diff --git a/lore/src/remote/message.rs b/lore/src/remote/message.rs
index 8c36c2e..256fd19 100644
--- a/lore/src/remote/message.rs
+++ b/lore/src/remote/message.rs
@@ -1,4 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Epic Games, Inc.
+// SPDX-FileCopyrightText: 2026 glitch-ux
 // SPDX-License-Identifier: MIT
 use std::io::ErrorKind;
 use std::io::Read;
@@ -49,7 +50,7 @@ pub fn blocking_read_v1_message<Message: for<'a> Deserialize<'a>, Reader: Read +
     reader
         .read_exact(&mut header_bytes)
         .internal("reading message header")?;
-    let header = V1Header::from_bytes(&header_bytes).unwrap();
+    let header = V1Header::from_bytes(&header_bytes)?;
 
     let mut message_bytes = vec![0; header.payload_size as usize];
     reader
diff --git a/lore/tests/remote_message.rs b/lore/tests/remote_message.rs
index ccc5b0f..4de7e72 100644
--- a/lore/tests/remote_message.rs
+++ b/lore/tests/remote_message.rs
@@ -1,4 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Epic Games, Inc.
+// SPDX-FileCopyrightText: 2026 glitch-ux
 // SPDX-License-Identifier: MIT
 use lore::remote::command::LoreCommand;
 use lore::remote::message::MessageError;
@@ -29,6 +30,20 @@ fn header_to_and_from_bytes() {
     assert!(bad_processed_header.is_err());
 }
 
+#[test]
+fn errors_on_invalid_serialization_type_in_header() {
+    // A valid V1 version byte (0), a zero payload size, and 0xff as the
+    // serialization-type byte, which is not a valid SerializationType. Reading a
+    // message with such a header must surface a recoverable error rather than
+    // panicking the process.
+    let bytes: [u8; 6] = [0, 0, 0, 0, 0, 0xff];
+
+    let result: Result<Option<(V1Header, MessageToServer)>, MessageError> =
+        blocking_read_v1_message(&mut bytes.as_slice());
+
+    assert!(result.is_err());
+}
+
 #[tokio::test]
 async fn message_to_server_to_and_from_bytes() {
     let path = LoreString::from_str("abc");