diff --git a/app/src/debug/AndroidManifest.xml b/app/src/debug/AndroidManifest.xml
index 80d6119de46..78fe161e414 100644
--- a/app/src/debug/AndroidManifest.xml
+++ b/app/src/debug/AndroidManifest.xml
@@ -28,6 +28,21 @@
             android:theme="@android:style/Theme.Material.Light.NoActionBar"
             android:name="io.homeassistant.companion.android.HiltComponentActivity"
             />
+
+        <activity
+            android:name=".nfc.TagReaderActivity"
+            android:exported="true">
+            <intent-filter android:autoVerify="true">
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+
+                <data
+                    android:scheme="https"
+                    android:host="next.home-assistant.io"
+                    android:pathPrefix="/tag/" />
+            </intent-filter>
+        </activity>
     </application>
 
 </manifest>
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index e52257f3228..6b2907fb176 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -469,7 +469,12 @@
         <activity
             android:name=".nfc.TagReaderActivity"
             android:label="@string/tag_reader_title"
-            android:exported="true">
+            android:launchMode="singleTask"
+            android:taskAffinity="io.homeassistant.companion.android.tag.reader"
+            android:autoRemoveFromRecents="true"
+            android:showWhenLocked="true"
+            android:exported="true"
+            android:theme="@style/Theme.HomeAssistant.TranslucentOverlay">
             <tools:validation testUrl="https://www.home-assistant.io/tag/123e4567-e89b-12d3-a456-426614174000" />
 
             <intent-filter>
@@ -519,7 +524,7 @@
             android:taskAffinity="io.homeassistant.companion.android.assist"
             android:autoRemoveFromRecents="true"
             android:showWhenLocked="true"
-            android:theme="@style/Theme.HomeAssistant.Assist">
+            android:theme="@style/Theme.HomeAssistant.TranslucentOverlay">
             <intent-filter>
                 <action android:name="android.intent.action.ASSIST" />
                 <category android:name="android.intent.category.DEFAULT" />
diff --git a/app/src/main/kotlin/io/homeassistant/companion/android/nfc/TagReaderActivity.kt b/app/src/main/kotlin/io/homeassistant/companion/android/nfc/TagReaderActivity.kt
index 99cc8ef866f..e5f21ca627f 100644
--- a/app/src/main/kotlin/io/homeassistant/companion/android/nfc/TagReaderActivity.kt
+++ b/app/src/main/kotlin/io/homeassistant/companion/android/nfc/TagReaderActivity.kt
@@ -1,87 +1,48 @@
 package io.homeassistant.companion.android.nfc
 
 import android.content.Intent
-import android.net.Uri
 import android.nfc.NfcAdapter
 import android.os.Bundle
-import android.widget.Toast
 import androidx.activity.compose.setContent
-import androidx.lifecycle.lifecycleScope
+import androidx.activity.viewModels
+import androidx.compose.runtime.getValue
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import dagger.hilt.android.AndroidEntryPoint
 import io.homeassistant.companion.android.BaseActivity
-import io.homeassistant.companion.android.common.R as commonR
-import io.homeassistant.companion.android.common.data.servers.ServerManager
-import io.homeassistant.companion.android.nfc.views.TagReaderView
-import io.homeassistant.companion.android.util.UrlUtil
-import io.homeassistant.companion.android.util.compose.HomeAssistantAppTheme
-import javax.inject.Inject
-import kotlinx.coroutines.async
-import kotlinx.coroutines.awaitAll
-import kotlinx.coroutines.launch
-import timber.log.Timber
+import io.homeassistant.companion.android.common.compose.theme.HATheme
+import io.homeassistant.companion.android.nfc.views.TagReaderScreen
 
 @AndroidEntryPoint
 class TagReaderActivity : BaseActivity() {
 
-    @Inject
-    lateinit var serverManager: ServerManager
+    private val viewModel: TagReaderViewModel by viewModels()
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
 
+        val isNfcTag = intent.action == NfcAdapter.ACTION_NDEF_DISCOVERED
+        val isQrTag = intent.action == Intent.ACTION_VIEW
+
         setContent {
-            HomeAssistantAppTheme {
-                TagReaderView()
+            HATheme {
+                val state by viewModel.uiState.collectAsStateWithLifecycle()
+
+                TagReaderScreen(
+                    state = state,
+                    onAllowOnce = viewModel::onAllowOnce,
+                    onAllowAlways = viewModel::onAllowAlways,
+                    onDismissed = viewModel::onDismissed,
+                    onErrorAcknowledged = viewModel::onErrorAcknowledged,
+                    onFinished = ::finish,
+                )
             }
         }
 
