diff --git a/amethyst/src/main/java/com/vitorpamplona/amethyst/service/logging/Logging.kt b/amethyst/src/main/java/com/vitorpamplona/amethyst/service/logging/Logging.kt
index ad9a307efc..6ba703477d 100644
--- a/amethyst/src/main/java/com/vitorpamplona/amethyst/service/logging/Logging.kt
+++ b/amethyst/src/main/java/com/vitorpamplona/amethyst/service/logging/Logging.kt
@@ -43,7 +43,14 @@ class Logging {
                     .detectLeakedClosableObjects()
                     .detectLeakedRegistrationObjects()
                     .detectFileUriExposure()
-                    .detectCleartextNetwork()
+                    // detectCleartextNetwork() is intentionally NOT enabled. netd enforces it
+                    // per-UID at the packet level (it flags a socket whose first bytes aren't a
+                    // TLS handshake) and there is no per-host exemption. Every relay WebSocket
+                    // tunneled over the embedded Arti Tor SOCKS proxy on 127.0.0.1:17392 opens
+                    // with a cleartext SOCKS5 greeting, so this detector fires constantly on
+                    // legitimate loopback traffic. The Network-Security-Config localhost
+                    // allowlist does NOT silence it — that flag only governs the voluntary
+                    // NetworkSecurityPolicy.isCleartextTrafficPermitted() check, not netd.
                     .detectContentUriWithoutPermission()
                     .apply {
                         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
diff --git a/amethyst/src/main/res/xml/network_security_config.xml b/amethyst/src/main/res/xml/network_security_config.xml
index 78948e9698..fdf4d8885a 100644
--- a/amethyst/src/main/res/xml/network_security_config.xml
+++ b/amethyst/src/main/res/xml/network_security_config.xml
@@ -1,8 +1,11 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
     Cleartext traffic is permitted globally so user-configured ws:// relays keep working.
-    The explicit localhost domain-config silences StrictMode CleartextNetworkViolation
-    for the Tor SOCKS proxy on 127.0.0.1.
+    The explicit localhost domain-config keeps NetworkSecurityPolicy.isCleartextTrafficPermitted()
+    happy for loopback services (the Tor SOCKS proxy on 127.0.0.1:17392, the local Blossom cache
+    on :24242). Note: this does NOT silence StrictMode's detectCleartextNetwork() — that detector
+    runs in netd at the packet level and ignores this allowlist, which is why we don't enable it
+    (see Logging.kt).
 -->
 <network-security-config>
     <base-config cleartextTrafficPermitted="true">