diff --git a/Coder-Desktop/Coder-Desktop/Coder_DesktopApp.swift b/Coder-Desktop/Coder-Desktop/Coder_DesktopApp.swift
index d9cd649..4d78735 100644
--- a/Coder-Desktop/Coder-Desktop/Coder_DesktopApp.swift
+++ b/Coder-Desktop/Coder-Desktop/Coder_DesktopApp.swift
@@ -17,8 +17,8 @@ struct DesktopApp: App {
         Window("Sign In", id: Windows.login.rawValue) {
             LoginForm()
                 .environmentObject(appDelegate.state)
-        }
-        .windowResizability(.contentSize)
+        }.handlesExternalEvents(matching: Set()) // Don't handle deep links
+            .windowResizability(.contentSize)
         SwiftUI.Settings {
             SettingsView<CoderVPNService>()
                 .environmentObject(appDelegate.vpn)
@@ -30,7 +30,7 @@ struct DesktopApp: App {
                 .environmentObject(appDelegate.state)
                 .environmentObject(appDelegate.fileSyncDaemon)
                 .environmentObject(appDelegate.vpn)
-        }
+        }.handlesExternalEvents(matching: Set()) // Don't handle deep links
     }
 }
 
@@ -40,6 +40,7 @@ class AppDelegate: NSObject, NSApplicationDelegate {
     let vpn: CoderVPNService
     let state: AppState
     let fileSyncDaemon: MutagenDaemon
+    let urlHandler: URLHandler
 
     override init() {
         vpn = CoderVPNService()
@@ -65,6 +66,7 @@ class AppDelegate: NSObject, NSApplicationDelegate {
             await fileSyncDaemon.tryStart()
         }
         self.fileSyncDaemon = fileSyncDaemon
+        urlHandler = URLHandler(state: state, vpn: vpn)
     }
 
     func applicationDidFinishLaunching(_: Notification) {
@@ -134,6 +136,17 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         return true
     }
 
