diff --git a/popup.html b/popup.html
index 9220b1f..4465adf 100644
--- a/popup.html
+++ b/popup.html
@@ -88,6 +88,10 @@
               <button id="open-more" class="btn arrow" aria-label="More readers">▾</button>
               <div id="reader-menu" class="menu" hidden></div>
             </div>
+            <button id="share" class="icon-btn" aria-label="Share on Bluesky"
+                    title="Share on Bluesky">
+              <img src="/vendored/bluesky.png" alt="" width="14" height="14" />
+            </button>
             <button id="refresh" class="icon-btn" aria-label="Refresh"
                     title="Re-fetch publication and subscription state">
               <svg viewBox="0 0 24 24" width="14" height="14" fill="none" stroke="currentColor"
diff --git a/public/vendored/README.md b/public/vendored/README.md
index 5e2cfba..dd292c3 100644
--- a/public/vendored/README.md
+++ b/public/vendored/README.md
@@ -1,8 +1,8 @@
-# Vendored reader icons
+# Vendored icons
 
-Favicons of the reader sites in `src/lib/readers.ts`, vendored so the
-extension ships them instead of hot-linking third-party hosts. Fetched
-2026-08-08:
+Favicons of the reader sites in `src/lib/readers.ts`, and of the services
+the popup links out to, vendored so the extension ships them instead of
+hot-linking third-party hosts. Fetched 2026-08-08:
 
 - `standard.svg` — https://standard-reader.app/favicon.svg, as served.
 - `leaflet.png` — https://leaflet.pub/icon.png (96×96), downscaled to 32×32.
@@ -10,5 +10,10 @@ extension ships them instead of hot-linking third-party hosts. Fetched
 - `pdsls.png` — https://pdsls.dev/favicon.ico (actually a 512×512 WebP),
   converted to a 32×32 PNG.
 
