diff --git a/xwords4/android/app/src/main/AndroidManifest.xml b/xwords4/android/app/src/main/AndroidManifest.xml
index 6fa3ddb0f..27df1905e 100644
--- a/xwords4/android/app/src/main/AndroidManifest.xml
+++ b/xwords4/android/app/src/main/AndroidManifest.xml
@@ -43,6 +43,16 @@
                android:theme="@style/AppTheme"
                >
 
+    <provider android:name="android.support.v4.content.FileProvider"
+              android:authorities="${applicationId}.provider"
+              android:exported="false"
+              android:grantUriPermissions="true"
+              >
+      <meta-data android:name="android.support.FILE_PROVIDER_PATHS"
+                 android:resource="@xml/provider_paths"
+                 />
+    </provider>
+
     <activity android:name="MainActivity"
               android:label="@string/app_name"
               android:launchMode="standard"
diff --git a/xwords4/android/app/src/main/java/org/eehouse/android/xw4/DwnldDelegate.java b/xwords4/android/app/src/main/java/org/eehouse/android/xw4/DwnldDelegate.java
index f7f6c1577..858787047 100644
--- a/xwords4/android/app/src/main/java/org/eehouse/android/xw4/DwnldDelegate.java
+++ b/xwords4/android/app/src/main/java/org/eehouse/android/xw4/DwnldDelegate.java
@@ -172,7 +172,7 @@ public class DwnldDelegate extends ListDelegateBase {
                 callListener( m_uri, true );
             } else if ( null != m_appFile ) {
                 // launch the installer
-                Intent intent = Utils.makeInstallIntent( m_appFile );
+                Intent intent = Utils.makeInstallIntent( m_activity, m_appFile );
                 startActivity( intent );
             } else {
                 // we failed at something....
@@ -473,5 +473,4 @@ public class DwnldDelegate extends ListDelegateBase {
         intent.putExtra( APK_EXTRA, url );
         return intent;
     }
-
 }
diff --git a/xwords4/android/app/src/main/java/org/eehouse/android/xw4/GamesListDelegate.java b/xwords4/android/app/src/main/java/org/eehouse/android/xw4/GamesListDelegate.java
index 9296d70d6..7838c07e3 100644
--- a/xwords4/android/app/src/main/java/org/eehouse/android/xw4/GamesListDelegate.java
+++ b/xwords4/android/app/src/main/java/org/eehouse/android/xw4/GamesListDelegate.java
@@ -1451,8 +1451,6 @@ public class GamesListDelegate extends ListDelegateBase
             showItemsIf( ONEGAME_ITEMS, menu, 1 == nGamesSelected );
             showItemsIf( ONEGROUP_ITEMS, menu, 1 == nGroupsSelected );
 
-            // check for updates only serves release builds, so don't offer in
-            // DEBUG case
             boolean enable = showDbg && nothingSelected
                 && UpdateCheckReceiver.haveToCheck( m_activity );
             Utils.setItemVisible( menu, R.id.games_menu_checkupdates, enable );
diff --git a/xwords4/android/app/src/main/java/org/eehouse/android/xw4/UpdateCheckReceiver.java b/xwords4/android/app/src/main/java/org/eehouse/android/xw4/UpdateCheckReceiver.java
index 0a599d6e9..300a96ddf 100644
--- a/xwords4/android/app/src/main/java/org/eehouse/android/xw4/UpdateCheckReceiver.java
+++ b/xwords4/android/app/src/main/java/org/eehouse/android/xw4/UpdateCheckReceiver.java
@@ -256,7 +256,8 @@ public class UpdateCheckReceiver extends BroadcastReceiver {
             m_dals = dals;
         }
 
-        @Override protected String doInBackground( Void... unused )
+        @Override
+        protected String doInBackground( Void... unused )
         {
             HttpURLConnection conn
                 = NetUtils.makeHttpUpdateConn( m_context, "getUpdates" );
@@ -267,7 +268,8 @@ public class UpdateCheckReceiver extends BroadcastReceiver {
             return json;
         }
 
-        @Override protected void onPostExecute( String json )
+        @Override
+        protected void onPostExecute( String json )
         {
             if ( null != json ) {
                 makeNotificationsIf( json, m_params );
diff --git a/xwords4/android/app/src/main/java/org/eehouse/android/xw4/Utils.java b/xwords4/android/app/src/main/java/org/eehouse/android/xw4/Utils.java
index 4c073a829..c5a02bf0e 100644
--- a/xwords4/android/app/src/main/java/org/eehouse/android/xw4/Utils.java
+++ b/xwords4/android/app/src/main/java/org/eehouse/android/xw4/Utils.java
@@ -34,17 +34,16 @@ import android.content.pm.PackageManager;
 import android.content.pm.ResolveInfo;
 import android.content.res.AssetManager;
 import android.content.res.Configuration;
-import android.text.ClipboardManager;
-
 import android.database.Cursor;
 import android.media.Ringtone;
 import android.media.RingtoneManager;
 import android.net.Uri;
 import android.provider.ContactsContract.PhoneLookup;
 import android.support.v4.app.NotificationCompat;
+import android.support.v4.content.FileProvider;
 import android.telephony.PhoneNumberUtils;
 import android.telephony.TelephonyManager;
-
+import android.text.ClipboardManager;
 import android.util.Base64;
 import android.view.Menu;
 import android.view.MenuItem;
@@ -486,13 +485,16 @@ public class Utils {
         return null == s_appVersion? 0 : s_appVersion;
     }
 
-    public static Intent makeInstallIntent( File file )
+    public static Intent makeInstallIntent( Context context, File file )
     {
-        String withScheme = "file://" + file.getPath();
-        Uri uri = Uri.parse( withScheme );
+        Uri uri = FileProvider
+            .getUriForFile( context,
+                            BuildConfig.APPLICATION_ID + ".provider",
+                            file );
         Intent intent = new Intent( Intent.ACTION_VIEW );
         intent.setDataAndType( uri, XWConstants.APK_TYPE );
-        intent.addFlags( Intent.FLAG_ACTIVITY_NEW_TASK );
+        intent.addFlags( Intent.FLAG_ACTIVITY_NEW_TASK
+                         | Intent.FLAG_GRANT_READ_URI_PERMISSION );
         return intent;
     }
 
@@ -501,7 +503,7 @@ public class Utils {
     {
         boolean result = false;
         PackageManager pm = context.getPackageManager();
-        Intent intent = makeInstallIntent( path );
+        Intent intent = makeInstallIntent( context, path );
         List<ResolveInfo> doers =
             pm.queryIntentActivities( intent,
                                       PackageManager.MATCH_DEFAULT_ONLY );