diff --git a/apps/gui/src-tauri/src/main.rs b/apps/gui/src-tauri/src/main.rs
index 905bb01..aff2e7f 100644
--- a/apps/gui/src-tauri/src/main.rs
+++ b/apps/gui/src-tauri/src/main.rs
@@ -247,6 +247,7 @@ fn main() {
             std::thread::spawn(move || responder.respond(serve_file(&eng, &request)));
         })
         .setup(|app| {
+            use tauri::{Listener, Manager};
             // When launched elevated by the unprivileged instance, terminate the old process.
             #[cfg(unix)]
             if let Some(pid) = std::env::var("GUARA_REPLACE_PID")
@@ -264,15 +265,42 @@ fn main() {
                 });
             }
 
-            // Reading raw disks requires root: request elevation as soon as the app launches,
-            // without waiting for the user to look for a button. If authorization fails,
-            // the window stays open and the UI displays a warning.
+            // The window starts hidden (tauri.conf.json: "visible": false) so the
+            // unprivileged instance never flashes on screen before being replaced.
+            // Reading raw disks requires root: request elevation as soon as the app
+            // launches, without waiting for the user to look for a button, and only
+            // show a window once we know which one it is — the elevated relaunch's,
+            // or this same one if elevation turned out not to be needed/possible.
             #[cfg(any(target_os = "linux", target_os = "macos"))]
-            if unsafe { libc::geteuid() != 0 } && std::env::var("GUARA_REPLACE_PID").is_err() {
-                let handle = app.handle().clone();
-                std::thread::spawn(move || {
-                    let _ = do_relaunch_elevated(handle);
-                });
+            {
+                if unsafe { libc::geteuid() != 0 } && std::env::var("GUARA_REPLACE_PID").is_err() {
+                    use tauri::Emitter;
+                    let handle = app.handle().clone();
+                    let handle_for_failure = app.handle().clone();
+                    std::thread::spawn(move || {
+                        // do_relaunch_elevated only emits "elevate-failed" itself once the
+                        // child process has actually spawned and later exits non-zero. If it
+                        // fails earlier (pkexec/osascript missing, exe path unresolved, log
+                        // file unwritable), it returns Err directly without emitting anything
+                        // — emit it here too, or the hidden window would never reappear.
+                        if let Err(e) = do_relaunch_elevated(handle) {
+                            let _ = handle_for_failure.emit("elevate-failed", e);
+                        }
+                    });
+                    // Whichever path emits it, make sure the window comes back so the
+                    // user sees the warning instead of a silently stuck, invisible app.
+                    if let Some(win) = app.get_webview_window("main") {
+                        app.handle().listen("elevate-failed", move |_| {
+                            let _ = win.show();
+                        });
+                    }
+                } else if let Some(win) = app.get_webview_window("main") {
+                    let _ = win.show();
+                }
+            }
+            #[cfg(not(any(target_os = "linux", target_os = "macos")))]
+            if let Some(win) = app.get_webview_window("main") {
+                let _ = win.show();
             }
             Ok(())
         })
diff --git a/apps/gui/src-tauri/tauri.conf.json b/apps/gui/src-tauri/tauri.conf.json
index 39706f8..12085b2 100644
--- a/apps/gui/src-tauri/tauri.conf.json
+++ b/apps/gui/src-tauri/tauri.conf.json
@@ -15,7 +15,8 @@
         "height": 780,
         "minWidth": 420,
         "minHeight": 560,
-        "resizable": true
+        "resizable": true,
+        "visible": false
       }
     ],
     "security": {