diff --git a/CLAUDE.md b/CLAUDE.md
index 89cb08f..32b9f1c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -68,6 +68,11 @@ Notes that are easy to get wrong:
 
 The backend host/port is configured once in `lib/main.dart` via `AcApi.configure(const ApiConfig(host: 'localhost', port: 5118))`. Plain http is intentional — the API is only reached inside a trusted network. There is no environment/config file; changing the backend address means editing `main.dart`.
 
+On android two things in `android/app/src/main/AndroidManifest.xml` have to stay in place for that to work, and both only bite the **release** apk:
+
+- `<uses-permission android:name="android.permission.INTERNET"/>` — flutter ships this permission only in `src/debug` and `src/profile`, which a release build does not merge. Without it every request fails with `SocketException: Connection failed (OS Error: Operation not permitted)`, because the app may not open a socket at all.
+- `android:usesCleartextTraffic="true"` on `<application>` — android blocks plain http since api 28 (the app targets 36). Without it requests fail with `CLEARTEXT communication to <host> not permitted`. Remove the attribute once the backend speaks https.
+
 ## Architecture
 
 ### API layer (`lib/Api/`)
diff --git a/ac_web/android/app/src/main/AndroidManifest.xml b/ac_web/android/app/src/main/AndroidManifest.xml
index 16270b7..66490de 100644
--- a/ac_web/android/app/src/main/AndroidManifest.xml
+++ b/ac_web/android/app/src/main/AndroidManifest.xml
@@ -1,8 +1,20 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <!-- Only `src/debug` and `src/profile` carry this permission by default,
+         because the flutter tool needs it for hot reload. A release build
+         merges this manifest alone, so without the line here every request of
+         the release apk fails with "Operation not permitted" (EPERM) - the app
+         is not allowed to open a socket at all. -->
+    <uses-permission android:name="android.permission.INTERNET"/>
+
     <application
         android:label="ac_web"
         android:name="${applicationName}"
-        android:icon="@mipmap/ic_launcher">
+        android:icon="@mipmap/ic_launcher"
+        android:usesCleartextTraffic="true">
+        <!-- The api is reached over plain http inside a trusted network (see
+             `AcApi.configure` in `lib/main.dart`), and android blocks cleartext
+             traffic by default since api 28. Drop this attribute as soon as the
+             backend is served over https. -->
         <activity
             android:name=".MainActivity"
             android:exported="true"