diff --git a/app/proguard-rules.pro b/app/proguard-rules.pro
index ef7b9226..10d382b8 100644
--- a/app/proguard-rules.pro
+++ b/app/proguard-rules.pro
@@ -35,6 +35,11 @@
 }
 
 # ── AndroidX Security Crypto ─────────────────────────────────────────────
+# EncryptedSharedPreferences / MasterKey resolve primitives via Tink's
+# reflection-based Registry. Without -keep, R8 obfuscates those classes and
+# token reads silently fail (401 on every API call, "Session expired").
+-keep class androidx.security.crypto.** { *; }
+-keep class com.google.crypto.tink.** { *; }
 -dontwarn androidx.security.crypto.**
 
 # ── Tink / Error Prone ───────────────────────────────────────────────────