diff --git a/.github/workflows/check-offline-permissions.yml b/.github/workflows/check-offline-permissions.yml
index e506e290..66b01263 100644
--- a/.github/workflows/check-offline-permissions.yml
+++ b/.github/workflows/check-offline-permissions.yml
@@ -60,5 +60,20 @@ jobs:
             else
               echo "OK: No $PERMISSION in offline build manifest"
             fi
+          for COMPONENT in androidx.work.WorkManagerInitializer androidx.work.impl.background.systemjob.SystemJobService; do
+            if grep -q "$COMPONENT" "$MANIFEST"; then
+              echo ""
+              echo "ERROR: $COMPONENT found in offline build manifest!"
+              echo "WorkManager must never initialize in the offline flavor: it tracks"
+              echo "network-constrained work via ConnectivityManager, which crashes with"
+              echo "SecurityException because ACCESS_NETWORK_STATE is removed."
+              echo ""
+              echo "Offending lines:"
+              grep "$COMPONENT" "$MANIFEST"
+              FAILED=1
+            else
+              echo "OK: No $COMPONENT in offline build manifest"
+            fi
+          done
           done
           exit $FAILED
diff --git a/app/src/main/java/com/greenart7c3/nostrsigner/Amber.kt b/app/src/main/java/com/greenart7c3/nostrsigner/Amber.kt
index 16af1eb5..5bd3fdc2 100644
--- a/app/src/main/java/com/greenart7c3/nostrsigner/Amber.kt
+++ b/app/src/main/java/com/greenart7c3/nostrsigner/Amber.kt
@@ -337,6 +337,7 @@ class Amber :
     }
 
     fun cancelBackupApplicationsAlarm() {
+        if (BuildFlavorChecker.isOfflineFlavor()) return
         WorkManager.getInstance(this).cancelUniqueWork("BackupApplicationsWorker")
     }
 
diff --git a/app/src/offline/AndroidManifest.xml b/app/src/offline/AndroidManifest.xml
index ba3a49c5..3c68176e 100644
--- a/app/src/offline/AndroidManifest.xml
+++ b/app/src/offline/AndroidManifest.xml
@@ -29,6 +29,44 @@
             android:enabled="true"
             android:exported="true" />
 
+        <!-- WorkManager is dead code in the offline flavor: every WorkManager enqueue is
+             flavor-guarded and ConnectivityService (the only startCleanLogsAlarm caller)
+             never runs here. Its auto-initialization must not run either: for any persisted
+             network-constrained work (e.g. state left by an installed free flavor), WorkManager
+             tracks it via ConnectivityManager.registerDefaultNetworkCallback, which throws
+             SecurityException because ACCESS_NETWORK_STATE is removed below. Strip every
+             WorkManager manifest component so it can never initialize or be invoked here. -->
+        <provider
+            android:name="androidx.startup.InitializationProvider"
+            android:authorities="${applicationId}.androidx-startup"
+            android:exported="false"
+            tools:node="merge">
+            <meta-data
+                android:name="androidx.work.WorkManagerInitializer"
+                android:value="androidx.startup"
+                tools:node="remove" />
+        </provider>
+
+        <service
+            android:name="androidx.work.impl.background.systemjob.SystemJobService"
+            tools:node="remove" />
+
+        <service
+            android:name="androidx.work.impl.foreground.SystemForegroundService"
+            tools:node="remove" />
+
+        <receiver
+            android:name="androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver"
+            tools:node="remove" />
+
+        <receiver
+            android:name="androidx.work.impl.background.systemalarm.RescheduleReceiver"
+            tools:node="remove" />
+
+        <receiver
+            android:name="androidx.work.impl.diagnostics.DiagnosticsReceiver"
+            tools:node="remove" />
+
         <activity
             android:name=".MainActivity"
             android:exported="true">