diff --git a/amethyst/src/main/AndroidManifest.xml b/amethyst/src/main/AndroidManifest.xml
index fd3b4f035..a006b8382 100644
--- a/amethyst/src/main/AndroidManifest.xml
+++ b/amethyst/src/main/AndroidManifest.xml
@@ -86,6 +86,7 @@
         android:theme="@style/Theme.Amethyst"
         android:largeHeap="true"
         android:usesCleartextTraffic="true"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:hardwareAccelerated="true"
         android:localeConfig="@xml/locales_config"
         tools:targetApi="34">
diff --git a/amethyst/src/main/res/xml/network_security_config.xml b/amethyst/src/main/res/xml/network_security_config.xml
new file mode 100644
index 000000000..78948e969
--- /dev/null
+++ b/amethyst/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Cleartext traffic is permitted globally so user-configured ws:// relays keep working.
+    The explicit localhost domain-config silences StrictMode CleartextNetworkViolation
+    for the Tor SOCKS proxy on 127.0.0.1.
+-->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    </base-config>
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="false">127.0.0.1</domain>
+        <domain includeSubdomains="false">localhost</domain>
+    </domain-config>
+</network-security-config>