+Fetched 2026-08-12:
+
+- `bluesky.png` — https://web-cdn.bsky.app/static/favicon-32x32.png, as
+  served. Used on the "Share on Bluesky" button in the popup.
+
 These are third-party marks; refresh them from the sources above rather
 than editing them.
diff --git a/public/vendored/bluesky.png b/public/vendored/bluesky.png
new file mode 100644
index 0000000000000000000000000000000000000000..a5ca7eed1e24b9554e417be0b81b5d0cf34bcdd5
GIT binary patch
literal 2240
zcmeAS@N?(olHy`uVBq!ia0y~yU{C;I4mJh`hT^KKFANL}jKx9jP7LeL$-HD>U^tc<
z;hE;^%b>-;z`()4#wf(V3{t|t$iToT#lQ+?GcbfPO2gT4j2ciiObiT+h73#$3=E<S
z3=C=QnG7sY^)(C--~r`>>440N)STSJlKditfTDZ_V?9$nLk0#0mI*9iGej5|7&a|n
zgqqFBz_5S`Zl1ydW&|5#w2^_4v6Z2bm64%>p@o%+xs|CY!{50=rx+L*I14-?iy0WW
zg+Z8+Vb&Z81_tI0nIRD+5xzcF$@#f@i7EL>sd^Q;1t60cY$~iOatm@(OA-|-a&z*E
zttxDlz$&crimgDx`br95B_-LmN)f&R3eNdOsS0L#26_fcc3cVy3N}S4X;wilZcyz-
zDQUJ!86_nJR{Hwo<>h+i#(Mch>H3D2mX`VkM*2oZx<x5zy2X`wC5aWfdBw^QLty5(
zq!uR^WfqiV=I1GZ%uP(nFD<cEQUY0|00R(rmSm<OY|1N!dMi0US05y!Z>VRWk4;-@
zMJ5hyAQ_z6Dsl_p-a@ggBC!CX2^<&@C)$8qU=<mZTAZI#3i6Acxsic^fq}juh_nGa
z5Jei{J&4u_{92Kv(X}FUhUR6K*cm}>LlZ{V<zJMUnpcttcB>&&3$hrJdQdP~ffIA2
zOJ;6rUU6oAo}ICgjXqWhtQsS5X+)Ah(pZsOVC9=yl9-ZMlIW6Hl4=J^{<?-nx<-Z}
zh89+)=2nI#x&{_j1_n0z7;4eXaV|<tEJ?*;3OExXn}Vbgn;H2<A^G_^cHn?O%heE9
zfb~OFK@G6c2c>DGG!9NP5YZqPH#;sHeQ;I-Wji~r)a8@H7#NtZd%8G=L~uS0kIo25
z7nt|cT-tH6+Hq5jZ)-Jcrz$C~*rLRx^=LN#(k=TUq&6J=w$`+B$Cb3lyn+X%J09^K
zon|MpXiCt^px+BzFHBqXB3RzV<mMXlHPvPRUz)ei`5N=>$(yLpi|pV0GyYs#oOZ5$
z=1tYAyX>!-&fHRayUk19;Z4Fa?qunor$Tgm@*=8SG7LGV8tKj5H~;x@U8xmO6N_hv
zt>j^{bpAF;^xvn03jY^w`)_TsVe2O8`K|vpYehzJ|E#S`j<|O&V&_xl#+|2BS{G%1
znvyQP!CddzQH#jmyn^+-%YCj~lzM08_TsFD!NT;GipiIilsA{3=wb0&v{PF@*Dvgx
z(hmlYjSpUBtTMUI@YDRGCYQlljp<LPpW9R7cZ$0~_VA+}k(T_IKQ&mYDg7{R4z`eU
ze$*Cs?DmW3qYF2<S{^%PX|r9u=ZLBJM&F%2iwjq*OLbJ$PJhvJCD!jebHq~Dea&~G
zzjF#Mu5?@c>|t6ytCpaSXRPJtZFi@#SZ#lscXyMDO;WjcrJiKcv7?KB3mOE9KIA<&
zp+-XWz&An8dbzFsi|z-Xc_IGob>F#Oe#;9RU3b;)i%Sie@OR(66Fu9%B~@`AcsSo}
z4%3{nJNFl_i1OL-dWG`whNW^B8uoX^`K%Y}I^mn+%Hkg?Zs~l*UH6`ro=2)X#~MS!
zJuDq(HFXw-t$xOKTFk;^?oRO|-Ij%H$Jl@Dnjn*>x9j-4*7q@+>pDs~4F3n&|K|x<
zd3TMv*qS3E{L?0Pgznbe_;j|Vj`k9*`H6|s6{aq$c5wRTpJ0FfNOd>!pWq3?-UryN
zx1X}v_D%TC+tdwvTm4t}n_6V|?`%B$ZE^OQdG3F0!p`eYb6BUaH!Owy#QUqo6^^%q
zw|sk>@s@SVx1tY{3t284eYSXF3{zs%gfBu*Cw{Dpvkk1>d;A*T!mNl-UuVqX>}zxD
z{U*q}QR};|Zs<Yzhb%3d>@J+>Df*>dvETgASIcQHW#g||PHB+%TrA)-Ir0a)&T|hb
z{TAt8#w*&-G009?W2{x*-0*CY)tyzRi=&LMgqjv9PhHEhFk8dnz1lp+SIOdkQ)O4Y
zw0DZ!S3l$VqZew|X4QqxpKlcN<)44^!Kw1Mm`taz{ZulpU;0Uf`RbLNuZ17J|17$s
zbEY=AxyG{VxKM!8#`)!ou8J*sGD|N`cmKQBM`dK2=WOBiFWhgZ_w}>jeEB)A)fTjT
zJa~q|YkA)B#|xOBa2qe1t?y)(BO6}H`|U^G3BMA-Z*p&bcXsSu*2bTB_D@WPwnzBt
z3sH)<b#vBDIaMNab<MlG*XKX}VZ5+&%f^NGm%Y-z_xVj6>q~p3EW6ELmY6;R)xw^x
KelF{r5}E*_M>Vnl

