diff --git a/Cargo.lock b/Cargo.lock
index cecedc12c9..0e4c910427 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4264,7 +4264,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "chrono",
  "craft-update",
@@ -4289,7 +4289,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-a11y"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4300,7 +4300,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-annot"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4312,7 +4312,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-audit"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4323,7 +4323,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-automation"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "base64 0.23.1",
  "flate2",
@@ -4347,7 +4347,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cli"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "base64 0.23.1",
  "pdfcraft-audit",
@@ -4365,11 +4365,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-compare"
-version = "0.21.0"
+version = "0.21.1"
 
 [[package]]
 name = "pdfcraft-content"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4377,7 +4377,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cos"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "chrono",
  "hayro-syntax",
@@ -4394,7 +4394,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-create"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "encoding_rs",
  "hayro-ccitt",
@@ -4414,7 +4414,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-crypt"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "aes",
  "md-5",
@@ -4427,7 +4427,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-edit"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "hayro-syntax",
  "icu_segmenter",
@@ -4446,7 +4446,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-engine"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "chrono",
  "craft-docpath",
@@ -4490,14 +4490,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-export"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "flate2",
 ]
 
 [[package]]
 name = "pdfcraft-filters"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "fax",
  "flate2",
@@ -4510,7 +4510,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-fonts"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "harfrust",
  "pdfcraft-cos",
@@ -4520,7 +4520,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-forms"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4533,11 +4533,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-geom"
-version = "0.21.0"
+version = "0.21.1"
 
 [[package]]
 name = "pdfcraft-js"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "boa_engine",
  "chrono",
@@ -4545,7 +4545,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-measure"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4558,14 +4558,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-model"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "pdfcraft-cos",
 ]
 
 [[package]]
 name = "pdfcraft-ocr"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "ocrs",
  "pdfcraft-fonts",
@@ -4580,7 +4580,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-ocr-worker"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "js-sys",
  "pdfcraft-ocr",
@@ -4590,7 +4590,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-optimize"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "image",
  "pdfcraft-annot",
@@ -4607,11 +4607,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-oracle"
-version = "0.21.0"
+version = "0.21.1"
 
 [[package]]
 name = "pdfcraft-organize"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4622,7 +4622,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-platform"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "async-channel",
  "futures-lite",
@@ -4633,7 +4633,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-prc"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "flate2",
  "proptest",
@@ -4642,7 +4642,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-prc-render"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "flate2",
  "pdfcraft-prc",
@@ -4651,7 +4651,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-preflight"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "flate2",
  "pdfcraft-content",
@@ -4662,7 +4662,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-print"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "craft-print",
  "log",
@@ -4677,7 +4677,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-redact"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "aho-corasick",
  "pdfcraft-annot",
@@ -4701,7 +4701,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-render"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "bytemuck",
  "flate2",
@@ -4725,7 +4725,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-sign"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "aes",
  "aws-lc-rs",
@@ -4764,11 +4764,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-testkit"
-version = "0.21.0"
+version = "0.21.1"
 
 [[package]]
 name = "pdfcraft-ui-egui"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "arboard",
  "base64 0.23.1",
@@ -4827,7 +4827,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-web"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "craft-web-api",
  "craft-web-host",
@@ -4842,7 +4842,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfa"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "base64 0.23.1",
  "image",
@@ -4856,7 +4856,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfdf"
-version = "0.21.0"
+version = "0.21.1"
 dependencies = [
  "base64 0.23.1",
  "pdfcraft-annot",
diff --git a/Cargo.toml b/Cargo.toml
index 9cd5b3b7c3..752f580475 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ exclude = ["vendor"]
 default-members = ["crates/*", "apps/pdfcraft", "apps/pdfcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.21.0"
+version = "0.21.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
diff --git a/crates/ui-egui/tests/flatpak_updates.rs b/crates/ui-egui/tests/flatpak_updates.rs
new file mode 100644
index 0000000000..536613f08a
--- /dev/null
+++ b/crates/ui-egui/tests/flatpak_updates.rs
@@ -0,0 +1,27 @@
+//! Release and source Flatpaks must allow release checks and host update helpers.
+fn finish_args(manifest: &str) -> Vec<&str> {
+    manifest
+        .split("finish-args:")
+        .nth(1)
+        .unwrap_or_default()
+        .lines()
+        .take_while(|line| line.is_empty() || line.starts_with(' ') || line.starts_with('#'))
+        .filter_map(|line| line.trim().strip_prefix("- "))
+        .map(|arg| arg.trim_matches(['\'', '"']))
+        .collect()
+}
+
+#[test]
+fn flatpak_update_permissions() {
+    let manifests = [
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml"),
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.pdfcraft.yml"),
+    ];
+    let args = manifests.map(finish_args);
+    assert_eq!(args[0], args[1], "source and release permissions must agree");
+    for permissions in args {
+        for required in ["--share=network", "--talk-name=org.freedesktop.Flatpak"] {
+            assert!(permissions.contains(&required), "missing update permission: {required}");
+        }
+    }
+}
diff --git a/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
index d781ad6c7c..8d2fb49192 100644
--- a/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
@@ -17,6 +17,8 @@ runtime-version: '25.08'
 sdk: org.freedesktop.Sdk
 command: pdfcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
   - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland
diff --git a/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml b/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml
index fba62fe382..2c5d6d88c6 100644
--- a/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml
@@ -18,6 +18,8 @@ sdk-extensions:
   - org.freedesktop.Sdk.Extension.rust-stable
 command: pdfcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
   - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland