diff --git a/apps/rebreak-native/app.config.ts b/apps/rebreak-native/app.config.ts
index 3d76a6b..e05edbe 100644
--- a/apps/rebreak-native/app.config.ts
+++ b/apps/rebreak-native/app.config.ts
@@ -95,6 +95,31 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
   extra: {
     eas: {
       projectId: "a4f2186e-8ca5-4d38-921d-82ae96c9c086",
+      // EAS muss VOR dem Build wissen, dass es eine App-Extension gibt — sonst
+      // generiert es nur Credentials für die Haupt-App und der Xcode-Build kippt
+      // mit "No profiles for 'org.rebreak.app.RebreakURLFilter' were found".
+      // Bundle-ID + Entitlements müssen exakt zu plugins/with-rebreak-protection-ios.js
+      // und modules/rebreak-protection/ios/RebreakURLFilter/RebreakURLFilter.entitlements passen.
+      build: {
+        experimental: {
+          ios: {
+            appExtensions: [
+              {
+                targetName: "RebreakURLFilter",
+                bundleIdentifier: "org.rebreak.app.RebreakURLFilter",
+                entitlements: {
+                  "com.apple.developer.networking.networkextension": [
+                    "content-filter-provider",
+                  ],
+                  "com.apple.security.application-groups": [
+                    "group.org.rebreak.app",
+                  ],
+                },
+              },
+            ],
+          },
+        },
+      },
     },
     apiUrl:
       process.env.EXPO_PUBLIC_API_URL ||