literal 0
HcmV?d00001

diff --git a/src/lib/share.test.ts b/src/lib/share.test.ts
new file mode 100644
index 0000000..0d82dcd
--- /dev/null
+++ b/src/lib/share.test.ts
@@ -0,0 +1,87 @@
+// What the composer is handed: which URL, and a title cut to fit around it.
+
+import { describe, expect, it } from 'vitest'
+import { POST_LIMIT, composeUrl, graphemes, shareText, shareUrl, truncate } from './share'
+import type { DocInfo, PubInfo } from './types'
+
+const pub: PubInfo = {
+  uri: 'at://did:plc:sharetest000000000000000/site.standard.publication/self',
+  did: 'did:plc:sharetest000000000000000',
+  handle: 'pub.example',
+  pds: 'https://pds.example.com',
+  record: { $type: 'site.standard.publication', url: 'https://pub.example/', name: 'Wobbegong' },
+  verified: true,
+}
+
+const doc: DocInfo = {
+  uri: 'at://did:plc:sharetest000000000000000/site.standard.document/3kdoc',
+  record: {
+    $type: 'site.standard.document',
+    site: pub.uri,
+    title: 'On quarrying granite',
+    publishedAt: '2026-08-12T00:00:00.000Z',
+    path: '/posts/granite',
+  },
+}
+
+describe('shareUrl', () => {
+  it('shares the page the reader is actually on', () => {
+    expect(shareUrl(pub, doc, 'https://pub.example/posts/granite?utm=x')).toBe(
+      'https://pub.example/posts/granite?utm=x',
+    )
+  })
+
+  it('rebuilds the article url from the record when there is no page url', () => {
+    expect(shareUrl(pub, doc)).toBe('https://pub.example/posts/granite')
+  })
+
+  it('falls back to the publication when the page is not an article', () => {
+    expect(shareUrl(pub)).toBe('https://pub.example/')
+  })
+
+  it('refuses a page url that is not http(s)', () => {
+    expect(shareUrl(pub, undefined, 'chrome://extensions')).toBe('https://pub.example/')
+  })
+})
+
+describe('shareText', () => {
+  it('leads with the article title and follows with the link', () => {
+    expect(shareText(pub, doc, 'https://pub.example/posts/granite')).toBe(
+      'On quarrying granite\n\nhttps://pub.example/posts/granite',
+    )
+  })
+
+  it('uses the publication name when the page is not an article', () => {
+    expect(shareText(pub, undefined, 'https://pub.example/')).toBe(
+      'Wobbegong\n\nhttps://pub.example/',
+    )
+  })
+
+  it('cuts the title, never the link, and stays inside Bluesky’s limit', () => {
+    const long = { ...doc, record: { ...doc.record, title: 'granite '.repeat(60) } }
+    const text = shareText(pub, long, 'https://pub.example/posts/granite')
+    expect(graphemes(text!).length).toBeLessThanOrEqual(POST_LIMIT)
+    expect(text).toContain('https://pub.example/posts/granite')
+    expect(text).toContain('…')
+  })
+
+  it('drops the title entirely when the link alone fills the post', () => {
+    const url = `https://pub.example/${'x'.repeat(295)}`
+    expect(shareText(pub, doc, url)).toBe(url)
+  })
+})
+
+describe('truncate', () => {
+  it('counts what a person would count, not code units', () => {
+    // Four code units, one grapheme.
+    expect(truncate('👩‍🌾abc', 2)).toBe('👩‍🌾…')
+  })
+})
+
+describe('composeUrl', () => {
+  it('percent-encodes the text into Bluesky’s documented intent link', () => {
+    const u = new URL(composeUrl('a b\n\nhttps://pub.example/'))
+    expect(u.origin + u.pathname).toBe('https://bsky.app/intent/compose')
+    expect(u.searchParams.get('text')).toBe('a b\n\nhttps://pub.example/')
+  })
+})
diff --git a/src/lib/share.ts b/src/lib/share.ts
new file mode 100644
index 0000000..1bfca29
--- /dev/null
+++ b/src/lib/share.ts
@@ -0,0 +1,95 @@
+// "Share on Bluesky": hand the article to Bluesky's composer and stop.
+//
+// Why a compose intent and not a post we write ourselves:
+//
+//   - Posting from here would need `repo:app.bsky.feed.post` in
+//     oauth/client-metadata.json, which means a hosted metadata deploy before
+//     any release that ships it, re-consent for every existing session, and a
+//     failure mode ("this sign-in cannot post") that the feedback form already
+//     demonstrates. The intent link needs no scope and no session at all: it
+//     works signed out.
+//   - A record embed (app.bsky.embed.record with a strongRef) can technically
+//     point at a `site.standard.document`, but the Bluesky appview hydrates
+//     only the record types it knows, so a document would arrive in the feed
+//     as a not-found quote. What the Bluesky client itself builds when you
+//     paste a URL is app.bsky.embed.external — a link card from the page's own
+//     Open Graph tags — and that is exactly what the composer will build from
+//     the URL this link hands it.
+//
+// So the text is a title and a URL, and Bluesky does the rest.