-        lifecycleScope.launch {
-            if (intent.action == NfcAdapter.ACTION_NDEF_DISCOVERED || intent.action == Intent.ACTION_VIEW) {
-                val isNfcTag = intent.action == NfcAdapter.ACTION_NDEF_DISCOVERED
-
-                val url =
-                    if (isNfcTag) {
-                        NFCUtil.extractUrlFromNFCIntent(intent)
-                    } else {
-                        intent.data
-                    }
-                try {
-                    handleTag(url, isNfcTag)
-                } catch (e: Exception) {
-                    showProcessingError(isNfcTag)
-                    Timber.e(e, "Unable to handle url (${if (isNfcTag) "nfc" else "qr"}}): $url")
-                }
-            }
-            finish()
-        }
-    }
-
-    private suspend fun handleTag(url: Uri?, isNfcTag: Boolean) {
-        // https://www.home-assistant.io/tag/5f0ba733-172f-430d-a7f8-e4ad940c88d7
-
-        val nfcTagId = UrlUtil.splitNfcTagId(url)
-        Timber.d("Tag ID: $nfcTagId")
-        if (nfcTagId != null && serverManager.isRegistered()) {
-            serverManager.servers().map {
-                lifecycleScope.async {
-                    try {
-                        serverManager.integrationRepository(it.id).scanTag(hashMapOf("tag_id" to nfcTagId))
-                        Timber.d("Tag scanned to HA successfully")
-                    } catch (e: Exception) {
-                        Timber.e(e, "Tag not scanned to HA")
-                    }
-                }
-            }.awaitAll()
+        if (isNfcTag || isQrTag) {
+            val url = if (isNfcTag) NFCUtil.extractUrlFromNFCIntent(intent) else intent.data
+            viewModel.onIntentReceived(url = url, isNfcTag = isNfcTag)
         } else {
-            showProcessingError(isNfcTag)
+            finish()
         }
     }
-
-    private fun showProcessingError(isNfcTag: Boolean) {
-        Toast.makeText(
-            this,
-            if (isNfcTag) commonR.string.nfc_processing_tag_error else commonR.string.qrcode_processing_tag_error,
-            Toast.LENGTH_LONG,
-        ).show()
-    }
 }
diff --git a/app/src/main/kotlin/io/homeassistant/companion/android/nfc/TagReaderUiState.kt b/app/src/main/kotlin/io/homeassistant/companion/android/nfc/TagReaderUiState.kt
new file mode 100644
index 00000000000..9531954734b
--- /dev/null
+++ b/app/src/main/kotlin/io/homeassistant/companion/android/nfc/TagReaderUiState.kt
@@ -0,0 +1,30 @@
+package io.homeassistant.companion.android.nfc
+
+import androidx.annotation.StringRes
+
+/**
+ * UI states surfaced by [TagReaderViewModel] and consumed by the tag reader screen.
+ */
+sealed interface TagReaderUiState {
+    /** Initial state. No UI is rendered. */
+    data object Initial : TagReaderUiState
+
+    /**
+     * The scanned tag id need approving from the user before any
+     * server action is taken.
+     */
+    data class ApprovingTag(val tagId: String) : TagReaderUiState
+
+    /**
+     * The tag is being scanned to all registered servers.
+     */
+    data object Scanning : TagReaderUiState
+
+    /**
+     * A user-facing error occurred.
+     */
+    data class Error(@StringRes val messageRes: Int) : TagReaderUiState
+
+    /** Terminal state: the activity should call `finish()`. */
+    data object Done : TagReaderUiState
+}
diff --git a/app/src/main/kotlin/io/homeassistant/companion/android/nfc/TagReaderViewModel.kt b/app/src/main/kotlin/io/homeassistant/companion/android/nfc/TagReaderViewModel.kt
new file mode 100644
index 00000000000..b6e1c4ba136
--- /dev/null
+++ b/app/src/main/kotlin/io/homeassistant/companion/android/nfc/TagReaderViewModel.kt
@@ -0,0 +1,152 @@
+package io.homeassistant.companion.android.nfc
+
+import android.net.Uri
+import androidx.annotation.VisibleForTesting
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import dagger.hilt.android.lifecycle.HiltViewModel
+import io.homeassistant.companion.android.common.R as commonR
+import io.homeassistant.companion.android.common.data.prefs.PrefsRepository
+import io.homeassistant.companion.android.common.data.servers.ServerManager
+import io.homeassistant.companion.android.util.UrlUtil
+import javax.inject.Inject
+import kotlin.coroutines.cancellation.CancellationException
+import kotlin.time.Duration.Companion.seconds
+import kotlinx.coroutines.async
+import kotlinx.coroutines.awaitAll
+import kotlinx.coroutines.coroutineScope
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.launch
+import timber.log.Timber
+
+/**
+ * Lower bound on how long the [TagReaderUiState.Scanning] state stays visible. Servers may
+ * answer faster than the user can perceive the loading sheet, so we keep it on screen for
+ * at least this long before transitioning to [TagReaderUiState.Done].
+ */
+@VisibleForTesting
+internal val MIN_SCANNING_DURATION = 1.5.seconds
+
+/**
+ * Drives the NFC / QR tag reader flow.
+ *
+ * Reads the tag id from the incoming URL, decides whether it can be auto-scanned
+ * based on whether it is already present in the allowed tags preference, or requires
+ * manual user approval when it is not yet allowed, and exposes the result as [uiState].
+ */
+@HiltViewModel
+class TagReaderViewModel @Inject constructor(
+    private val serverManager: ServerManager,
+    private val prefsRepository: PrefsRepository,
+) : ViewModel() {
+
+    private val _uiState = MutableStateFlow<TagReaderUiState>(TagReaderUiState.Initial)
+    val uiState: StateFlow<TagReaderUiState> = _uiState.asStateFlow()
+
+    /**
+     * Called by the activity once the launching intent has been parsed. Drives
+     * a single tag-handling cycle and updates [uiState] accordingly.
+     */
+    fun onIntentReceived(url: Uri?, isNfcTag: Boolean) {
+        viewModelScope.launch {
+            val tagId = UrlUtil.splitNfcTagId(url)
+            if (tagId == null) {
+                Timber.w("Tag intent had no tag id, isNfcTag=$isNfcTag")
+                _uiState.value = TagReaderUiState.Error(errorMessageRes(isNfcTag))
+                return@launch
+            }
+            if (!serverManager.isRegistered()) {
+                Timber.w("Tag scanned but no server is registered")
+                _uiState.value = TagReaderUiState.Error(errorMessageRes(isNfcTag))
+                return@launch
+            }
+            if (prefsRepository.allowedTags().contains(tagId)) {
+                scanAndFinish(tagId)
+            } else {
+                _uiState.value = TagReaderUiState.ApprovingTag(tagId)
+            }
+        }
+    }
+
+    /**
+     * Called when the user taps "Allow Once" in the approval bottom sheet. Transitions
+     * the sheet into its scanning state and dispatches the tag to all registered servers.
+     *
+     * Has no effect unless the current state is [TagReaderUiState.ApprovingTag].
+     */
+    fun onAllowOnce() {
+        val current = _uiState.value as? TagReaderUiState.ApprovingTag ?: return
+        viewModelScope.launch {
+            scanAndFinish(current.tagId)
+        }
+    }
+
+    /**
+     * Called when the user taps "Allow always" in the approval bottom sheet. Persists
+     * the tag id so future scans of the same tag skip the
+     * approval step, then proceeds with the scan in the same way as [onAllowOnce].
+     *
+     * Has no effect unless the current state is [TagReaderUiState.ApprovingTag].
+     */
+    fun onAllowAlways() {
+        val current = _uiState.value as? TagReaderUiState.ApprovingTag ?: return
+        viewModelScope.launch {
+            prefsRepository.addAllowedTag(current.tagId)
+            scanAndFinish(current.tagId)
+        }
+    }
+
+    /**
+     * Called once the user-facing error has been dismissed. Transitions to [TagReaderUiState.Done]
+     * so the activity can finish.
+     */
+    fun onErrorAcknowledged() {
+        if (_uiState.value is TagReaderUiState.Error) {
+            _uiState.value = TagReaderUiState.Done
+        }
+    }
+
+    /**
+     * Called when the user dismisses the approval.
+     * Transitions to [TagReaderUiState.Done] so the activity can finish.
+     */
+    fun onDismissed() {
+        _uiState.value = TagReaderUiState.Done
+    }
+
+    private suspend fun scanAndFinish(tagId: String) {
+        _uiState.value = TagReaderUiState.Scanning
+        coroutineScope {
+            launch { delay(MIN_SCANNING_DURATION) }
+            launch { scanTag(tagId) }
+        }
+        _uiState.value = TagReaderUiState.Done
+    }
+
+    private suspend fun scanTag(tagId: String) {
+        coroutineScope {
+            serverManager.servers().map { server ->
+                async {
+                    try {
+                        serverManager.integrationRepository(server.id)
+                            .scanTag(mapOf("tag_id" to tagId))
+                        Timber.d("Tag scanned to HA serverId=${server.id}")
+                    } catch (e: CancellationException) {
+                        throw e
+                    } catch (e: Exception) {
+                        Timber.e(e, "Tag not scanned to HA serverId=${server.id}")
+                    }
+                }
+            }.awaitAll()
+        }
+    }
+
+    private fun errorMessageRes(isNfcTag: Boolean): Int = if (isNfcTag) {
+        commonR.string.nfc_processing_tag_error
+    } else {
+        commonR.string.qrcode_processing_tag_error
+    }
+}
diff --git a/app/src/main/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderScreen.kt b/app/src/main/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderScreen.kt
new file mode 100644
index 00000000000..2b6982d65a2
--- /dev/null
+++ b/app/src/main/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderScreen.kt
@@ -0,0 +1,297 @@
+package io.homeassistant.companion.android.nfc.views
+
+import androidx.compose.foundation.Image
+import androidx.compose.foundation.background
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.interaction.MutableInteractionSource
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.WindowInsets
+import androidx.compose.foundation.layout.WindowInsetsSides
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.only
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.safeDrawing
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.windowInsetsPadding
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.Icon
+import androidx.compose.material3.SnackbarHost
+import androidx.compose.material3.SnackbarHostState
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.tooling.preview.Preview
+import androidx.compose.ui.unit.dp
+import io.homeassistant.companion.android.R
+import io.homeassistant.companion.android.common.R as commonR
+import io.homeassistant.companion.android.common.compose.composable.HAFilledButton
+import io.homeassistant.companion.android.common.compose.composable.HAModalBottomSheet
+import io.homeassistant.companion.android.common.compose.composable.HAPlainButton
+import io.homeassistant.companion.android.common.compose.composable.rememberHAModalBottomSheetState
+import io.homeassistant.companion.android.common.compose.theme.HADimens
+import io.homeassistant.companion.android.common.compose.theme.HATextStyle
+import io.homeassistant.companion.android.common.compose.theme.HAThemeForPreview
+import io.homeassistant.companion.android.common.compose.theme.LocalHAColorScheme
+import io.homeassistant.companion.android.common.compose.util.adaptiveIconPainterResource
