diff --git a/README.md b/README.md
index 54ceb3e..889bee8 100644
--- a/README.md
+++ b/README.md
@@ -46,6 +46,8 @@ the development computer's LAN address, such as `http://192.168.1.20:8080`.
 Enter the same API token when connecting. The app stores its connection settings
 in its private application data and excludes them from Android backups. Cleartext
 HTTP is permitted only in debug builds; use HTTPS for non-local deployments.
+The release app trusts Android's system roots and the bundled public WARD root
+CA used by the project's private PKI.
 
 Tap a grid tile to open the vertical player. Long-press to select videos for a
 manual collection. The pager prepares neighboring pages to reduce startup latency.
diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 2bbc592..f2e2a17 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -4,6 +4,7 @@
     <application
         android:allowBackup="false"
         android:label="Short Form Video"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:supportsRtl="true"
         android:theme="@style/Theme.ShortFormVideo"
         android:usesCleartextTraffic="${usesCleartextTraffic}">
diff --git a/android/app/src/main/res/raw/ward_root_ca.crt b/android/app/src/main/res/raw/ward_root_ca.crt
new file mode 100644
index 0000000..e373fff
--- /dev/null
+++ b/android/app/src/main/res/raw/ward_root_ca.crt
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICdDCCAfmgAwIBAgIRAKfU9Zw+Js/brHgEQsGh6kMwCgYIKoZIzj0EAwMweTEL
+MAkGA1UEBhMCVVMxETAPBgNVBAgTCE1pc3NvdXJpMREwDwYDVQQHEwhDb2x1bWJp
+YTENMAsGA1UEChMEV0FSRDEcMBoGA1UECxMTS2VlcGVyIG9mIHRoZSBTZWFsczEX
+MBUGA1UEAxMOV0FSRCBIaWdoIFNlYWwwHhcNMjYwNzE0MTkwNzE1WhcNNDYwNzE0
+MTkwNzE1WjB5MQswCQYDVQQGEwJVUzERMA8GA1UECBMITWlzc291cmkxETAPBgNV
+BAcTCENvbHVtYmlhMQ0wCwYDVQQKEwRXQVJEMRwwGgYDVQQLExNLZWVwZXIgb2Yg
+dGhlIFNlYWxzMRcwFQYDVQQDEw5XQVJEIEhpZ2ggU2VhbDB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABIAy+1J1e+aAhuIwoeDhVMffxfVSPz9SF2oeYAIVo20Oy7lLf2e1
+Bxl4v2jI70gE6RvEQZIun9hCCdndaYlQBfNeTsq2WyATaswqwPoXzy8F+k0A0L3I
+WNB5Q3+ziXbb7aNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C
+AQEwHQYDVR0OBBYEFBT8E6uVkuXG2FDBlO1Aj7oSXmWoMAoGCCqGSM49BAMDA2kA
+MGYCMQC1buh+feqK1d0bxtx1kRIIpSvmcwmDzHQfy+/nM7rtRpAYfvY6qfif4YAR
+6QWU42gCMQDGjjSuDynEUJGUROnvgqzbVPr+QkbiQMHFZ9qkFHDYtxFq6otl/+Xa
+0oqfuT+Sqz8=
+-----END CERTIFICATE-----
diff --git a/android/app/src/main/res/xml/network_security_config.xml b/android/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 0000000..80291cb
--- /dev/null
+++ b/android/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config>
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="@raw/ward_root_ca" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>