diff --git a/apps/apple/CascadeMac/Cascade.entitlements b/apps/apple/CascadeMac/Cascade.entitlements
index 0ab12df..ee95ab7 100644
--- a/apps/apple/CascadeMac/Cascade.entitlements
+++ b/apps/apple/CascadeMac/Cascade.entitlements
@@ -5,6 +5,6 @@
 	<key>com.apple.security.app-sandbox</key>
 	<true/>
 	<key>com.apple.security.network.client</key>
-	<false/>
+	<true/>
 </dict>
 </plist>
diff --git a/apps/apple/project.yml b/apps/apple/project.yml
index 6b8b8d9..ecca7cc 100644
--- a/apps/apple/project.yml
+++ b/apps/apple/project.yml
@@ -56,8 +56,9 @@ targets:
         # App Sandbox: audio + Application Support writes + IOKit power
         # assertions + MediaPlayer Now Playing all work under sandbox.
         com.apple.security.app-sandbox: true
-        # Explicit: this app never reaches the network.
-        com.apple.security.network.client: false
+        # Outbound network for the optional account/listening-time sync
+        # (magic-link sign-in + G-Counter sync to cascade-sync-server).
+        com.apple.security.network.client: true
     settings:
       base:
         PRODUCT_BUNDLE_IDENTIFIER: page.stephens.cascade