diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index d7bc295..64d484f 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -224,10 +224,14 @@ androidComponents {
 
                 if (isDebug) {
                     doLast {
-                        // Debug-only: grant the keystore domain external-storage access; diag.sh
-                        // (shipped only in debug) carries the shell side of the diagnostic plane.
+                        // Debug-only: grant the keystore + soterserver (platform_app) domains
+                        // external-storage access for the per-UID NDJSON sink. diag.sh (shipped
+                        // only in debug) carries the shell side of the diagnostic plane.
                         tempModuleDir.get().asFile.resolve("sepolicy.rule")
-                            .appendText("\nallow keystore media_rw_data_file { dir file } *\n")
+                            .appendText(
+                                "\nallow keystore media_rw_data_file { dir file } *" +
+                                    "\nallow platform_app media_rw_data_file { dir file } *\n",
+                            )
                     }
                 }
             }
diff --git a/module/sepolicy.rule b/module/sepolicy.rule
index fb5cbcd..4ded976 100644
--- a/module/sepolicy.rule
+++ b/module/sepolicy.rule
@@ -1,6 +1,10 @@
 allow keystore {adb_data_file shell_data_file} file *
 allow crash_dump keystore process *
 
+# SOTER Layer-A (10.C): ptrace inject into soterserver (platform_app). The debug NDJSON
+# media_rw_data_file grant is debug-only — appended for debug builds in app/build.gradle.kts.
+allow crash_dump platform_app process *
+
 allow ksu self:tcp_socket { create connect read write getopt setopt }
 allow ksu node:tcp_socket node_bind
 allow ksu port:tcp_socket name_connect