diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index aad5c5b5..20fc0df0 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -40,6 +40,7 @@
 
     <application
         android:allowBackup="true"
+        android:hasFragileUserData="true"
         android:banner="@mipmap/ic_banner"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
diff --git a/docker/README.md b/docker/README.md
index 2c1c4c56..efe8d3c6 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -991,12 +991,30 @@ Keep and back up this file across clean builds, disposable worktrees, container
 rebuilds and Gradle cache resets. Never commit it. The standard debug passwords
 are public; this key is for local debug/optimized builds, not release signing.
 
-**One-time reinstall:** the first build with the stable key still needs one
-uninstall+reinstall on the box because the signer changes once; later ones
-install in place with `adb install -r`, retaining sign-ins and settings.
-The initial uninstall removes app data, so sign in again once after that switch.
-Deleting/replacing the persistent key or choosing a different override changes
-the signer again and requires another reinstall.
+### Preserve household TV data
+
+Install and update the household TV app only in place with `adb install -r`,
+using the same package and persistent debug signer. Its certificate SHA-256 is:
+
+```text
+182bac72e292b9ea4d3d4e6383f92eb2161fa28ba5afcff0337cb7d5a9d5341d
+```
+
+Never run `adb uninstall`, `pm uninstall` or `pm clear`, or switch signers on
+the household box: clearing/removing the app deletes saved people, sign-ins
+and settings, and a different signer cannot update the existing app in place.
+Do not delete or replace the persistent key. If an uninstall is unavoidable,
+use `adb uninstall -k <package>` to keep app data, then reinstall the same
+package with the same signer.
+
+The manifest sets `android:hasFragileUserData="true"` so Android 10+ can offer
+a **keep app data** choice during interactive uninstall. Choose it when
+available; older Android versions ignore the attribute. This is a retention
+prompt, not an automatic backup or a guarantee against data clearing.
+
+For an in-place update, compare `dumpsys package <pkg>` before and after:
+`firstInstallTime` must remain unchanged. The guarded installer that checks
+the signer and this timestamp lives in the operator's tooling, not this repo.
 
 
 ## Release credentials