diff --git a/Makefile b/Makefile
index 9a70f903a89..a13950018f6 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,7 @@ SHELLCHECK_IMAGE ?= docker.io/koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a
 
 CONTAINER_RUNTIME ?= $(shell hash docker >/dev/null 2>&1 && echo docker || echo podman)
 
-PLAYWRIGHT_BROWSERS ?= chromium firefox $(if $(filter Darwin,$(shell uname -s 2>/dev/null)),webkit)
+PLAYWRIGHT_BROWSERS ?= chromium firefox webkit
 PLAYWRIGHT_FLAGS ?=
 
 HAS_GO := $(shell hash $(GO) > /dev/null 2>&1 && echo yes)
diff --git a/playwright.config.ts b/playwright.config.ts
index 4e52b123037..fcadecd4f89 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -1,4 +1,4 @@
-import {env, platform} from 'node:process';
+import {env} from 'node:process';
 import {defineConfig, devices} from '@playwright/test';
 
 const timeoutFactor = Number(env.GITEA_TEST_E2E_TIMEOUT_FACTOR) || 1;
@@ -41,12 +41,12 @@ export default defineConfig({
         },
       },
     },
-    ...(platform === 'darwin' ? [{ // webkit on linux is unstable
+    {
       name: 'webkit',
       use: {
         ...devices['Desktop Safari'],
         permissions: ['clipboard-read'],
       },
-    }] : []),
+    },
   ],
 });
diff --git a/tests/e2e/webauthn.test.ts b/tests/e2e/webauthn.test.ts
index 64f6edf935d..9816a4a0048 100644
--- a/tests/e2e/webauthn.test.ts
+++ b/tests/e2e/webauthn.test.ts
@@ -1,3 +1,4 @@
+import {platform} from 'node:process';
 import {test, expect, type Page} from '@playwright/test';
 import {apiCreateUser, loginUser, randomString, testUserPassword} from './utils.ts';
 
@@ -48,7 +49,9 @@ test('security key survives credProtect', async ({page, request, browserName}) =
 });
 
 // this authenticator has no credProtect, so it cannot replace the test above
-test('security key signs in as second factor and as passkey', async ({page, request}) => {
+test('security key signs in as second factor and as passkey', async ({page, request, browserName}) => {
+  test.skip(browserName === 'webkit' && platform === 'linux', 'linux webkit has no webauthn, playwright only stubs PublicKeyCredential'); // eslint-disable-line playwright/no-skipped-test -- conditional skip, the reason is in the message
+
   const username = `e2e-passkey-${randomString(8)}`;
   await apiCreateUser(request, username);
   await page.context().credentials.install();
diff --git a/tools/playwright.sh b/tools/playwright.sh
index 9148b01481e..90dd7e2b4ca 100755
--- a/tools/playwright.sh
+++ b/tools/playwright.sh
@@ -1,8 +1,8 @@
 #!/bin/bash
 set -euo pipefail
 
-# playwright only supports ubuntu/debian officially, and on CI VMs its system deps are pre-installed
-if [ -z "${GITHUB_ACTIONS:-}" ] && [ "$(uname -s)" = "Linux" ] && grep -qE '^ID(_LIKE)?=.*(ubuntu|debian)' /etc/os-release 2>/dev/null; then
+# playwright only supports ubuntu/debian officially
+if [ "$(uname -s)" = "Linux" ] && grep -qE '^ID(_LIKE)?=.*(ubuntu|debian)' /etc/os-release 2>/dev/null; then
   if [ "$(id -u)" = 0 ] || { command -v sudo >/dev/null 2>&1 && sudo -n true >/dev/null 2>&1; }; then # Avoid Playwright's interactive su fallback.
     pnpm exec playwright install --with-deps "$@"
   else