+    func application(_: NSApplication, open urls: [URL]) {
+        guard let url = urls.first else {
+            // We only accept one at time, for now
+            return
+        }
+        do { try urlHandler.handle(url) } catch {
+            // TODO: Push notification
+            print(error.description)
+        }
+    }
+
     private func displayIconHiddenAlert() {
         let alert = NSAlert()
         alert.alertStyle = .informational
diff --git a/Coder-Desktop/Coder-Desktop/Info.plist b/Coder-Desktop/Coder-Desktop/Info.plist
index 5e59b25..4712604 100644
--- a/Coder-Desktop/Coder-Desktop/Info.plist
+++ b/Coder-Desktop/Coder-Desktop/Info.plist
@@ -2,6 +2,21 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>CFBundleURLTypes</key>
+	<array>
+		<dict>
+			<key>CFBundleTypeRole</key>
+			<string>Editor</string>
+			<key>CFBundleURLIconFile</key>
+			<string>1024Icon</string>
+			<key>CFBundleURLName</key>
+			<string>com.coder.Coder-Desktop</string>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>coder</string>
+			</array>
+		</dict>
+	</array>
 	<key>NSAppTransportSecurity</key>
 	<dict>
 		<!--
diff --git a/Coder-Desktop/Coder-Desktop/URLHandler.swift b/Coder-Desktop/Coder-Desktop/URLHandler.swift
new file mode 100644
index 0000000..191c19d
--- /dev/null
+++ b/Coder-Desktop/Coder-Desktop/URLHandler.swift
@@ -0,0 +1,39 @@
+import Foundation
+import VPNLib
+
+@MainActor
+class URLHandler {
+    let state: AppState
+    let vpn: any VPNService
+    let router: CoderRouter
+
+    init(state: AppState, vpn: any VPNService) {
+        self.state = state
+        self.vpn = vpn
+        router = CoderRouter()
+    }
+
+    func handle(_ url: URL) throws(RouterError) {
+        guard state.hasSession, let deployment = state.baseAccessURL else {
+            throw .noSession
+        }
+        guard deployment.host() == url.host else {
+            throw .invalidAuthority(url.host() ?? "<none>")
+        }
+        do {
+            switch try router.match(url: url) {
+            case let .open(workspace, agent, type):
+                switch type {
+                case let .rdp(creds):
+                    handleRDP(workspace: workspace, agent: agent, creds: creds)
+                }
+            }
+        } catch {
+            throw .matchError(url: url)
+        }
+
+        func handleRDP(workspace _: String, agent _: String, creds _: RDPCredentials) {
+            // TODO: Handle RDP
+        }
+    }
+}
diff --git a/Coder-Desktop/Resources/1024Icon.png b/Coder-Desktop/Resources/1024Icon.png
new file mode 100644
index 0000000..cc20c78
Binary files /dev/null and b/Coder-Desktop/Resources/1024Icon.png differ
diff --git a/Coder-Desktop/VPNLib/CoderRouter.swift b/Coder-Desktop/VPNLib/CoderRouter.swift
new file mode 100644
index 0000000..de849e7
--- /dev/null
+++ b/Coder-Desktop/VPNLib/CoderRouter.swift
@@ -0,0 +1,64 @@
+import Foundation
+import URLRouting
+
+// This is in VPNLib to avoid depending on `swift-collections` in both the app & extension.
+public struct CoderRouter: ParserPrinter {
+    public init() {}
+
+    public var body: some ParserPrinter<URLRequestData, CoderRoute> {
+        Route(.case(CoderRoute.open(workspace:agent:route:))) {
+            Scheme("coder")
+            // v0/open/ws/<workspace>/agent/<agent>/<openType>
+            Path { "v0"; "open"; "ws"; Parse(.string); "agent"; Parse(.string) }
+            openRouter
+        }
+    }
+
+    var openRouter: some ParserPrinter<URLRequestData, OpenRoute> {
+        OneOf {
+            Route(.memberwise(OpenRoute.rdp)) {
+                Path { "rdp" }
+                Query {
+                    Parse(.memberwise(RDPCredentials.init)) {
+                        Optionally { Field("username") }
+                        Optionally { Field("password") }
+                    }
+                }
+            }
+        }
+    }
+}
+
+public enum RouterError: Error {
+    case invalidAuthority(String)
+    case matchError(url: URL)
+    case noSession
+
+    public var description: String {
+        switch self {
+        case let .invalidAuthority(authority):
+            "Authority '\(authority)' does not match the host of the current Coder deployment."
+        case let .matchError(url):
+            "Failed to handle \(url.absoluteString) because the format is unsupported."
+        case .noSession:
+            "Not logged in."
+        }
+    }
+
+    public var localizedDescription: String { description }
+}
+
+public enum CoderRoute: Equatable, Sendable {
+    case open(workspace: String, agent: String, route: OpenRoute)
+}
+
+public enum OpenRoute: Equatable, Sendable {
+    case rdp(RDPCredentials)
+}
+
+// Due to a Swift Result builder limitation, we can't flatten this out to `case rdp(String?, String?)`
+// https://github.com/pointfreeco/swift-url-routing/issues/50
+public struct RDPCredentials: Equatable, Sendable {
+    public let username: String?
+    public let password: String?
+}
diff --git a/Coder-Desktop/VPNLibTests/CoderRouterTests.swift b/Coder-Desktop/VPNLibTests/CoderRouterTests.swift
new file mode 100644
index 0000000..2d47dd6
--- /dev/null
+++ b/Coder-Desktop/VPNLibTests/CoderRouterTests.swift
@@ -0,0 +1,108 @@
+import Foundation
+import Testing
+import URLRouting
+@testable import VPNLib
+
+@MainActor
+@Suite(.timeLimit(.minutes(1)))
+struct CoderRouterTests {
+    let router: CoderRouter
+
+    init() {
+        router = CoderRouter()
+    }
+
+    struct RouteTestCase: CustomStringConvertible, Sendable {
+        let urlString: String
+        let expectedRoute: CoderRoute?
+        let description: String
+    }
+
+    @Test("RDP routes", arguments: [
+        // Valid routes
+        RouteTestCase(
+            urlString: "coder://coder.example.com/v0/open/ws/myworkspace/agent/dev/rdp?username=user&password=pass",
+            expectedRoute: .open(
+                workspace: "myworkspace",
+                agent: "dev",
+                route: .rdp(RDPCredentials(username: "user", password: "pass"))
+            ),
+            description: "RDP with username and password"
+        ),
+        RouteTestCase(
+            urlString: "coder://coder.example.com/v0/open/ws/workspace-123/agent/agent-456/rdp",
+            expectedRoute: .open(
+                workspace: "workspace-123",
+                agent: "agent-456",
+                route: .rdp(RDPCredentials(username: nil, password: nil))
+            ),
+            description: "RDP without credentials"
+        ),
+        RouteTestCase(
+            urlString: "coder://coder.example.com/v0/open/ws/workspace-123/agent/agent-456/rdp?username=user",
+            expectedRoute: .open(
+                workspace: "workspace-123",
+                agent: "agent-456",
+                route: .rdp(RDPCredentials(username: "user", password: nil))
+            ),
+            description: "RDP with username only"
+        ),
+        RouteTestCase(
+            urlString: "coder://coder.example.com/v0/open/ws/workspace-123/agent/agent-456/rdp?password=pass",
+            expectedRoute: .open(
+                workspace: "workspace-123",
+                agent: "agent-456",
+                route: .rdp(RDPCredentials(username: nil, password: "pass"))
+            ),
+            description: "RDP with password only"
+        ),
+        RouteTestCase(
+            urlString: "coder://coder.example.com/v0/open/ws/ws-special-chars/agent/agent-with-dashes/rdp",
+            expectedRoute: .open(
+                workspace: "ws-special-chars",
+                agent: "agent-with-dashes",
+                route: .rdp(RDPCredentials(username: nil, password: nil))
+            ),
+            description: "RDP with special characters in workspace and agent IDs"
+        ),
+
+        // Invalid routes
+        RouteTestCase(
+            urlString: "coder://coder.example.com/invalid/path",
+            expectedRoute: nil,
+            description: "Completely invalid path"
+        ),
+        RouteTestCase(
+            urlString: "coder://coder.example.com/v1/open/ws/workspace-123/agent/agent-456/rdp",
+            expectedRoute: nil,
+            description: "Invalid version prefix (v1 instead of v0)"
+        ),
+        RouteTestCase(
+            urlString: "coder://coder.example.com/v0/open/workspace-123/agent/agent-456/rdp",
+            expectedRoute: nil,
+            description: "Missing 'ws' segment"
+        ),
+        RouteTestCase(
+            urlString: "coder://coder.example.com/v0/open/ws/workspace-123/rdp",
+            expectedRoute: nil,
+            description: "Missing agent segment"
+        ),
+        RouteTestCase(
+            urlString: "http://coder.example.com/v0/open/ws/workspace-123/agent/agent-456",
+            expectedRoute: nil,
+            description: "Wrong scheme"
+        ),
+    ])
+    func testRdpRoutes(testCase: RouteTestCase) throws {
+        let url = URL(string: testCase.urlString)!
+
+        if let expectedRoute = testCase.expectedRoute {
+            let route = try router.match(url: url)
+            #expect(route == expectedRoute)
+        } else {
+            #expect(throws: (any Error).self) {
+                _ = try router.match(url: url)
+            }
+        }
+    }
+}
diff --git a/Coder-Desktop/project.yml b/Coder-Desktop/project.yml
index 701d648..9ec3ba4 100644
--- a/Coder-Desktop/project.yml
+++ b/Coder-Desktop/project.yml
@@ -126,6 +126,10 @@ packages:
   SDWebImageSVGCoder:
     url: https://github.com/SDWebImage/SDWebImageSVGCoder
     exactVersion: 1.7.0
+  URLRouting:
+    url: https://github.com/pointfreeco/swift-url-routing
+    revision: 09b155d
+
 
