diff --git a/Makefile b/Makefile
index 94c841d3..3ff4080c 100644
--- a/Makefile
+++ b/Makefile
@@ -79,7 +79,11 @@ dev: ## Start backend + desktop app (parallel)
 	@echo -e "$(YELLOW)Note: If Tauri fails, run 'make build-server' first or use separate terminals$(NC)"
 	@trap 'kill 0' EXIT; \
 		$(MAKE) dev-backend & \
-		sleep 2 && WEBKIT_DISABLE_DMABUF_RENDERER=1 $(MAKE) dev-frontend & \
+		sleep 2 && if [ "$$(uname)" = "Linux" ] && lspci 2>/dev/null | grep -qi nvidia; then \
+			WEBKIT_DISABLE_DMABUF_RENDERER=1 $(MAKE) dev-frontend; \
+		else \
+			$(MAKE) dev-frontend; \
+		fi & \
 		wait
 
 dev-backend: ## Start FastAPI backend server
diff --git a/tauri/src-tauri/src/main.rs b/tauri/src-tauri/src/main.rs
index 19bf70aa..83629070 100644
--- a/tauri/src-tauri/src/main.rs
+++ b/tauri/src-tauri/src/main.rs
@@ -651,9 +651,19 @@ pub fn run() {
                         }
 
                         // Auto-grant UserMediaPermissionRequest (microphone access)
-                        wk_webview.connect_permission_request(move |_, request: &webkit2gtk::PermissionRequest| {
+                        // Only for trusted local origins (Tauri dev server or custom protocol)
+                        wk_webview.connect_permission_request(move |webview, request: &webkit2gtk::PermissionRequest| {
                             if request.is::<webkit2gtk::UserMediaPermissionRequest>() {
-                                request.allow();
+                                let uri = WebViewExt::uri(webview).unwrap_or_default();
+                                let is_trusted = uri.starts_with("tauri://")
+                                    || uri.starts_with("https://tauri.localhost")
+                                    || uri.starts_with("http://localhost")
+                                    || uri.starts_with("http://127.0.0.1");
+                                if is_trusted {
+                                    request.allow();
+                                    return true;
+                                }
+                                request.deny();
                                 return true;
                             }
                             false