+
+import type { DocInfo, PubInfo } from './types'
+import { pubSiteUrl } from './readers'
+
+/** Bluesky's documented compose intent (docs.bsky.app "Action Intent Links"). */
+const COMPOSE = 'https://bsky.app/intent/compose'
+
+/**
+ * Bluesky's own limit on a post, which the intent link inherits: 300
+ * *grapheme clusters*, not code units. A long title is cut rather than
+ * refused, and the URL is what must survive the cut.
+ */
+export const POST_LIMIT = 300
+
+const segmenter =
+  typeof Intl !== 'undefined' && 'Segmenter' in Intl
+    ? new Intl.Segmenter(undefined, { granularity: 'grapheme' })
+    : undefined
+
+export function graphemes(text: string): string[] {
+  if (!segmenter) return [...text]
+  return [...segmenter.segment(text)].map((s) => s.segment)
+}
+
+/** Cut to `limit` graphemes, marking the cut when there was one. */
+export function truncate(text: string, limit: number): string {
+  const parts = graphemes(text)
+  if (parts.length <= limit) return text
+  if (limit <= 1) return '…'
+  return `${parts.slice(0, limit - 1).join('').trimEnd()}…`
+}
+
+/**
+ * The page the share should point at: the article when the popup knows one,
+ * the publication's own site otherwise. `pageUrl` — the tab the popup is open
+ * on — wins over a reconstructed document URL, since it is the URL the reader
+ * actually reached and the one whose Open Graph tags the composer will read.
+ */
+export function shareUrl(pub: PubInfo, doc?: DocInfo, pageUrl?: string): string | null {
+  if (pageUrl && /^https?:\/\//.test(pageUrl)) return pageUrl
+  const site = pubSiteUrl(pub)
+  if (!site || !doc?.record.path) return site
+  const path = doc.record.path.startsWith('/') ? doc.record.path : `/${doc.record.path}`
+  return site.replace(/\/+$/, '') + path
+}
+
+/**
+ * What lands in the composer: the article's title (or the publication's name
+ * when the page is not an article) and the link, with the title cut to
+ * whatever room the link leaves. Nothing is posted here — the reader still
+ * has to press post in Bluesky, and can edit every word of it first.
+ */
+export function shareText(pub: PubInfo, doc?: DocInfo, pageUrl?: string): string | null {
+  const url = shareUrl(pub, doc, pageUrl)
+  if (!url) return null
+  const title = (doc?.record.title ?? pub.record.name).trim()
+  const room = POST_LIMIT - graphemes(url).length - 2
+  if (room < 8) return url
+  return `${truncate(title, room)}\n\n${url}`
+}
+
+export function composeUrl(text: string): string {
+  const u = new URL(COMPOSE)
+  u.searchParams.set('text', text)
+  return u.toString()
+}
+
+/** The whole thing: the link to open, or null when there is nothing to share. */
+export function shareOnBlueskyUrl(
+  pub: PubInfo,
+  doc?: DocInfo,
+  pageUrl?: string,
+): string | null {
+  const text = shareText(pub, doc, pageUrl)
+  return text ? composeUrl(text) : null
+}
diff --git a/src/popup/popup.ts b/src/popup/popup.ts
index c074756..08b15f8 100644
--- a/src/popup/popup.ts
+++ b/src/popup/popup.ts
@@ -22,6 +22,7 @@ import { isScopeError } from '../lib/scope'
 import { type Owner, fetchOwner, ownerName, ownerSubtitle } from '../lib/profile'
 import { SESSION_EXPIRED_KEY, getStoredSession } from '../lib/session-store'
 import { DEFAULT_READER_ID, READERS, type Reader, docUrl, pubSiteUrl, pubUrl } from '../lib/readers'
+import { shareOnBlueskyUrl } from '../lib/share'
 import { type StatusMessage, statusMessagesFor } from '../lib/status'
 import {
   type FollowedSubscriber,
@@ -264,6 +265,7 @@ function render() {
   renderLabels()
   renderSubscribe()
   renderOpen()
+  renderShare()
 }
 
 // Shape-coded tone icons (triangle = warn, circle = error) so a pill's
@@ -772,6 +774,19 @@ function renderOpen() {
   }
 }
 
+/**
+ * Hands the article to Bluesky's composer; nothing is posted from here, and
+ * the button works signed out because the intent link needs no session
+ * (src/lib/share.ts).
+ */
+function renderShare() {
+  const pub = state?.pub
+  const url = pub ? shareOnBlueskyUrl(pub, state?.doc, state?.url) : null
+  const btn = $<HTMLButtonElement>('share')
+  btn.disabled = !url
+  btn.dataset.url = url ?? ''
+}
+
 function openUrl(url: string) {
   chrome.tabs.create({ url })
   window.close()
@@ -997,6 +1012,11 @@ $('signout').addEventListener('click', async () => {
   void loadLabels(false)
 })
 
+$('share').addEventListener('click', () => {
+  const url = $<HTMLButtonElement>('share').dataset.url
+  if (url) openUrl(url)
+})
+
 $('refresh').addEventListener('click', () => loadState(true))
 
 // Per popup open, and per publication: closing the popup puts the cover back.