 targets:
   Coder Desktop:
@@ -290,6 +294,7 @@ targets:
       - package: GRPC
       - package: Subprocess
       - package: Semaphore
+      - package: URLRouting
       - target: CoderSDK
         embed: false
 
diff --git a/Makefile b/Makefile
index 115f6e8..a21b756 100644
--- a/Makefile
+++ b/Makefile
@@ -121,6 +121,7 @@ test: $(addprefix $(PROJECT)/Resources/,$(MUTAGEN_RESOURCES)) $(XCPROJECT) ## Ru
 		-project $(XCPROJECT) \
 		-scheme $(SCHEME) \
 		-testPlan $(TEST_PLAN) \
+		-skipMacroValidation \
 		-skipPackagePluginValidation \
 		CODE_SIGNING_REQUIRED=NO \
 		CODE_SIGNING_ALLOWED=NO | xcbeautify
diff --git a/scripts/build.sh b/scripts/build.sh
index b1351da..227f04b 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -125,6 +125,7 @@ xcodebuild \
   -configuration "Release" \
   -archivePath "$ARCHIVE_PATH" \
   archive \
+  -skipMacroValidation \
   -skipPackagePluginValidation \
   CODE_SIGN_STYLE=Manual \
   CODE_SIGN_IDENTITY="$CODE_SIGN_IDENTITY" \