diff --git a/packaging/linux/flatpak/ai.storyteller.figcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.figcraft.bundle.yml
index 4b0bd0fe..579a5d64 100644
--- a/packaging/linux/flatpak/ai.storyteller.figcraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.figcraft.bundle.yml
@@ -30,9 +30,9 @@ finish-args:
   # line, Open Recent, "Save" next to the original) work in the usual places.
   - --filesystem=xdg-pictures
   - --filesystem=xdg-documents
-  # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in
-  # the sandbox; `flatpak override --user --share=network ai.storyteller.figcraft` exposes it to
-  # host agents) and home/host filesystem access.
+  # Network: update checks reach GitHub. The optional --control server still listens on
+  # 127.0.0.1 in the sandbox. Home/host filesystem access is not granted.
+  - --share=network
 modules:
   - name: figcraft
     buildsystem: simple
diff --git a/packaging/linux/flatpak/ai.storyteller.figcraft.yml b/packaging/linux/flatpak/ai.storyteller.figcraft.yml
index 542f1ab7..461176c9 100644
--- a/packaging/linux/flatpak/ai.storyteller.figcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.figcraft.yml
@@ -35,9 +35,9 @@ finish-args:
   # line, Open Recent, "Save" next to the original) work in the usual places.
   - --filesystem=xdg-pictures
   - --filesystem=xdg-documents
-  # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in
-  # the sandbox; `flatpak override --user --share=network ai.storyteller.figcraft` exposes it to
-  # host agents) and home/host filesystem access.
+  # Network: update checks reach GitHub. The optional --control server still listens on
+  # 127.0.0.1 in the sandbox. Home/host filesystem access is not granted.
+  - --share=network
 build-options:
   append-path: /usr/lib/sdk/rust-stable/bin
 modules: