diff --git a/lib/session.sh b/lib/session.sh
index 8454b57..421b2d2 100644
--- a/lib/session.sh
+++ b/lib/session.sh
@@ -125,4 +125,15 @@ UNIT
         sudo ln -sf ../polkit-agent.service \
             /etc/systemd/user/graphical-session.target.wants/polkit-agent.service
     fi
+
+    # libvirt group: members manage qemu:///system without a polkit prompt.
+    # Without this, virt-manager dies on "access denied by policy" even with
+    # a working agent (VM-proven). Idempotent; applies after re-login.
+    if pkg_installed libvirt; then
+        local real_user="${SUDO_USER:-$USER}"
+        if ! id -nG "$real_user" 2>/dev/null | grep -qw libvirt; then
+            info "Adding $real_user to the libvirt group (re-login to apply)..."
+            sudo usermod -aG libvirt "$real_user"
+        fi
+    fi
 }