+import io.homeassistant.companion.android.nfc.TagReaderUiState
+import io.homeassistant.companion.android.util.safeBottomWindowInsets
+
+private val SCANNING_CONTENT_HEIGHT = 160.dp
+
+/** Visible diameter of the sheet close button (background + clip). */
+private val CLOSE_BUTTON_VISIBLE_SIZE = 40.dp
+
+/** Tap target size of the sheet close button — meets Material's 48dp minimum for accessibility. */
+private val CLOSE_BUTTON_TAP_SIZE = 48.dp
+
+/**
+ * Renders the tag reader UI for a given [state].
+ *
+ * - [TagReaderUiState.Initial]: nothing is rendered.
+ * - [TagReaderUiState.ApprovingTag]: bottom sheet with the approval content. Dismissal is
+ *   wired to [onDismissed].
+ * - [TagReaderUiState.Scanning]: bottom sheet with the loading content.
+ * - [TagReaderUiState.Error]: a snackbar is shown for [TagReaderUiState.Error.messageRes];
+ *   once it is dismissed [onErrorAcknowledged] is invoked.
+ * - [TagReaderUiState.Done]: if a sheet was visible, it is animated out before [onFinished]
+ *   is invoked. Without this lag the Scanning → Done transition would snap away unanimated.
+ *
+ * @param onFinished invoked after the screen has finished any closing animations and the
+ * activity should call `finish()`.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun TagReaderScreen(
+    state: TagReaderUiState,
+    onAllowOnce: () -> Unit,
+    onAllowAlways: () -> Unit,
+    onDismissed: () -> Unit,
+    onErrorAcknowledged: () -> Unit,
+    onFinished: () -> Unit,
+    modifier: Modifier = Modifier,
+) {
+    val snackbarHostState = remember { SnackbarHostState() }
+    val sheetState = rememberHAModalBottomSheetState()
+
+    // Tracks whether the bottom sheet has ever been shown. Used to decide whether the
+    // [TagReaderUiState.Done] state should keep the sheet in composition long enough to
+    // animate it out without this flag, an Error → Done transition would briefly render
+    // the sheet only to immediately animate it away (a visible blink).
+    var sheetWasShown by remember { mutableStateOf(false) }
+    LaunchedEffect(state) {
+        if (state is TagReaderUiState.ApprovingTag || state is TagReaderUiState.Scanning) {
+            sheetWasShown = true
+        }
+    }
+
+    val showSheet = state is TagReaderUiState.ApprovingTag ||
+        state is TagReaderUiState.Scanning ||
+        (state is TagReaderUiState.Done && sheetWasShown)
+
+    Box(modifier = modifier.fillMaxSize()) {
+        SnackbarHost(
+            hostState = snackbarHostState,
+            modifier = Modifier
+                .align(Alignment.BottomCenter)
+                .windowInsetsPadding(safeBottomWindowInsets(applyHorizontal = true)),
+        )
+
+        if (showSheet) {
+            HAModalBottomSheet(
+                bottomSheetState = sheetState,
+                onDismissRequest = onDismissed,
+                dragHandle = {},
+            ) {
+                Column(
+                    modifier = Modifier.windowInsetsPadding(WindowInsets.safeDrawing.only(WindowInsetsSides.Bottom)),
+                ) {
+                    TagApprovalSheetHeader(onClose = onDismissed)
+
+                    when (state) {
+                        is TagReaderUiState.ApprovingTag -> ApprovingContent(
+                            tagId = state.tagId,
+                            onAllowOnce = onAllowOnce,
+                            onAllowAlways = onAllowAlways,
+                        )
+
+                        TagReaderUiState.Scanning -> ScanningContent()
+                        TagReaderUiState.Done -> Unit
+                    }
+                }
+            }
+        }
+    }
+
+    if (state is TagReaderUiState.Done) {
+        LaunchedEffect(Unit) {
+            if (sheetState.isVisible) {
+                sheetState.hide()
+            }
+            onFinished()
+        }
+    }
+
+    if (state is TagReaderUiState.Error) {
+        val message = stringResource(state.messageRes)
+        LaunchedEffect(state) {
+            snackbarHostState.showSnackbar(message)
+            onErrorAcknowledged()
+        }
+    }
+}
+
+@Composable
+private fun TagApprovalSheetHeader(onClose: () -> Unit, modifier: Modifier = Modifier) {
+    Box(
+        modifier = modifier
+            .fillMaxWidth()
+            .padding(bottom = HADimens.SPACE2),
+    ) {
+        Column(modifier = Modifier.align(Alignment.TopCenter)) {
+            Image(
+                painter = adaptiveIconPainterResource(R.mipmap.ic_launcher_round),
+                contentDescription = stringResource(commonR.string.home_assistant_branding_icon_content_description),
+                modifier = Modifier
+                    .padding(top = HADimens.SPACE5)
+                    .size(36.dp)
+                    .align(Alignment.CenterHorizontally)
+                    .clip(CircleShape),
+            )
+            Text(
+                text = stringResource(commonR.string.app_name),
+                style = HATextStyle.BodyMedium,
+                modifier = Modifier
+                    .padding(HADimens.SPACE2)
+                    .align(Alignment.CenterHorizontally),
+            )
+        }
+        // Replicates Close button of the Android 17 biometrics bottom sheet
+        Box(
+            modifier = Modifier
+                .align(Alignment.TopEnd)
+                .padding(HADimens.SPACE2)
+                .size(CLOSE_BUTTON_TAP_SIZE)
+                .clickable(
+                    interactionSource = remember { MutableInteractionSource() },
+                    indication = null,
+                    onClick = onClose,
+                ),
+            contentAlignment = Alignment.Center,
+        ) {
+            Box(
+                modifier = Modifier
+                    .size(CLOSE_BUTTON_VISIBLE_SIZE)
+                    .clip(CircleShape)
+                    .background(LocalHAColorScheme.current.colorSurfaceLow),
+                contentAlignment = Alignment.Center,
+            ) {
+                Icon(
+                    imageVector = Icons.Default.Close,
+                    contentDescription = stringResource(commonR.string.cancel),
+                    tint = LocalHAColorScheme.current.colorOnNeutralQuiet,
+                )
+            }
+        }
+    }
+}
+
+@Composable
+private fun ApprovingContent(tagId: String, onAllowOnce: () -> Unit, onAllowAlways: () -> Unit) {
+    Column(
+        modifier = Modifier
+            .fillMaxWidth()
+            .padding(horizontal = HADimens.SPACE6, vertical = HADimens.SPACE4),
+        verticalArrangement = Arrangement.spacedBy(HADimens.SPACE3),
+        horizontalAlignment = Alignment.CenterHorizontally,
+    ) {
+        Text(
+            text = stringResource(commonR.string.tag_approval_title),
+            style = HATextStyle.HeadlineMedium,
+            modifier = Modifier.fillMaxWidth(),
+        )
+        Text(
+            text = stringResource(commonR.string.tag_approval_description, tagId),
+            style = HATextStyle.Body,
+            modifier = Modifier
+                .fillMaxWidth()
+                .padding(bottom = HADimens.SPACE4),
+        )
+
+        HAFilledButton(
+            text = stringResource(commonR.string.tag_allow_always),
+            onClick = onAllowAlways,
+            modifier = Modifier.fillMaxWidth(),
+        )
+        HAPlainButton(
+            text = stringResource(commonR.string.tag_allow_once),
+            onClick = onAllowOnce,
+            modifier = Modifier.fillMaxWidth(),
+        )
+    }
+}
+
+@Composable
+private fun ScanningContent() {
+    Column(
+        modifier = Modifier
+            .fillMaxWidth()
+            .height(SCANNING_CONTENT_HEIGHT)
+            .padding(horizontal = HADimens.SPACE6, vertical = HADimens.SPACE4),
+        horizontalAlignment = Alignment.CenterHorizontally,
+        verticalArrangement = Arrangement.spacedBy(HADimens.SPACE4, Alignment.CenterVertically),
+    ) {
+        CircularProgressIndicator()
+        Text(
+            text = stringResource(commonR.string.tag_reader_title),
+            style = HATextStyle.Body,
+            textAlign = TextAlign.Center,
+        )
+    }
+}
+
+@Preview
+@Composable
+private fun ApprovingPreview() {
+    HAThemeForPreview {
+        TagReaderScreen(
+            state = TagReaderUiState.ApprovingTag("aa69fa33-39fd-4247-a559-af06081b2935"),
+            onAllowOnce = {},
+            onErrorAcknowledged = {},
+            onDismissed = {},
+            onAllowAlways = {},
+            onFinished = {},
+        )
+    }
+}
+
+@Preview
+@Composable
+private fun ScanningPreview() {
+    HAThemeForPreview {
+        TagReaderScreen(
+            state = TagReaderUiState.Scanning,
+            onAllowOnce = {},
+            onErrorAcknowledged = {},
+            onDismissed = {},
+            onAllowAlways = {},
+            onFinished = {},
+        )
+    }
+}
diff --git a/app/src/main/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderView.kt b/app/src/main/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderView.kt
deleted file mode 100644
index 82ac035fc32..00000000000
--- a/app/src/main/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderView.kt
+++ /dev/null
@@ -1,47 +0,0 @@
-package io.homeassistant.companion.android.nfc.views
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.WindowInsets
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.safeDrawing
-import androidx.compose.foundation.layout.windowInsetsPadding
-import androidx.compose.material.CircularProgressIndicator
-import androidx.compose.material.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.style.TextAlign
-import androidx.compose.ui.tooling.preview.Preview
-import androidx.compose.ui.unit.dp
-import io.homeassistant.companion.android.common.R
-
-@Composable
-fun TagReaderView(modifier: Modifier = Modifier) {
-    Column(
-        modifier = modifier
-            .fillMaxSize()
-            .windowInsetsPadding(WindowInsets.safeDrawing)
-            .padding(all = 16.dp),
-        horizontalAlignment = Alignment.CenterHorizontally,
-        verticalArrangement = Arrangement.Center,
-    ) {
-        CircularProgressIndicator()
-        Text(
-            text = stringResource(R.string.tag_reader_title),
-            textAlign = TextAlign.Center,
-            modifier = Modifier
-                .fillMaxWidth(0.75f)
-                .padding(top = 16.dp),
-        )
-    }
-}
-
-@Preview(showSystemUi = true)
-@Composable
-private fun TagReaderViewPreview() {
-    TagReaderView()
-}
diff --git a/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsFragment.kt b/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsFragment.kt
index f8d76fc25a4..c88101204e6 100644
--- a/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsFragment.kt
+++ b/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsFragment.kt
@@ -105,6 +105,17 @@ class DeveloperSettingsFragment :
                 return@setOnPreferenceClickListener true
             }
         }
+        findPreference<Preference>("tag_clear_allowed")?.let {
+            it.setOnPreferenceClickListener {
+                presenter.clearAllowedTags()
+                Toast.makeText(
+                    requireContext(),
+                    commonR.string.clear_allowed_tags_complete,
+                    Toast.LENGTH_SHORT,
+                ).show()
+                return@setOnPreferenceClickListener true
+            }
+        }
     }
 
