diff --git a/README.md b/README.md
index 80ecccc..812e806 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,7 @@ Open the app and tap the **Settings** button to configure:
 | Setting | Default | Description |
 | --- | --- | --- |
 | Stream Name | `Live Stream` | Display name shown in the notification |
-| Stream URL | radiojar default | Full HTTP(S) URL of the audio stream |
+| Stream URL | radiojar default | Full HTTP(S) URL of the audio stream; HTTP cleartext is allowed for any domain |
 | Auto-start on Boot | **Enabled** | Start the stream automatically after device reboot |
 | Auto-relaunch if Stopped | **Enabled** | Watchdogs automatically restart the stream after a crash, network loss, or stop |
 | Reconnect Delay | 5 s | Base delay before the first reconnect attempt |
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 1b016db..d8c70dc 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -35,6 +35,7 @@
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Theme.StreamPlayer"
+        android:usesCleartextTraffic="true"
         android:networkSecurityConfig="@xml/network_security_config">
 
         <!-- ═══════════════════════════════════════════
diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
index e76dc95..36bbab5 100644
--- a/app/src/main/res/xml/network_security_config.xml
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -1,16 +1,11 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-    Allow cleartext (plain HTTP) connections to radiojar.com and its subdomains.
+    Allow cleartext (plain HTTP) connections for user-configured stream URLs.
 
-    Radiojar's stream.radiojar.com returns an HTTP 302 redirect to a fresh tokenized
-    stream URL on n0X.radiojar.com over plain HTTP. Android 9+ blocks cleartext by
-    default, so we explicitly permit it for radiojar.com only.
-
-    All other traffic remains HTTPS-only.
+    This app is configured by the user to play arbitrary live-stream endpoints.
+    Android 9+ blocks cleartext by default, so cleartext traffic is explicitly
+    permitted here for any domain the user enters.
 -->
 <network-security-config>
-    <domain-config cleartextTrafficPermitted="true">
-        <domain includeSubdomains="true">radiojar.com</domain>
-    </domain-config>
-    <base-config cleartextTrafficPermitted="false" />
+    <base-config cleartextTrafficPermitted="true" />
 </network-security-config>