diff --git a/packaging/io.github.onyks_os.UsbguardGui.yaml b/packaging/io.github.onyks_os.UsbguardGui.yaml
index 458815d..b9a8add 100644
--- a/packaging/io.github.onyks_os.UsbguardGui.yaml
+++ b/packaging/io.github.onyks_os.UsbguardGui.yaml
@@ -29,8 +29,9 @@ finish-args:
   - --system-talk-name=org.usbguard1
   # --diagnose asks systemd whether usbguard.service is active (read-only).
   - --system-talk-name=org.freedesktop.systemd1
-  # Notifications and the tray are not implemented yet; their permissions
-  # (§14.1) are added together with the features.
+  # The status icon (StatusNotifierItem). Notifications need no permission:
+  # GApplication sends them through the portal inside a sandbox.
+  - --talk-name=org.kde.StatusNotifierWatcher
 
 modules:
   - name: usbguard-gui
diff --git a/src/ui/tray.rs b/src/ui/tray.rs
index 6e7d9f1..14e1b02 100644
--- a/src/ui/tray.rs
+++ b/src/ui/tray.rs
@@ -100,7 +100,13 @@ pub(super) fn start(commands: Sender<TrayCommand>, reply: Sender<TrayResult>) {
             total: 0,
             blocked: 0,
         };
-        let result = tray.spawn().await.map_err(|e| e.to_string());
+        // A sandbox cannot own the StatusNotifierItem-PID-N name the
+        // specification asks for; the watcher accepts the unique name.
+        let result = tray
+            .disable_dbus_name(super::autostart::sandboxed())
+            .spawn()
+            .await
+            .map_err(|e| e.to_string());
         let _ = reply.send(result).await;
     });
 }