     override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
diff --git a/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsPresenter.kt b/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsPresenter.kt
index bd5930bb32d..38c11c02696 100644
--- a/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsPresenter.kt
+++ b/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsPresenter.kt
@@ -17,4 +17,5 @@ interface DeveloperSettingsPresenter {
 
     fun webViewSupportsClearCache(): Boolean
     fun clearWebViewCache()
+    fun clearAllowedTags()
 }
diff --git a/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsPresenterImpl.kt b/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsPresenterImpl.kt
index 47edcd6ddd9..e204c81e660 100644
--- a/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsPresenterImpl.kt
+++ b/app/src/main/kotlin/io/homeassistant/companion/android/settings/developer/DeveloperSettingsPresenterImpl.kt
@@ -168,4 +168,10 @@ class DeveloperSettingsPresenterImpl @Inject constructor(
             view.onWebViewClearCacheResult(success = false)
         }
     }
+
+    override fun clearAllowedTags() {
+        mainScope.launch {
+            prefsRepository.clearAllowedTags()
+        }
+    }
 }
diff --git a/app/src/main/res/values/styles.xml b/app/src/main/res/values/styles.xml
index 8a1187b396e..edccfff7225 100644
--- a/app/src/main/res/values/styles.xml
+++ b/app/src/main/res/values/styles.xml
@@ -29,7 +29,7 @@
         <item name="android:windowLightStatusBar">@bool/isLightMode</item>
     </style>
 
