diff --git a/packages/mobile/android/app/src/main/AndroidManifest.xml b/packages/mobile/android/app/src/main/AndroidManifest.xml
index dba5d6b5..4b21d928 100644
--- a/packages/mobile/android/app/src/main/AndroidManifest.xml
+++ b/packages/mobile/android/app/src/main/AndroidManifest.xml
@@ -1,17 +1,12 @@
 <?xml version="1.0" encoding="utf-8" ?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <!-- usesCleartextTraffic: OpenChamber connects to user-hosted servers over
-         plain http:// on the local network (LAN transport). Android blocks all
-         cleartext HTTP by default (targetSdk >= 28), which silently failed every
-         LAN probe and forced Android onto relay-only. This mirrors the iOS ATS
-         exceptions (NSAllowsArbitraryLoadsInWebContent + NSAllowsLocalNetworking). -->
     <application
         android:allowBackup="true"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
-        android:usesCleartextTraffic="true"
         android:theme="@style/AppTheme">
         <activity
             android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode|navigation"
diff --git a/packages/mobile/android/app/src/main/res/xml/network_security_config.xml b/packages/mobile/android/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 00000000..8a76775f
--- /dev/null
+++ b/packages/mobile/android/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>