diff --git a/ci/fedora-rpm.Dockerfile b/ci/fedora-rpm.Dockerfile
index 3087481..faaf45d 100644
--- a/ci/fedora-rpm.Dockerfile
+++ b/ci/fedora-rpm.Dockerfile
@@ -1,11 +1,15 @@
-# CI builder for the punktfunk RPM — Fedora 43 to match Bazzite's base (so the RPM's
-# auto-generated library Requires, e.g. libavcodec.so.NN, pin to exactly what the target
-# runs). Used by .gitea/workflows/rpm.yml; built+pushed by .gitea/workflows/docker.yml.
+# CI builder for the punktfunk RPM. The Fedora version is parameterized so one Dockerfile
+# serves every target whose ffmpeg soname must match: Fedora 43 == Bazzite's base (group
+# "bazzite"), Fedora 44 == the Fedora KDE spin (group "fedora-44"). The RPM's auto-generated
+# library Requires (e.g. libavcodec.so.NN) pin to exactly what the chosen base — and thus the
+# target — ships. Used by .gitea/workflows/rpm.yml; built+pushed by .gitea/workflows/docker.yml.
 #
-#   docker build -f ci/fedora-rpm.Dockerfile -t punktfunk-fedora-rpm ci
+#   docker build --build-arg FEDORA_VERSION=43 -f ci/fedora-rpm.Dockerfile -t punktfunk-fedora-rpm ci
+#   docker build --build-arg FEDORA_VERSION=44 -f ci/fedora-rpm.Dockerfile -t punktfunk-fedora44-rpm ci
 #
 # Mirrors ci/rust-ci.Dockerfile (the Ubuntu workspace builder) for the rpmbuild side.
-FROM fedora:43
+ARG FEDORA_VERSION=43
+FROM fedora:${FEDORA_VERSION}
 
 # RPM Fusion (free + nonfree) provides the NVENC-capable ffmpeg-devel the host links against.
 RUN dnf -y install \
diff --git a/packaging/kde/host.env b/packaging/kde/host.env
new file mode 100644
index 0000000..7f25161
--- /dev/null
+++ b/packaging/kde/host.env
@@ -0,0 +1,12 @@
+# punktfunk host config for a Fedora/Ubuntu KDE Plasma appliance (kwin backend).
+# Copy to ~/.config/punktfunk/host.env. Pairs with punktfunk-kde-session.service, which brings
+# up a headless `kwin --virtual` on wayland-kde (with KWIN_WAYLAND_NO_PERMISSION_CHECKS=1 so the
+# host can bind KWin's privileged zkde_screencast protocol — an interactive Plasma session will
+# NOT hand that protocol to an external client). The host streams a per-client virtual output
+# from that session, captured zero-copy (dmabuf -> CUDA -> NVENC) on NVIDIA.
+WAYLAND_DISPLAY=wayland-kde
+XDG_CURRENT_DESKTOP=KDE
+PUNKTFUNK_COMPOSITOR=kwin
+PUNKTFUNK_VIDEO_SOURCE=virtual
+PUNKTFUNK_ZEROCOPY=1
+PUNKTFUNK_INPUT_BACKEND=libei
diff --git a/packaging/rpm/punktfunk.spec b/packaging/rpm/punktfunk.spec
index e81d10e..67e6184 100644
--- a/packaging/rpm/punktfunk.spec
+++ b/packaging/rpm/punktfunk.spec
@@ -140,6 +140,13 @@ install -Dm0644 scripts/punktfunk-host.service %{buildroot}%{_userunitdir}/punkt
 # %{_bindir}. Rewrite it so a fresh install (no hand-rolled unit) starts the installed binary.
 sed -i 's#%h/punktfunk/target/release/punktfunk-host#%{_bindir}/punktfunk-host#' %{buildroot}%{_userunitdir}/punktfunk-host.service
 
+# Optional headless KDE session unit (the kwin streaming appliance): brings up `kwin --virtual` on
+# wayland-kde via the packaged run-headless-kde.sh, so the host's kwin backend has a session whose
+# privileged screencast protocol it can bind. Repoint its ExecStart from the dev source tree to the
+# installed script. NOT enabled by default — only kwin-backend hosts (e.g. Fedora/Ubuntu KDE) need it.
+install -Dm0644 scripts/punktfunk-kde-session.service %{buildroot}%{_userunitdir}/punktfunk-kde-session.service
+sed -i 's#%h/punktfunk/scripts/headless/run-headless-kde.sh#%{_datadir}/%{name}/headless/run-headless-kde.sh#' %{buildroot}%{_userunitdir}/punktfunk-kde-session.service
+
 # --- client subpackage ---
 install -Dm0755 target/release/punktfunk-client %{buildroot}%{_bindir}/punktfunk-client
 install -Dm0644 packaging/linux/io.unom.Punktfunk.desktop \
@@ -154,6 +161,7 @@ install -Dm0755 scripts/headless/run-headless-kde.sh   %{buildroot}%{_datadir}/%
 install -Dm0755 scripts/headless/run-headless-sway.sh  %{buildroot}%{_datadir}/%{name}/headless/run-headless-sway.sh
 install -Dm0644 scripts/host.env.example               %{buildroot}%{_datadir}/%{name}/host.env.example
 install -Dm0644 packaging/bazzite/host.env             %{buildroot}%{_datadir}/%{name}/host.env.bazzite
+install -Dm0644 packaging/kde/host.env                 %{buildroot}%{_datadir}/%{name}/host.env.kde
 install -Dm0644 docs/api/openapi.json                  %{buildroot}%{_datadir}/%{name}/openapi.json
 
 %files
@@ -163,6 +171,7 @@ install -Dm0644 docs/api/openapi.json                  %{buildroot}%{_datadir}/%
 %{_udevrulesdir}/60-punktfunk.rules
 %{_prefix}/lib/sysctl.d/99-punktfunk-net.conf
 %{_userunitdir}/punktfunk-host.service
+%{_userunitdir}/punktfunk-kde-session.service
 %dir %{_datadir}/%{name}
 %{_datadir}/%{name}/*