-    <style name="Theme.HomeAssistant.Assist" parent="Theme.HomeAssistant" >
+    <style name="Theme.HomeAssistant.TranslucentOverlay" parent="Theme.HomeAssistant" >
         <item name="android:windowIsTranslucent">true</item>
         <item name="android:windowBackground">@android:color/transparent</item>
         <item name="android:windowContentOverlay">@null</item>
diff --git a/app/src/main/res/xml/preferences_developer.xml b/app/src/main/res/xml/preferences_developer.xml
index eee91dfc732..2cf85a49a19 100644
--- a/app/src/main/res/xml/preferences_developer.xml
+++ b/app/src/main/res/xml/preferences_developer.xml
@@ -20,8 +20,12 @@
         android:icon="@drawable/ic_thread"
         android:title="@string/thread_debug"
         android:summary="@string/thread_debug_summary"/>
+    <Preference
+        android:key="tag_clear_allowed"
+        android:icon="@drawable/ic_delete"
+        android:title="@string/clear_allowed_tags"/>
     <Preference
         android:key="webview_clear_cache"
         android:icon="@drawable/ic_clear"
         android:title="@string/clear_webview_cache"/>
-</PreferenceScreen>
\ No newline at end of file
+</PreferenceScreen>
diff --git a/app/src/screenshotTest/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest.kt b/app/src/screenshotTest/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest.kt
new file mode 100644
index 00000000000..9c78cee610c
--- /dev/null
+++ b/app/src/screenshotTest/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest.kt
@@ -0,0 +1,42 @@
+package io.homeassistant.companion.android.nfc.views
+
+import androidx.compose.runtime.Composable
+import com.android.tools.screenshot.PreviewTest
+import io.homeassistant.companion.android.common.compose.theme.HAThemeForPreview
+import io.homeassistant.companion.android.nfc.TagReaderUiState
+import io.homeassistant.companion.android.util.compose.HAPreviews
+
+class TagReaderScreenScreenshotTest {
+
+    @PreviewTest
+    @HAPreviews
+    @Composable
+    fun `TagReaderScreen approving`() {
+        HAThemeForPreview {
+            TagReaderScreen(
+                state = TagReaderUiState.ApprovingTag("custom-tag-foo"),
+                onAllowOnce = {},
+                onAllowAlways = {},
+                onDismissed = {},
+                onErrorAcknowledged = {},
+                onFinished = {},
+            )
+        }
+    }
+
+    @PreviewTest
+    @HAPreviews
+    @Composable
+    fun `TagReaderScreen scanning`() {
+        HAThemeForPreview {
+            TagReaderScreen(
+                state = TagReaderUiState.Scanning,
+                onAllowOnce = {},
+                onAllowAlways = {},
+                onDismissed = {},
+                onErrorAcknowledged = {},
+                onFinished = {},
+            )
+        }
+    }
+}
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_foldable_c908f502_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_foldable_c908f502_0.png
new file mode 100644
index 00000000000..6d4506faf24
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_foldable_c908f502_0.png differ
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_phone_e05166be_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_phone_e05166be_0.png
new file mode 100644
index 00000000000..eab6b5d275d
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_phone_e05166be_0.png differ
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_phone_landscape_9e00b29d_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_phone_landscape_9e00b29d_0.png
new file mode 100644
index 00000000000..907bc3339d8
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_phone_landscape_9e00b29d_0.png differ
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_small_phone_66e7bbf2_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_small_phone_66e7bbf2_0.png
new file mode 100644
index 00000000000..a5c00c107ea
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_small_phone_66e7bbf2_0.png differ
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_tablet_2f22c4ea_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_tablet_2f22c4ea_0.png
new file mode 100644
index 00000000000..f304a902829
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_tablet_2f22c4ea_0.png differ
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_tablet_landscape_62cae397_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_tablet_landscape_62cae397_0.png
new file mode 100644
index 00000000000..fc6c0d3f16f
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen approving_tablet_landscape_62cae397_0.png differ
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_foldable_c908f502_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_foldable_c908f502_0.png
new file mode 100644
index 00000000000..bf6b8cb4aa5
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_foldable_c908f502_0.png differ
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_phone_e05166be_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_phone_e05166be_0.png
new file mode 100644
index 00000000000..0b56d2baf6e
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_phone_e05166be_0.png differ
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_phone_landscape_9e00b29d_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_phone_landscape_9e00b29d_0.png
new file mode 100644
index 00000000000..d5715c045d5
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_phone_landscape_9e00b29d_0.png differ
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_small_phone_66e7bbf2_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_small_phone_66e7bbf2_0.png
new file mode 100644
index 00000000000..6a1b2d06607
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_small_phone_66e7bbf2_0.png differ
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_tablet_2f22c4ea_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_tablet_2f22c4ea_0.png
new file mode 100644
index 00000000000..172a4c38858
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_tablet_2f22c4ea_0.png differ
diff --git a/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_tablet_landscape_62cae397_0.png b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_tablet_landscape_62cae397_0.png
new file mode 100644
index 00000000000..700cef41ea3
Binary files /dev/null and b/app/src/screenshotTestFullDebug/reference/io/homeassistant/companion/android/nfc/views/TagReaderScreenScreenshotTest/TagReaderScreen scanning_tablet_landscape_62cae397_0.png differ
diff --git a/app/src/test/kotlin/io/homeassistant/companion/android/nfc/TagReaderViewModelTest.kt b/app/src/test/kotlin/io/homeassistant/companion/android/nfc/TagReaderViewModelTest.kt
new file mode 100644
index 00000000000..2931c03b7c5
--- /dev/null
+++ b/app/src/test/kotlin/io/homeassistant/companion/android/nfc/TagReaderViewModelTest.kt
@@ -0,0 +1,294 @@
+package io.homeassistant.companion.android.nfc
+
+import android.net.Uri
+import app.cash.turbine.test
+import io.homeassistant.companion.android.common.R as commonR
+import io.homeassistant.companion.android.common.data.integration.IntegrationRepository
+import io.homeassistant.companion.android.common.data.prefs.PrefsRepository
+import io.homeassistant.companion.android.common.data.servers.ServerManager
+import io.homeassistant.companion.android.database.server.Server
+import io.homeassistant.companion.android.testing.unit.ConsoleLogExtension
+import io.homeassistant.companion.android.testing.unit.MainDispatcherJUnit5Extension
+import io.mockk.coEvery
+import io.mockk.coVerify
+import io.mockk.every
+import io.mockk.mockk
+import kotlinx.coroutines.ExperimentalCoroutinesApi
+import kotlinx.coroutines.test.currentTime
+import kotlinx.coroutines.test.runTest
+import org.junit.jupiter.api.Assertions.assertEquals
+import org.junit.jupiter.api.Assertions.assertTrue
+import org.junit.jupiter.api.Test
+import org.junit.jupiter.api.extension.ExtendWith
+
+@OptIn(ExperimentalCoroutinesApi::class)
+@ExtendWith(MainDispatcherJUnit5Extension::class, ConsoleLogExtension::class)
+class TagReaderViewModelTest {
+
+    private val serverManager: ServerManager = mockk(relaxed = true)
+    private val prefsRepository: PrefsRepository = mockk(relaxed = true)
+
+    private fun createViewModel(): TagReaderViewModel = TagReaderViewModel(serverManager = serverManager, prefsRepository = prefsRepository)
+
+    private fun uri(value: String): Uri = mockk(relaxed = true) {
+        every { this@mockk.toString() } returns value
+    }
+
+    @Test
+    fun `Given URL with no tag id and NFC origin, when onIntentReceived, then state becomes nfc Error`() = runTest {
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onIntentReceived(url = uri("https://example.com/not-a-tag"), isNfcTag = true)
+            assertEquals(TagReaderUiState.Error(commonR.string.nfc_processing_tag_error), awaitItem())
+        }
+    }
+
+    @Test
+    fun `Given URL with no tag id and QR origin, when onIntentReceived, then state becomes qrcode Error`() = runTest {
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onIntentReceived(url = uri("https://example.com/not-a-tag"), isNfcTag = false)
+            assertEquals(TagReaderUiState.Error(commonR.string.qrcode_processing_tag_error), awaitItem())
+        }
+    }
+
+    @Test
+    fun `Given no server registered, when onIntentReceived, then state becomes Error`() = runTest {
+        coEvery { serverManager.isRegistered() } returns false
+
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onIntentReceived(
+                url = uri("https://www.home-assistant.io/tag/5f0ba733-172f-430d-a7f8-e4ad940c88d7"),
+                isNfcTag = true,
+            )
+            assertEquals(TagReaderUiState.Error(commonR.string.nfc_processing_tag_error), awaitItem())
+        }
+    }
+
+    @Test
+    fun `Given tag id not in allowed list, when onIntentReceived, then state becomes ApprovingTag and scanTag is never called`() = runTest {
+        val server1: Server = mockk(relaxed = true) { every { id } returns 1 }
+        val repo1: IntegrationRepository = mockk(relaxed = true)
+
+        coEvery { serverManager.isRegistered() } returns true
+        coEvery { serverManager.servers() } returns listOf(server1)
+        coEvery { serverManager.integrationRepository(1) } returns repo1
+        coEvery { prefsRepository.allowedTags() } returns emptySet()
+
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onIntentReceived(
+                url = uri("https://www.home-assistant.io/tag/custom-tag-foo"),
+                isNfcTag = true,
+            )
+            assertEquals(TagReaderUiState.ApprovingTag("custom-tag-foo"), awaitItem())
+        }
+
+        coVerify(exactly = 0) { repo1.scanTag(any()) }
+    }
+
+    @Test
+    fun `Given tag id already in allowed list, when onIntentReceived, then approval is skipped and state goes Scanning then Done`() = runTest {
+        val server1: Server = mockk(relaxed = true) { every { id } returns 1 }
+        val repo1: IntegrationRepository = mockk(relaxed = true)
+
+        coEvery { serverManager.isRegistered() } returns true
+        coEvery { serverManager.servers() } returns listOf(server1)
+        coEvery { serverManager.integrationRepository(1) } returns repo1
+        coEvery { prefsRepository.allowedTags() } returns setOf("custom-tag-foo")
+
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onIntentReceived(
+                url = uri("https://www.home-assistant.io/tag/custom-tag-foo"),
+                isNfcTag = true,
+            )
+            assertEquals(TagReaderUiState.Scanning, awaitItem())
+            assertEquals(TagReaderUiState.Done, awaitItem())
+        }
+
+        coVerify(exactly = 1) { repo1.scanTag(mapOf("tag_id" to "custom-tag-foo")) }
+        // The tag was already on the allow list — onIntentReceived must not re-add it.
+        coVerify(exactly = 0) { prefsRepository.addAllowedTag(any()) }
+    }
+
+    @Test
+    fun `Given ApprovingTag and two registered servers, when onAllowOnce, then state goes Scanning then Done and scanTag is called per server`() = runTest {
+        val server1: Server = mockk(relaxed = true) { every { id } returns 1 }
+        val server2: Server = mockk(relaxed = true) { every { id } returns 2 }
+        val repo1: IntegrationRepository = mockk(relaxed = true)
+        val repo2: IntegrationRepository = mockk(relaxed = true)
+
+        coEvery { serverManager.isRegistered() } returns true
+        coEvery { serverManager.servers() } returns listOf(server1, server2)
+        coEvery { serverManager.integrationRepository(1) } returns repo1
+        coEvery { serverManager.integrationRepository(2) } returns repo2
+
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onIntentReceived(
+                url = uri("https://www.home-assistant.io/tag/custom-tag-foo"),
+                isNfcTag = true,
+            )
+            assertEquals(TagReaderUiState.ApprovingTag("custom-tag-foo"), awaitItem())
+
+            viewModel.onAllowOnce()
+            assertEquals(TagReaderUiState.Scanning, awaitItem())
+            assertEquals(TagReaderUiState.Done, awaitItem())
+        }
+
+        coVerify(exactly = 1) { repo1.scanTag(mapOf("tag_id" to "custom-tag-foo")) }
+        coVerify(exactly = 1) { repo2.scanTag(mapOf("tag_id" to "custom-tag-foo")) }
+        coVerify(exactly = 0) { prefsRepository.addAllowedTag(any()) }
+    }
+
+    @Test
+    fun `Given ApprovingTag, when onAllowAlways, then tag is persisted and state goes Scanning then Done and scanTag is called`() = runTest {
+        val server1: Server = mockk(relaxed = true) { every { id } returns 1 }
+        val repo1: IntegrationRepository = mockk(relaxed = true)
+
+        coEvery { serverManager.isRegistered() } returns true
+        coEvery { serverManager.servers() } returns listOf(server1)
+        coEvery { serverManager.integrationRepository(1) } returns repo1
+
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onIntentReceived(
+                url = uri("https://www.home-assistant.io/tag/custom-tag-foo"),
+                isNfcTag = true,
+            )
+            assertEquals(TagReaderUiState.ApprovingTag("custom-tag-foo"), awaitItem())
+
+            viewModel.onAllowAlways()
+            assertEquals(TagReaderUiState.Scanning, awaitItem())
+            assertEquals(TagReaderUiState.Done, awaitItem())
+        }
+
+        coVerify(exactly = 1) { prefsRepository.addAllowedTag("custom-tag-foo") }
+        coVerify(exactly = 1) { repo1.scanTag(mapOf("tag_id" to "custom-tag-foo")) }
+    }
+
+    @Test
+    fun `Given Initial state, when onAllowAlways, then state stays Initial and tag is not persisted`() = runTest {
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onAllowAlways()
+            expectNoEvents()
+        }
+        coVerify(exactly = 0) { prefsRepository.addAllowedTag(any()) }
+        coVerify(exactly = 0) { serverManager.servers() }
+    }
+
+    @Test
+    fun `Given two servers and scanTag throws on first, when onAllowOnce, then state still becomes Done and second server is still attempted`() = runTest {
+        val server1: Server = mockk(relaxed = true) { every { id } returns 1 }
+        val server2: Server = mockk(relaxed = true) { every { id } returns 2 }
+        val repo1: IntegrationRepository = mockk()
+        val repo2: IntegrationRepository = mockk(relaxed = true)
+
+        coEvery { serverManager.isRegistered() } returns true
+        coEvery { serverManager.servers() } returns listOf(server1, server2)
+        coEvery { serverManager.integrationRepository(1) } returns repo1
+        coEvery { serverManager.integrationRepository(2) } returns repo2
+        coEvery { repo1.scanTag(any()) } throws java.io.IOException("boom")
+
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onIntentReceived(
+                url = uri("https://www.home-assistant.io/tag/custom-tag-foo"),
+                isNfcTag = true,
+            )
+            assertEquals(TagReaderUiState.ApprovingTag("custom-tag-foo"), awaitItem())
+
+            viewModel.onAllowOnce()
+            assertEquals(TagReaderUiState.Scanning, awaitItem())
+            assertEquals(TagReaderUiState.Done, awaitItem())
+        }
+
+        coVerify(exactly = 1) { repo2.scanTag(mapOf("tag_id" to "custom-tag-foo")) }
+    }
+
+    @Test
+    fun `Given ApprovingTag, when onAllowOnce, then Scanning state lasts at least MIN_SCANNING_DURATION before Done`() = runTest {
+        val server1: Server = mockk(relaxed = true) { every { id } returns 1 }
+        val repo1: IntegrationRepository = mockk(relaxed = true)
+
+        coEvery { serverManager.isRegistered() } returns true
+        coEvery { serverManager.servers() } returns listOf(server1)
+        coEvery { serverManager.integrationRepository(1) } returns repo1
+
+        val testScope = this
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onIntentReceived(
+                url = uri("https://www.home-assistant.io/tag/custom-tag-foo"),
+                isNfcTag = true,
+            )
+            assertEquals(TagReaderUiState.ApprovingTag("custom-tag-foo"), awaitItem())
+
+            val scanningStart = testScope.currentTime
+            viewModel.onAllowOnce()
+            assertEquals(TagReaderUiState.Scanning, awaitItem())
+            assertEquals(TagReaderUiState.Done, awaitItem())
+            val elapsed = testScope.currentTime - scanningStart
+
+            assertTrue(
+                elapsed >= MIN_SCANNING_DURATION.inWholeMilliseconds,
+                "Expected Scanning to last at least $MIN_SCANNING_DURATION, lasted ${elapsed}ms",
+            )
+        }
+    }
+
+    @Test
+    fun `Given Initial state, when onAllowOnce, then state stays Initial and servers is never queried`() = runTest {
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onAllowOnce()
+            expectNoEvents()
+        }
+        coVerify(exactly = 0) { serverManager.servers() }
+    }
+
+    @Test
+    fun `Given Error state, when onErrorAcknowledged, then state becomes Done`() = runTest {
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onIntentReceived(url = uri("https://example.com/not-a-tag"), isNfcTag = true)
+            assertEquals(TagReaderUiState.Error(commonR.string.nfc_processing_tag_error), awaitItem())
+
+            viewModel.onErrorAcknowledged()
+            assertEquals(TagReaderUiState.Done, awaitItem())
+        }
+    }
+
+    @Test
+    fun `Given ApprovingTag state, when onDismissed, then state becomes Done`() = runTest {
+        coEvery { serverManager.isRegistered() } returns true
+
+        val viewModel = createViewModel()
+        viewModel.uiState.test {
+            assertEquals(TagReaderUiState.Initial, awaitItem())
+            viewModel.onIntentReceived(
+                url = uri("https://www.home-assistant.io/tag/custom-tag-foo"),
+                isNfcTag = true,
+            )
+            assertEquals(TagReaderUiState.ApprovingTag("custom-tag-foo"), awaitItem())
+
+            viewModel.onDismissed()
+            assertEquals(TagReaderUiState.Done, awaitItem())
+        }
+    }
+}
diff --git a/app/src/test/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderScreenTest.kt b/app/src/test/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderScreenTest.kt
new file mode 100644
index 00000000000..0d0456e9035
--- /dev/null
+++ b/app/src/test/kotlin/io/homeassistant/companion/android/nfc/views/TagReaderScreenTest.kt
@@ -0,0 +1,220 @@
+package io.homeassistant.companion.android.nfc.views
+
+import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
+import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
+import dagger.hilt.android.testing.HiltAndroidRule
+import dagger.hilt.android.testing.HiltAndroidTest
+import dagger.hilt.android.testing.HiltTestApplication
+import io.homeassistant.companion.android.HiltComponentActivity
+import io.homeassistant.companion.android.common.R as commonR
+import io.homeassistant.companion.android.nfc.TagReaderUiState
+import io.homeassistant.companion.android.testing.unit.ConsoleLogRule
+import io.homeassistant.companion.android.testing.unit.stringResource
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.annotation.Config
+
+@RunWith(RobolectricTestRunner::class)
+@Config(application = HiltTestApplication::class)
+@HiltAndroidTest
+class TagReaderScreenTest {
+
+    @get:Rule(order = 0)
+    var consoleLog = ConsoleLogRule()
+
+    @get:Rule(order = 1)
+    val hiltRule = HiltAndroidRule(this)
+
+    @get:Rule(order = 2)
+    val composeTestRule = createAndroidComposeRule<HiltComponentActivity>()
+
+    @Test
+    fun `Given ApprovingTag state then approval content with Allow once and Allow always buttons is displayed`() {
+        composeTestRule.apply {
+            setContent {
+                TagReaderScreen(
+                    state = TagReaderUiState.ApprovingTag("custom-tag-foo"),
+                    onAllowOnce = {},
+                    onAllowAlways = {},
+                    onDismissed = {},
+                    onErrorAcknowledged = {},
+                    onFinished = {},
+                )
+            }
+
+            onNodeWithText(stringResource(commonR.string.tag_approval_title)).assertExists()
+            onNodeWithText(
+                activity.getString(commonR.string.tag_approval_description, "custom-tag-foo"),
+            ).assertExists()
+            onNodeWithText(stringResource(commonR.string.tag_allow_once)).assertExists()
+            onNodeWithText(stringResource(commonR.string.tag_allow_always)).assertExists()
+            onNodeWithContentDescription(stringResource(commonR.string.cancel)).assertExists()
+        }
+    }
+
+    @Test
+    fun `Given ApprovingTag state when Allow once is clicked then onAllowOnce is invoked`() {
+        var allowOnceCalled = false
+        var allowAlwaysCalled = false
+
+        composeTestRule.apply {
+            setContent {
+                TagReaderScreen(
+                    state = TagReaderUiState.ApprovingTag("custom-tag-foo"),
+                    onAllowOnce = { allowOnceCalled = true },
+                    onAllowAlways = { allowAlwaysCalled = true },
+                    onDismissed = {},
+                    onErrorAcknowledged = {},
+                    onFinished = {},
+                )
+            }
+
+            onNodeWithText(stringResource(commonR.string.tag_allow_once)).performClick()
+
+            assertTrue("onAllowOnce should be invoked", allowOnceCalled)
+            assertFalse("onAllowAlways should not be invoked", allowAlwaysCalled)
+        }
+    }
+
+    @Test
+    fun `Given ApprovingTag state when Allow always is clicked then onAllowAlways is invoked`() {
+        var allowOnceCalled = false
+        var allowAlwaysCalled = false
+
+        composeTestRule.apply {
+            setContent {
+                TagReaderScreen(
+                    state = TagReaderUiState.ApprovingTag("custom-tag-foo"),
+                    onAllowOnce = { allowOnceCalled = true },
+                    onAllowAlways = { allowAlwaysCalled = true },
+                    onDismissed = {},
+                    onErrorAcknowledged = {},
+                    onFinished = {},
+                )
+            }
+
+            onNodeWithText(stringResource(commonR.string.tag_allow_always)).performClick()
+
+            assertTrue("onAllowAlways should be invoked", allowAlwaysCalled)
+            assertFalse("onAllowOnce should not be invoked", allowOnceCalled)
+        }
+    }
+
+    @Test
+    fun `Given ApprovingTag state when close button is clicked then onDismissed is invoked`() {
+        var dismissedCalled = false
+
+        composeTestRule.apply {
+            setContent {
+                TagReaderScreen(
+                    state = TagReaderUiState.ApprovingTag("custom-tag-foo"),
+                    onAllowOnce = {},
+                    onAllowAlways = {},
+                    onDismissed = { dismissedCalled = true },
+                    onErrorAcknowledged = {},
+                    onFinished = {},
+                )
+            }
+
+            onNodeWithContentDescription(stringResource(commonR.string.cancel)).performClick()
+
+            assertTrue("onDismissed should be invoked", dismissedCalled)
+        }
+    }
+
+    @Test
+    fun `Given Scanning state then loading content is displayed and approval buttons are not`() {
+        composeTestRule.apply {
+            setContent {
+                TagReaderScreen(
+                    state = TagReaderUiState.Scanning,
+                    onAllowOnce = {},
+                    onAllowAlways = {},
+                    onDismissed = {},
+                    onErrorAcknowledged = {},
+                    onFinished = {},
+                )
+            }
+
+            onNodeWithText(stringResource(commonR.string.tag_reader_title)).assertExists()
+            onNodeWithText(stringResource(commonR.string.tag_allow_once)).assertDoesNotExist()
+            onNodeWithText(stringResource(commonR.string.tag_allow_always)).assertDoesNotExist()
+        }
+    }
+
+    @Test
+    fun `Given Initial state then nothing from the sheet is displayed`() {
+        composeTestRule.apply {
+            setContent {
+                TagReaderScreen(
+                    state = TagReaderUiState.Initial,
+                    onAllowOnce = {},
+                    onAllowAlways = {},
+                    onDismissed = {},
+                    onErrorAcknowledged = {},
+                    onFinished = {},
+                )
+            }
+
+            onNodeWithText(stringResource(commonR.string.tag_approval_title)).assertDoesNotExist()
+            onNodeWithText(stringResource(commonR.string.tag_allow_once)).assertDoesNotExist()
+            onNodeWithText(stringResource(commonR.string.tag_allow_always)).assertDoesNotExist()
+            onNodeWithContentDescription(stringResource(commonR.string.cancel)).assertDoesNotExist()
+        }
+    }
+
+    @Test
+    fun `Given Done state with no prior sheet then onFinished is invoked immediately`() {
+        var finishedCalled = false
+
+        composeTestRule.apply {
+            setContent {
+                TagReaderScreen(
+                    state = TagReaderUiState.Done,
+                    onAllowOnce = {},
+                    onAllowAlways = {},
+                    onDismissed = {},
+                    onErrorAcknowledged = {},
+                    onFinished = { finishedCalled = true },
+                )
+            }
+
+            mainClock.advanceTimeUntil(timeoutMillis = 5_000) { finishedCalled }
+            assertTrue("onFinished should be invoked", finishedCalled)
+        }
+    }
+
+    @Test
+    fun `Given Error state then onErrorAcknowledged is invoked after the snackbar is shown`() {
+        var acknowledgedCalled = false
+
+        composeTestRule.apply {
+            setContent {
+                TagReaderScreen(
+                    state = TagReaderUiState.Error(commonR.string.nfc_processing_tag_error),
+                    onAllowOnce = {},
+                    onAllowAlways = {},
+                    onDismissed = {},
+                    onErrorAcknowledged = { acknowledgedCalled = true },
+                    onFinished = {},
+                )
+            }
+
+            // Advance the test clock past the snackbar's auto-dismiss timeout instead of
+            // wall-clock polling. The snackbar is shown by a LaunchedEffect that calls
+            // showSnackbar() which suspends until the snackbar is dismissed and then invokes
+            // onErrorAcknowledged.
+            mainClock.advanceTimeUntil(
+                4000L, // This is SnackbarDuration.Short.toMillis but it is not public
+            ) { acknowledgedCalled }
+
+            assertTrue("onErrorAcknowledged should be invoked once the snackbar is dismissed", acknowledgedCalled)
+        }
+    }
+}
diff --git a/automotive/src/debug/AndroidManifest.xml b/automotive/src/debug/AndroidManifest.xml
new file mode 100644
index 00000000000..96afa659496
--- /dev/null
+++ b/automotive/src/debug/AndroidManifest.xml
@@ -0,0 +1,21 @@
+<manifest xmlns:tools="http://schemas.android.com/tools"
+    xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <application tools:ignore="MissingApplicationIcon">
+        <activity
+            android:name=".nfc.TagReaderActivity"
+            android:exported="true">
+            <intent-filter android:autoVerify="true">
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+
+                <data
+                    android:scheme="https"
+                    android:host="next.home-assistant.io"
+                    android:pathPrefix="/tag/" />
+            </intent-filter>
+        </activity>
+    </application>
+
+</manifest>
diff --git a/automotive/src/main/AndroidManifest.xml b/automotive/src/main/AndroidManifest.xml
index cf8aaf6abf9..ae13e53c38d 100644
--- a/automotive/src/main/AndroidManifest.xml
+++ b/automotive/src/main/AndroidManifest.xml
@@ -371,7 +371,12 @@
         <activity
             android:name=".nfc.TagReaderActivity"
             android:label="@string/tag_reader_title"
-            android:exported="true">
+            android:launchMode="singleTask"
+            android:taskAffinity="io.homeassistant.companion.android.tag.reader"
+            android:autoRemoveFromRecents="true"
+            android:showWhenLocked="true"
+            android:exported="true"
+            android:theme="@style/Theme.HomeAssistant.TranslucentOverlay">
             <tools:validation testUrl="https://www.home-assistant.io/tag/123e4567-e89b-12d3-a456-426614174000" />
 
             <intent-filter>
@@ -449,7 +454,7 @@
             android:taskAffinity="io.homeassistant.companion.android.assist"
             android:autoRemoveFromRecents="true"
             android:showWhenLocked="true"
-            android:theme="@style/Theme.HomeAssistant.Assist">
+            android:theme="@style/Theme.HomeAssistant.TranslucentOverlay">
         </activity>
 
         <provider
diff --git a/common/src/main/kotlin/io/homeassistant/companion/android/common/compose/composable/HAModalBottomSheet.kt b/common/src/main/kotlin/io/homeassistant/companion/android/common/compose/composable/HAModalBottomSheet.kt
index bf86ec912c2..b23fcc68060 100644
--- a/common/src/main/kotlin/io/homeassistant/companion/android/common/compose/composable/HAModalBottomSheet.kt
+++ b/common/src/main/kotlin/io/homeassistant/companion/android/common/compose/composable/HAModalBottomSheet.kt
@@ -2,6 +2,7 @@ package io.homeassistant.companion.android.common.compose.composable
 
 import androidx.compose.foundation.layout.ColumnScope
 import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material3.BottomSheetDefaults
 import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.ModalBottomSheet
 import androidx.compose.material3.SheetState
@@ -42,6 +43,7 @@ fun HAModalBottomSheet(
     bottomSheetState: SheetState,
     modifier: Modifier = Modifier,
     onDismissRequest: () -> Unit = {},
+    dragHandle: @Composable (() -> Unit)? = { BottomSheetDefaults.DragHandle() },
     content: @Composable ColumnScope.() -> Unit,
 ) {
     ModalBottomSheet(
@@ -50,6 +52,7 @@ fun HAModalBottomSheet(
         scrimColor = LocalHAColorScheme.current.colorOverlayModal,
         onDismissRequest = onDismissRequest,
         shape = RoundedCornerShape(topStart = HARadius.X3L, topEnd = HARadius.X3L),
+        dragHandle = dragHandle,
         content = content,
     )
 }
diff --git a/common/src/main/kotlin/io/homeassistant/companion/android/common/compose/util/PainterResourceUtil.kt b/common/src/main/kotlin/io/homeassistant/companion/android/common/compose/util/PainterResourceUtil.kt
new file mode 100644
index 00000000000..ba4a0251a34
--- /dev/null
+++ b/common/src/main/kotlin/io/homeassistant/companion/android/common/compose/util/PainterResourceUtil.kt
@@ -0,0 +1,48 @@
+package io.homeassistant.companion.android.common.compose.util
+
+import android.graphics.drawable.AdaptiveIconDrawable
+import android.os.Build
+import androidx.annotation.DrawableRes
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.remember
+import androidx.compose.ui.graphics.asImageBitmap
+import androidx.compose.ui.graphics.painter.BitmapPainter
+import androidx.compose.ui.graphics.painter.Painter
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.platform.LocalResources
+import androidx.compose.ui.res.painterResource
+import androidx.core.content.res.ResourcesCompat
+import androidx.core.graphics.drawable.toBitmap
+
+/**
+ * Loads a drawable as a Compose [Painter], with fallback support for [AdaptiveIconDrawable].
+ *
+ * Compose's stock [painterResource] only handles [android.graphics.drawable.VectorDrawable] and
+ * rasterized assets (PNG / JPG / WebP); it throws on adaptive icons (`<adaptive-icon>` XML in
+ * `mipmap-anydpi-v26`), which is the format launcher icons use on API 26+. This helper detects
+ * that case and rasterises the adaptive icon to a [android.graphics.Bitmap] via [toBitmap], then
+ * wraps it in a [BitmapPainter]. For every other resource type and on pre-O devices where
+ * adaptive icons don't exist it delegates to [painterResource] unchanged.
+ *
+ * Typical use: rendering the app launcher icon (e.g. `R.mipmap.ic_launcher_round`) inside Compose.
+ *
+ * Note: callers that want a circular icon (matching launcher behaviour on API 26+) should clip
+ * the resulting [androidx.compose.foundation.Image] with `Modifier.clip(CircleShape)` this
+ * helper returns the unmasked bitmap.
+ *
+ * Got from https://gist.github.com/tkuenneth/ddf598663f041dc79960cda503d14448.
+ */
+@Composable
+fun adaptiveIconPainterResource(@DrawableRes id: Int): Painter {
+    val resources = LocalResources.current
+    val theme = LocalContext.current.theme
+
+    val adaptivePainter: Painter? = remember(id, resources, theme) {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return@remember null
+        val drawable = ResourcesCompat.getDrawable(resources, id, theme) as? AdaptiveIconDrawable
+            ?: return@remember null
+        BitmapPainter(drawable.toBitmap().asImageBitmap())
+    }
+
+    return adaptivePainter ?: painterResource(id)
+}
diff --git a/common/src/main/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepository.kt b/common/src/main/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepository.kt
index 5339d6aa964..ebad011da80 100644
--- a/common/src/main/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepository.kt
+++ b/common/src/main/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepository.kt
@@ -160,4 +160,10 @@ interface PrefsRepository {
     suspend fun getSelectedWakeWord(): String?
 
     suspend fun setSelectedWakeWord(wakeWord: String)
+
+    suspend fun addAllowedTag(tag: String)
+
+    suspend fun allowedTags(): Set<String>
+
+    suspend fun clearAllowedTags()
 }
diff --git a/common/src/main/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepositoryImpl.kt b/common/src/main/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepositoryImpl.kt
index 637b3482c6d..517dba76504 100644
--- a/common/src/main/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepositoryImpl.kt
+++ b/common/src/main/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepositoryImpl.kt
@@ -47,6 +47,7 @@ private const val PREF_CHANGE_LOG_POPUP_ENABLED = "change_log_popup_enabled"
 private const val PREF_SHOW_PRIVACY_HINT = "show_privacy_hint"
 private const val PREF_WAKE_WORD_ENABLED = "wake_word_enabled"
 private const val PREF_SELECTED_WAKE_WORD = "selected_wake_word"
+private const val PREF_ALLOWED_TAGS = "approved_tags"
 
 /**
  * This class ensure that when we use the local storage in [PrefsRepositoryImpl] the migrations has been made
@@ -402,4 +403,19 @@ internal class PrefsRepositoryImpl @Inject constructor(
     override suspend fun setSelectedWakeWord(wakeWord: String) {
         localStorage().putString(PREF_SELECTED_WAKE_WORD, wakeWord)
     }
+
+    override suspend fun addAllowedTag(tag: String) {
+        val approved = allowedTags().toMutableSet()
+        if (approved.add(tag)) {
+            localStorage().putStringSet(PREF_ALLOWED_TAGS, approved)
+        }
+    }
+
+    override suspend fun allowedTags(): Set<String> {
+        return localStorage().getStringSet(PREF_ALLOWED_TAGS) ?: emptySet()
+    }
+
+    override suspend fun clearAllowedTags() {
+        localStorage().remove(PREF_ALLOWED_TAGS)
+    }
 }
diff --git a/common/src/main/kotlin/io/homeassistant/companion/android/util/UrlUtil.kt b/common/src/main/kotlin/io/homeassistant/companion/android/util/UrlUtil.kt
index 6769c2b9b1a..e79cce328c4 100644
--- a/common/src/main/kotlin/io/homeassistant/companion/android/util/UrlUtil.kt
+++ b/common/src/main/kotlin/io/homeassistant/companion/android/util/UrlUtil.kt
@@ -1,6 +1,7 @@
 package io.homeassistant.companion.android.util
 
 import android.net.Uri
+import io.homeassistant.companion.android.common.BuildConfig
 import io.homeassistant.companion.android.common.data.MalformedHttpUrlException
 import io.homeassistant.companion.android.common.data.authentication.impl.AuthenticationService
 import java.net.InetAddress
@@ -121,11 +122,19 @@ object UrlUtil {
             userInfo == other.userInfo
     }
 
+    /**
+     * Matches `https://www.home-assistant.io/tag/<id>` URLs in production. Debug builds also
+     * accept `next.home-assistant.io` so the tag flow can be exercised against the next branch
+     * of the documentation site.
+     */
+    private val nfcTagUrlRegex: Regex = if (BuildConfig.DEBUG) {
+        Regex("^https?://(?:www|next)\\.home-assistant\\.io/tag/(.*)")
+    } else {
+        Regex("^https?://www\\.home-assistant\\.io/tag/(.*)")
+    }
+
     fun splitNfcTagId(it: Uri?): String? {
-        val matches =
-            Regex("^https?://www\\.home-assistant\\.io/tag/(.*)").find(
-                it.toString(),
-            )
+        val matches = nfcTagUrlRegex.find(it.toString())
         return matches?.groups?.get(1)?.value
     }
 }
diff --git a/common/src/main/res/values/strings.xml b/common/src/main/res/values/strings.xml
index 8f2e214a324..2d9a1da6bfc 100644
--- a/common/src/main/res/values/strings.xml
+++ b/common/src/main/res/values/strings.xml
@@ -151,6 +151,8 @@
     <string name="changelog">View full change log</string>
     <string name="choose_entity">Choose entity</string>
     <string name="clear_favorites">Clear favorites</string>
+    <string name="clear_allowed_tags">Clear approved tags</string>
+    <string name="clear_allowed_tags_complete">Tags cleared</string>
     <string name="clear_search">Clear search</string>
     <string name="clear_webview_cache">Reset frontend cache</string>
     <string name="clear_webview_cache_active">Resetting…</string>
@@ -490,6 +492,10 @@
     <string name="nfc_trigger_device">Scanned by this device:</string>
     <string name="nfc_invalid_tag">This tag does not contain Home Assistant data</string>
     <string name="nfc_processing_tag_error">Error while processing NFC tag</string>
+    <string name="tag_approval_title">Allow sending?</string>
+    <string name="tag_approval_description">Sending the tag %1$s to perform automations attach to it.</string>
+    <string name="tag_allow_once">Allow once</string>
+    <string name="tag_allow_always">Allow always</string>
     <string name="nfc_read_tag_instructions">Hold your device near an NFC tag</string>
     <string name="nfc_summary">Set up NFC tags</string>
     <string name="nfc_tag_identifier">Tag ID</string>
diff --git a/common/src/test/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepositoryImplTest.kt b/common/src/test/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepositoryImplTest.kt
index 94c2bbf5212..76f06df5eb4 100644
--- a/common/src/test/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepositoryImplTest.kt
+++ b/common/src/test/kotlin/io/homeassistant/companion/android/common/data/prefs/PrefsRepositoryImplTest.kt
@@ -210,4 +210,56 @@ class PrefsRepositoryImplTest {
             }
         }
     }
+
+    @Test
+    fun `Given no approved tags when listing then returns empty list`() = runTest {
+        coEvery { localStorage.getStringSet("approved_tags") } returns null
+
+        assertEquals(emptySet<String>(), repository.allowedTags())
+    }
+
+    @Test
+    fun `Given approved tags stored when listing then returns them`() = runTest {
+        coEvery { localStorage.getStringSet("approved_tags") } returns setOf("tag-a", "tag-b")
+
+        assertEquals(setOf("tag-a", "tag-b"), repository.allowedTags())
+    }
+
+    @Test
+    fun `Given new tag when approving then it is added to the stored set`() = runTest {
+        coEvery { localStorage.getStringSet("approved_tags") } returns setOf("tag-a")
+        coEvery { localStorage.putStringSet(any(), any()) } returns Unit
+
+        repository.addAllowedTag("tag-b")
+
+        coVerify(exactly = 1) { localStorage.putStringSet("approved_tags", setOf("tag-a", "tag-b")) }
+    }
+
+    @Test
+    fun `Given no approved tags when approving then writes a single-entry set`() = runTest {
+        coEvery { localStorage.getStringSet("approved_tags") } returns null
+        coEvery { localStorage.putStringSet(any(), any()) } returns Unit
+
+        repository.addAllowedTag("tag-a")
+
+        coVerify(exactly = 1) { localStorage.putStringSet("approved_tags", setOf("tag-a")) }
+    }
+
+    @Test
+    fun `Given tag already approved when approving again then storage is not written`() = runTest {
+        coEvery { localStorage.getStringSet("approved_tags") } returns setOf("tag-a")
+
+        repository.addAllowedTag("tag-a")
+
+        coVerify(exactly = 0) { localStorage.putStringSet(any(), any()) }
+    }
+
+    @Test
+    fun `Given approved tags when clearing then storage entry is removed`() = runTest {
+        coEvery { localStorage.remove(any()) } returns Unit
+
+        repository.clearAllowedTags()
+
+        coVerify(exactly = 1) { localStorage.remove("approved_tags") }
+    }
 }