diff --git a/crates/ui-egui/tests/flatpak_updates.rs b/crates/ui-egui/tests/flatpak_updates.rs
new file mode 100644
index 000000000..cc70ea46d
--- /dev/null
+++ b/crates/ui-egui/tests/flatpak_updates.rs
@@ -0,0 +1,27 @@
+//! Release and source Flatpaks must allow release checks and host update helpers.
+fn finish_args(manifest: &str) -> Vec<&str> {
+    manifest
+        .split("finish-args:")
+        .nth(1)
+        .unwrap_or_default()
+        .lines()
+        .take_while(|line| line.is_empty() || line.starts_with(' ') || line.starts_with('#'))
+        .filter_map(|line| line.trim().strip_prefix("- "))
+        .map(|arg| arg.trim_matches(['\'', '"']))
+        .collect()
+}
+
+#[test]
+fn flatpak_update_permissions() {
+    let manifests = [
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml"),
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.deckcraft.yml"),
+    ];
+    let args = manifests.map(finish_args);
+    assert_eq!(args[0], args[1], "source and release permissions must agree");
+    for permissions in args {
+        for required in ["--share=network", "--talk-name=org.freedesktop.Flatpak"] {
+            assert!(permissions.contains(&required), "missing update permission: {required}");
+        }
+    }
+}
diff --git a/packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml
index 5b54f575f..a86186225 100644
--- a/packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml
@@ -17,6 +17,8 @@ runtime-version: '25.08'
 sdk: org.freedesktop.Sdk
 command: deckcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
   - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland
diff --git a/packaging/linux/flatpak/ai.storyteller.deckcraft.yml b/packaging/linux/flatpak/ai.storyteller.deckcraft.yml
index 8c1d1e24f..5faa9da72 100644
--- a/packaging/linux/flatpak/ai.storyteller.deckcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.deckcraft.yml
@@ -18,6 +18,8 @@ sdk-extensions:
   - org.freedesktop.Sdk.Extension.rust-stable
 command: deckcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
   - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland