diff --git a/Telegram/CMakeLists.txt b/Telegram/CMakeLists.txt
index 070e0f74b8..5033315c11 100644
--- a/Telegram/CMakeLists.txt
+++ b/Telegram/CMakeLists.txt
@@ -2130,6 +2130,7 @@ else()
 
     include(${cmake_helpers_loc}/external/glib/generate_dbus.cmake)
     generate_dbus(Telegram org.freedesktop.portal. XdpBackground ${third_party_loc}/xdg-desktop-portal/data/org.freedesktop.portal.Background.xml)
+    generate_dbus(Telegram org.freedesktop.portal. FlatpakPortal ${src_loc}/platform/linux/org.freedesktop.portal.Flatpak.xml)
     generate_dbus(Telegram org.freedesktop. XdgNotifications ${src_loc}/platform/linux/org.freedesktop.Notifications.xml)
 
     if (NOT DESKTOP_APP_DISABLE_X11_INTEGRATION)
diff --git a/Telegram/SourceFiles/core/update_checker.cpp b/Telegram/SourceFiles/core/update_checker.cpp
index 276fe1b73c..fa81899673 100644
--- a/Telegram/SourceFiles/core/update_checker.cpp
+++ b/Telegram/SourceFiles/core/update_checker.cpp
@@ -31,9 +31,16 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
 
 #include <QtCore/QJsonDocument>
 #include <QtCore/QJsonObject>
+#include <QtCore/QFileSystemWatcher>
 
 #include <ksandbox.h>
 
+#if !defined Q_OS_WIN && !defined Q_OS_MAC
+#include "base/platform/linux/base_linux_xdp_utilities.h"
+
+#include <flatpakportal/flatpakportal.hpp>
+#endif // !Q_OS_WIN && !Q_OS_MAC
+
 extern "C" {
 #include <openssl/rsa.h>
 #include <openssl/pem.h>
@@ -59,6 +66,12 @@ namespace {
 constexpr auto kUpdaterTimeout = 10 * crl::time(1000);
 constexpr auto kMaxResponseSize = 1024 * 1024;
 
+#if !defined Q_OS_WIN && !defined Q_OS_MAC
+constexpr auto kFlatpakPortalService = "org.freedesktop.portal.Flatpak";
+constexpr auto kFlatpakPortalObjectPath = "/org/freedesktop/portal/Flatpak";
+constexpr auto kFlatpakUpdated = "/app/.updated"_cs;
+#endif // !Q_OS_WIN && !Q_OS_MAC
+
 #ifdef TDESKTOP_DISABLE_AUTOUPDATE
 bool UpdaterIsDisabled = true;
 #else // TDESKTOP_DISABLE_AUTOUPDATE
@@ -80,6 +93,11 @@ using VersionChar = wchar_t;
 
 using Loader = MTP::AbstractDedicatedLoader;
 
+#if !defined Q_OS_WIN && !defined Q_OS_MAC
+using namespace gi::repository;
+namespace GObject = gi::repository::GObject;
+#endif // !Q_OS_WIN && !Q_OS_MAC
+
 struct BIODeleter {
 	void operator()(BIO *value) {
 		BIO_free(value);
@@ -98,6 +116,8 @@ public:
 
 	virtual void start() = 0;
 
+	virtual bool poll() const;
+
 	rpl::producer<std::shared_ptr<Loader>> ready() const;
 	rpl::producer<> failed() const;
 
@@ -217,6 +237,40 @@ private:
 
 };
 
+#if !defined Q_OS_WIN && !defined Q_OS_MAC
+class FlatpakChecker : public Checker {
+public:
+	FlatpakChecker(bool testing);
+
+	void start() override;
+
+	bool poll() const override;
+
+	~FlatpakChecker();
+
+private:
+	FlatpakPortal::Flatpak _interface;
+	FlatpakPortal::FlatpakUpdateMonitor _monitor;
+	QFileSystemWatcher _watcher;
+	ulong _updateAvailableSignal = 0;
+
+};
+
+class FlatpakLoader : public Loader {
+public:
+	FlatpakLoader(FlatpakPortal::FlatpakUpdateMonitor monitor);
+
+	~FlatpakLoader();
+
+private:
+	void startLoading() override;
+
+	FlatpakPortal::FlatpakUpdateMonitor _monitor;
+	ulong _progressSignal = 0;
+
+};
+#endif // !Q_OS_WIN && !Q_OS_MAC
+
 std::shared_ptr<Updater> GetUpdaterInstance() {
 	if (const auto result = UpdaterInstance.lock()) {
 		return result;
@@ -271,6 +325,10 @@ QString ExtractFilename(const QString &url) {
 
 bool UnpackUpdate(const QString &filepath) {
 #ifndef TDESKTOP_DISABLE_AUTOUPDATE
+	if (filepath.isEmpty()) {
+		return true;
+	}
+
 	QFile input(filepath);
 	if (!input.open(QIODevice::ReadOnly)) {
 		LOG(("Update Error: cant read updates file!"));
@@ -633,6 +691,10 @@ rpl::producer<> Checker::failed() const {
 	return _failed.events();
 }
 
+bool Checker::poll() const {
+	return true;
+}
+
 bool Checker::testing() const {
 	return _testing;
 }
@@ -1050,6 +1112,161 @@ Fn<void(const MTP::Error &error)> MtpChecker::failHandler() {
 	};
 }
 
+#if !defined Q_OS_WIN && !defined Q_OS_MAC
+FlatpakChecker::FlatpakChecker(bool testing)
+: Checker(testing)
+, _watcher({u"/app"_q}) {
+	FlatpakPortal::FlatpakProxy::new_for_bus(
+			Gio::BusType::SESSION_,
+			Gio::DBusProxyFlags::NONE_,
+			kFlatpakPortalService,
+			kFlatpakPortalObjectPath,
+			crl::guard(this, [=](GObject::Object, Gio::AsyncResult res) {
+		auto result = FlatpakPortal::FlatpakProxy::new_for_bus_finish(res);
+		if (!result) {
+			Gio::DBusErrorNS_::strip_remote_error(result.error());
+			LOG(("Update Error: %1").arg(result.error().message_().c_str()));
+			return;
+		}
+
+		_interface = *result;
+		_interface.call_create_update_monitor(
+				GLib::Variant::new_array(
+					GLib::VariantType::new_("{sv}"),
+					{}),
+				[=](GObject::Object, Gio::AsyncResult res) {
+			const auto result = _interface.call_create_update_monitor_finish(
+				res);
+
+			if (!result) {
+				Gio::DBusErrorNS_::strip_remote_error(result.error());
+				LOG(("Update Error: %1").arg(
+					result.error().message_().c_str()));
+				fail();
+				return;
+			}
+
+			FlatpakPortal::FlatpakUpdateMonitorProxy::new_for_bus(
+					Gio::BusType::SESSION_,
+					Gio::DBusProxyFlags::NONE_,
+					kFlatpakPortalService,
+					std::get<1>(*result),
+					crl::guard(this, [=](GObject::Object, Gio::AsyncResult res) {
+				using FlatpakPortal::FlatpakUpdateMonitorProxy;
+				auto result = FlatpakUpdateMonitorProxy::new_for_bus_finish(
+					res);
+
+				if (!result) {
+					Gio::DBusErrorNS_::strip_remote_error(result.error());
+					LOG(("Update Error: %1").arg(
+						result.error().message_().c_str()));
+					fail();
+					return;
+				}
+
+				_monitor = *result;
+				_updateAvailableSignal
+					= _monitor.signal_update_available().connect([=](
+							FlatpakPortal::FlatpakUpdateMonitor,
+							GLib::Variant updateInfo) {
+						done(std::make_shared<FlatpakLoader>(_monitor));
+					});
+			}));
+		});
+	}));
+
+	QObject::connect(
+		&_watcher,
+		&QFileSystemWatcher::directoryChanged,
+		[=](const QString &path) {
+			start();
+		});
+}
+
+void FlatpakChecker::start() {
+	if (QFileInfo::exists(kFlatpakUpdated.utf16())) {
+		done(std::make_shared<FlatpakLoader>(_monitor));
+	}
+}
+
+bool FlatpakChecker::poll() const {
+	return false;
+}
+
+FlatpakChecker::~FlatpakChecker() {
+	if (_monitor) {
+		_monitor.disconnect(_updateAvailableSignal);
+		_monitor.call_close(nullptr);
+	}
+}
+
+FlatpakLoader::FlatpakLoader(FlatpakPortal::FlatpakUpdateMonitor monitor)
+: Loader({}, kChunkSize)
+, _monitor(monitor) {
+	if (!_monitor) {
+		return;
+	}
+
+	_progressSignal = _monitor.signal_progress().connect([=](
+			FlatpakPortal::FlatpakUpdateMonitor,
+			GLib::Variant info) {
+		auto dict = GLib::VariantDict::new_(info);
+		switch (dict.lookup_value("status").get_uint32()) {
+		case 0: {
+			const auto n_ops = dict.lookup_value("n_ops").get_uint32();
+			const auto op = dict.lookup_value("op").get_uint32();
+			const auto progress = dict.lookup_value("progress").get_uint32();
+			threadSafeProgress({
+				int64(
+					std::round((op + (progress / 100.)) / n_ops * 104857600)),
+				104857600,
+				true,
+			});
+		} break;
+		case 1:
+		case 2: threadSafeReady(); break;
+		case 3: {
+			LOG(("Update Error: %1").arg(
+				dict.lookup_value("error_message").get_string(
+					nullptr).c_str()));
+			threadSafeFailed();
+		} break;
+		}
+	});
+}
+
+void FlatpakLoader::startLoading() {
+	if (QFileInfo::exists(kFlatpakUpdated.utf16())) {
+		threadSafeReady();
+	}
+
+	if (!_monitor) {
+		return;
+	}
+
+	_monitor.call_update(
+		base::Platform::XDP::ParentWindowID(),
+		GLib::Variant::new_array(
+			GLib::VariantType::new_("{sv}"),
+			{}),
+		crl::guard(this, [=](GObject::Object, Gio::AsyncResult res) {
+			const auto result = _monitor.call_close_finish(res);
+			if (!result) {
+				Gio::DBusErrorNS_::strip_remote_error(result.error());
+				LOG(("Update Error: %1").arg(
+					result.error().message_().c_str()));
+				threadSafeFailed();
+			}
+		}));
+}
+
+FlatpakLoader::~FlatpakLoader() {
+	if (_monitor) {
+		_monitor.disconnect(_progressSignal);
+	}
+}
+#endif // !Q_OS_WIN && !Q_OS_MAC
+
 } // namespace
 
