diff --git a/PgpConnect.jar b/PgpConnect.jar
index a82fcfe..9325c05 100644
Binary files a/PgpConnect.jar and b/PgpConnect.jar differ
diff --git a/PgpConnect.java b/PgpConnect.java
index 65b3bf0..f93fb98 100644
--- a/PgpConnect.java
+++ b/PgpConnect.java
@@ -42,12 +42,15 @@ public class PgpConnect extends Fragment {
 	IOpenPgpService2 mService;
 	final int PERMISSIONS_REQUEST = 1;
 
-	// Keychain >= 11 (and the standalone "Keychain" 5.x/6.x releases) expose
-	// the OpenPGP API service under org.openintents.openpgp.IOpenPgpService;
-	// older releases used org.openintents.openpgp.api.OpenPgpService (the
-	// action hardcoded in OpenPgpServiceConnection). Try the new action
-	// first and fall back to the legacy one.
+	// The OpenPgpApi in openpgp-api.jar calls through the IOpenPgpService2
+	// AIDL interface, so we must bind the service that implements that
+	// descriptor: org.openintents.openpgp.IOpenPgpService2 (Keychain >= 11 /
+	// standalone 5.x-6.x). The v1 action (IOpenPgpService) does not implement
+	// the v2 descriptor and dies with a SecurityException; the very old
+	// org.openintents.openpgp.api.OpenPgpService action (used by
+	// OpenPgpServiceConnection) no longer exists. Try in that order.
 	static final String[] SERVICE_ACTIONS = {
+		"org.openintents.openpgp.IOpenPgpService2",
 		"org.openintents.openpgp.IOpenPgpService",
 		"org.openintents.openpgp.api.OpenPgpService",
 	};
diff --git a/scripts/build.sh b/scripts/build.sh
index 4684210..9a341b1 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -74,8 +74,21 @@ if perm not in t:
     t = t.replace("    <application", "    " + perm + "\n    <application", 1)
     if perm not in t:
         sys.exit("ERROR: failed to inject MANAGE_EXTERNAL_STORAGE")
+# Android 11+ package visibility: without <queries> the app cannot even
+# resolve (let alone bind) Keychain's OpenPGP service.
+queries = """    <queries>
+        <package android:name="org.sufficientlysecure.keychain"/>
+        <intent>
+            <action android:name="org.openintents.openpgp.IOpenPgpService2"/>
+        </intent>
+    </queries>
+"""
+if "<queries>" not in t:
+    t = t.replace("    <application", queries + "    <application", 1)
+    if "<queries>" not in t:
+        sys.exit("ERROR: failed to inject <queries>")
 p.write_text(t)
-print("manifest: MANAGE_EXTERNAL_STORAGE present")
+print("manifest: MANAGE_EXTERNAL_STORAGE + <queries> present")
 PYEOF
 
 echo "=== apktool rebuild ==="