diff --git a/samples/CameraAccessAndroid/app/src/main/AndroidManifest.xml b/samples/CameraAccessAndroid/app/src/main/AndroidManifest.xml
index 5ed342a12..fedb25fc9 100644
--- a/samples/CameraAccessAndroid/app/src/main/AndroidManifest.xml
+++ b/samples/CameraAccessAndroid/app/src/main/AndroidManifest.xml
@@ -19,7 +19,7 @@
         android:icon="@mipmap/ic_launcher"
         android:label="VisionClaw"
         android:supportsRtl="true"
-        android:usesCleartextTraffic="true"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:theme="@style/Theme.CameraAccess">
 
         <!-- Without Developer Mode, this key will need to be set with ID from app registered in Wearables Developer Center -->
diff --git a/samples/CameraAccessAndroid/app/src/main/java/com/meta/wearable/dat/externalsampleapps/cameraaccess/webrtc/WebRTCClient.kt b/samples/CameraAccessAndroid/app/src/main/java/com/meta/wearable/dat/externalsampleapps/cameraaccess/webrtc/WebRTCClient.kt
index 0d62a3567..9a46efb64 100644
--- a/samples/CameraAccessAndroid/app/src/main/java/com/meta/wearable/dat/externalsampleapps/cameraaccess/webrtc/WebRTCClient.kt
+++ b/samples/CameraAccessAndroid/app/src/main/java/com/meta/wearable/dat/externalsampleapps/cameraaccess/webrtc/WebRTCClient.kt
@@ -129,7 +129,8 @@ class WebRTCClient(private val context: Context) {
         // Create video source + track with custom capturer
         val factory = peerConnectionFactory ?: return
         videoSource = factory.createVideoSource(false) // false = not a screen cast
-        customCapturer = CustomVideoCapturer().apply { initialize(videoSource!!) }
+        val source = videoSource ?: return
+        customCapturer = CustomVideoCapturer().apply { initialize(source) }
         localVideoTrack = factory.createVideoTrack("video0", videoSource).apply {
             setEnabled(true)
         }
diff --git a/samples/CameraAccessAndroid/app/src/main/res/xml/network_security_config.xml b/samples/CameraAccessAndroid/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 000000000..82a313e98
--- /dev/null
+++ b/samples/CameraAccessAndroid/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <!-- Allow cleartext only for loopback and mDNS hosts on the local network. -->
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="true">localhost</domain>
+        <domain>127.0.0.1</domain>
+        <domain includeSubdomains="true">local</domain>
+    </domain-config>
+    <!-- Block cleartext for all other domains (enforce HTTPS) -->
+    <base-config cleartextTrafficPermitted="false" />
+</network-security-config>