diff --git a/.github/scripts/inject-tauri-shell.mjs b/.github/scripts/inject-tauri-shell.mjs
index 2e06f9b..e8efd01 100644
--- a/.github/scripts/inject-tauri-shell.mjs
+++ b/.github/scripts/inject-tauri-shell.mjs
@@ -5,6 +5,8 @@ import { fileURLToPath } from "node:url";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const root = path.resolve(__dirname, "../..");
 const MARKER = "data-web2app-tauri-shell";
+const PERMISSIONS_POLICY_MARKER = "data-web2app-permissions-policy";
+const PERMISSIONS_POLICY_TAG = `<meta ${PERMISSIONS_POLICY_MARKER} http-equiv="Permissions-Policy" content="camera=*, microphone=*" />`;
 const scriptPath = path.join(root, "template", "scripts", "tauri-shell.js");
 
 export function injectTauriShell(distDir) {
@@ -12,19 +14,26 @@ export function injectTauriShell(distDir) {
   if (!fs.existsSync(indexPath)) return;
 
   let html = fs.readFileSync(indexPath, "utf8");
-  if (html.includes(MARKER)) return;
+  const needsPolicy = !html.includes(PERMISSIONS_POLICY_MARKER);
+  const needsScript = !html.includes(MARKER);
+  if (!needsPolicy && !needsScript) return;
 
-  const script = fs.readFileSync(scriptPath, "utf8").trim();
-  const tag = `<script ${MARKER}>${script}</script>`;
+  const injections = [];
+  if (needsPolicy) injections.push(PERMISSIONS_POLICY_TAG);
+  if (needsScript) {
+    const script = fs.readFileSync(scriptPath, "utf8").trim();
+    injections.push(`<script ${MARKER}>${script}</script>`);
+  }
+  const block = `${injections.join("\n")}\n`;
 
   if (html.includes("<head>")) {
-    html = html.replace("<head>", `<head>\n${tag}`);
+    html = html.replace("<head>", `<head>\n${block}`);
   } else if (html.includes("</head>")) {
-    html = html.replace("</head>", `${tag}\n</head>`);
+    html = html.replace("</head>", `${block}</head>`);
   } else if (html.includes("</body>")) {
-    html = html.replace("</body>", `${tag}\n</body>`);
+    html = html.replace("</body>", `${block}</body>`);
   } else {
-    html += `\n${tag}\n`;
+    html += `\n${block}`;
   }
 
   fs.writeFileSync(indexPath, html);
diff --git a/.github/scripts/patch-android-system-bars.mjs b/.github/scripts/patch-android-system-bars.mjs
index 65695bb..adee0fd 100644
--- a/.github/scripts/patch-android-system-bars.mjs
+++ b/.github/scripts/patch-android-system-bars.mjs
@@ -136,16 +136,34 @@ function ensureNetworkSecurityXml(androidRoot) {
   console.log(`Wrote ${path.relative(root, target)}`);
 }
 
+const ANDROID_PERMISSIONS = [
+  "android.permission.INTERNET",
+  "android.permission.CAMERA",
+];
+
+function ensureUsesPermission(xml, permission) {
+  if (xml.includes(permission)) return xml;
+  const tag = `    <uses-permission android:name="${permission}" />\n`;
+  if (xml.includes("<application")) {
+    return xml.replace(/<application/, `${tag}\n    <application`);
+  }
+  return xml.replace(/<\/manifest>/, `${tag}</manifest>`);
+}
+
 function patchAndroidManifest(androidRoot) {
   for (const file of walk(androidRoot, (p) => p.endsWith("AndroidManifest.xml"))) {
     const normalized = file.replace(/\\/g, "/");
     if (!normalized.includes("/src/main/")) continue;
 
     let xml = fs.readFileSync(file, "utf8");
-    if (!xml.includes("android.permission.INTERNET")) {
+    for (const permission of ANDROID_PERMISSIONS) {
+      xml = ensureUsesPermission(xml, permission);
+    }
+
+    if (!xml.includes("android.hardware.camera")) {
       xml = xml.replace(
         /<application/,
-        '    <uses-permission android:name="android.permission.INTERNET" />\n\n    <application',
+        '    <uses-feature android:name="android.hardware.camera" android:required="false" />\n\n    <application',
       );
     }
 
@@ -206,4 +224,4 @@ ensureNetworkSecurityXml(androidRoot);
 patchAndroidManifest(androidRoot);
 patchGradleCleartext(androidRoot);
 
-console.log("Android app patches applied (system bars + network)");
+console.log("Android app patches applied (system bars + network + camera)");
