-data-dir="$d/b" --dump-dom about:blank 2>&1 | tail -5; echo "nozygote exit=$?"
-          "$chrome" --headless=new --disable-namespace-sandbox --user-data-dir="$d/c" --dump-dom about:blank 2>&1 | tail -10; echo "suid-only exit=$?"
-          "$chrome" --headless=new --no-sandbox --user-data-dir="$d/e" --dump-dom about:blank 2>&1 | tail -5; echo "nosandbox exit=$?"
-          DEBUG=pw:browser node -e '
-            const { chromium } = require("playwright");
-            (async () => {
-              try { const c = await chromium.launchPersistentContext(process.argv[1], { headless: true, chromiumSandbox: true, args: ["--remote-debugging-pipe"] }); console.log("PW OK"); await c.close(); }
-              catch (e) { console.log("PW ERR", e.message.slice(0, 4000)); }
-            })();' "$d/pw" 2>&1 | tail -60
-          sudo dmesg 2>&1 | tail -30
-          sudo journalctl -k --no-pager 2>&1 | grep -iE 'apparmor|denied|audit' | tail -20
-          exit 1
 
       # Headed-browser tests (handoff, extension sidepanel DOM) need a real
       # DISPLAY — first Linux run failed with Playwright's "launched a headed
@@ -522,6 +496,20 @@ jobs:
       # GSTACK_EXPECT_BINARIES=1 arms make-pdf/test/e2e/ci-prereqs.test.ts:
       # if a future edit drops the gate build (or poppler), the lane FAILS
       # instead of the gates silently self-skipping back to false green.
+      - name: DIAG chromium sandbox on this image
+        run: |
+          set +e
+          grep -A1 'Runner Image' /dev/null
+          echo "restrict_userns=$(sysctl -n kernel.apparmor_restrict_unprivileged_userns) profiles=$(sudo aa-status --profiled 2>/dev/null)"
+          chrome=$(bun -e 'import { chromium } from "playwright"; console.log(chromium.executablePath())')
+          d=$(mktemp -d)
+          timeout 20 "$chrome" --headless=new --user-data-dir="$d/a" --dump-dom about:blank 2>&1 | head -12; echo "plain-before exit=${PIPESTATUS[0]}"
+          timeout 60 bun test browse/test/cookie-import-native.test.ts -t 'pipe smoke' 2>&1 | tail -4; echo "smoke-before exit=${PIPESTATUS[0]}"
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          unshare -Ur true && echo "unshare userns OK" || echo "unshare userns FAILED"
+          timeout 20 "$chrome" --headless=new --user-data-dir="$d/b" --dump-dom about:blank 2>&1 | head -5; echo "plain-after exit=${PIPESTATUS[0]}"
+          timeout 60 bun test browse/test/cookie-import-native.test.ts 2>&1 | tail -4; echo "file-after exit=${PIPESTATUS[0]}"
+          exit 1
       - name: Run free suite
         run: xvfb-run -a bun run test:free --ci-run "$RUNNER_TEMP/free-plan.json" --shard ${{ matrix.shard }} --result "$RUNNER_TEMP/free-results/shard-${{ matrix.shard }}.json"
         env: