diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index eb51a12..9de6b57 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -6,6 +6,7 @@
         android:allowBackup="false"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Theme.Cyrene">
diff --git a/app/src/main/kotlin/top/yeij/cyrene/core/auth/AuthManager.kt b/app/src/main/kotlin/top/yeij/cyrene/core/auth/AuthManager.kt
index 0c36b2a..de7253e 100644
--- a/app/src/main/kotlin/top/yeij/cyrene/core/auth/AuthManager.kt
+++ b/app/src/main/kotlin/top/yeij/cyrene/core/auth/AuthManager.kt
@@ -114,6 +114,7 @@ class AuthManager(private val store: SessionStore) {
         is SSLException -> CyreneError.Local(CyreneError.LocalKind.Tls)
         is SocketTimeoutException -> CyreneError.Local(CyreneError.LocalKind.Timeout)
         is ConnectException -> CyreneError.Local(CyreneError.LocalKind.ConnectFailed)
+        is java.net.UnknownServiceException -> CyreneError.Local(CyreneError.LocalKind.CleartextBlocked)
         is IOException -> CyreneError.Local(CyreneError.LocalKind.NoNetwork)
         else -> CyreneError.Local(CyreneError.LocalKind.Unknown)
     }
diff --git a/app/src/main/kotlin/top/yeij/cyrene/core/error/CyreneError.kt b/app/src/main/kotlin/top/yeij/cyrene/core/error/CyreneError.kt
index 4f16ff8..8c7d633 100644
--- a/app/src/main/kotlin/top/yeij/cyrene/core/error/CyreneError.kt
+++ b/app/src/main/kotlin/top/yeij/cyrene/core/error/CyreneError.kt
@@ -33,6 +33,7 @@ sealed interface CyreneError {
                 LocalKind.Tls -> "证书校验失败（自签证书暂不支持）"
                 LocalKind.Timeout -> "连接超时，服务器没有响应"
                 LocalKind.ConnectFailed -> "无法连接到服务器"
+                LocalKind.CleartextBlocked -> "系统禁止明文 HTTP 访问"
                 LocalKind.Parse -> "服务器返回的数据无法识别"
                 LocalKind.Unknown -> "发生未知错误"
             }
@@ -45,6 +46,7 @@ sealed interface CyreneError {
         Tls,
         Timeout,
         ConnectFailed,
+        CleartextBlocked,
         Parse,
         Unknown,
     }
diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 0000000..7fb2d8c
--- /dev/null
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  自部署场景：用户会把 App 指向自己局域网/本机的 HTTP 服务（如 http://192.168.x.x:8080、
+  http://127.0.0.1:10942），所以必须放行明文流量；同时信任用户安装的 CA，
+  便于自签证书的 HTTPS 部署。生产公网部署仍建议用 HTTPS。
+-->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>