 bool UpdaterDisabled() {
@@ -1079,6 +1296,7 @@ public:
 	State state() const;
 	int already() const;
 	int size() const;
+	bool percent() const;
 
 	void setMtproto(base::weak_ptr<Main::Session> session);
 
@@ -1123,6 +1341,7 @@ private:
 	rpl::event_stream<> _ready;
 	Implementation _httpImplementation;
 	Implementation _mtpImplementation;
+	Implementation _flatpakImplementation;
 	std::shared_ptr<Loader> _activeLoader;
 	bool _usingMtprotoLoader = (cAlphaVersion() != 0);
 	base::weak_ptr<Main::Session> _session;
@@ -1231,9 +1450,16 @@ int Updater::already() const {
 	return _activeLoader ? _activeLoader->alreadySize() : 0;
 }
 
+bool Updater::percent() const {
+	return _activeLoader ? _activeLoader->preferPercent() : 0;
+}
+
 void Updater::stop() {
 	_httpImplementation = Implementation();
 	_mtpImplementation = Implementation();
+	_flatpakImplementation = Implementation{
+		std::move(_flatpakImplementation.checker)
+	};
 	_activeLoader = nullptr;
 	_action = Action::Waiting;
 }
@@ -1267,7 +1493,15 @@ void Updater::start(bool forceWait) {
 		return;
 	}
 
-	if (sendRequest) {
+	if (KSandbox::isFlatpak()) {
+#if !defined Q_OS_WIN && !defined Q_OS_MAC
+		if (!_flatpakImplementation.checker) {
+			startImplementation(
+				&_flatpakImplementation,
+				std::make_unique<FlatpakChecker>(_testing));
+		}
+#endif // !Q_OS_WIN && !Q_OS_MAC
+	} else if (sendRequest) {
 		startImplementation(
 			&_httpImplementation,
 			std::make_unique<HttpChecker>(_testing));
@@ -1317,7 +1551,7 @@ void Updater::startImplementation(
 void Updater::checkerDone(
 		not_null<Implementation*> which,
 		std::shared_ptr<Loader> loader) {
-	which->checker = nullptr;
+	if (which->checker->poll()) which->checker = nullptr;
 	which->loader = std::move(loader);
 
 	tryLoaders();
@@ -1388,7 +1622,14 @@ bool Updater::tryLoaders() {
 			_isLatest.fire({});
 		}
 	};
-	if (_mtpImplementation.failed && _httpImplementation.failed) {
+	if (KSandbox::isFlatpak()) {
+		if (_flatpakImplementation.failed) {
+			_failed.fire({});
+			return false;
+		} else {
+			tryOne(_flatpakImplementation);
+		}
+	} else if (_mtpImplementation.failed && _httpImplementation.failed) {
 		_failed.fire({});
 		return false;
 	} else if (!_mtpImplementation.loader) {
@@ -1491,6 +1732,10 @@ int UpdateChecker::size() const {
 	return _updater->size();
 }
 
+bool UpdateChecker::percent() const {
+	return _updater->percent();
+}
+
 //QString winapiErrorWrap() {
 //	WCHAR errMsg[2048];
 //	DWORD errorCode = GetLastError();
diff --git a/Telegram/SourceFiles/core/update_checker.h b/Telegram/SourceFiles/core/update_checker.h
index 4e32c30002..458ffc75a9 100644
--- a/Telegram/SourceFiles/core/update_checker.h
+++ b/Telegram/SourceFiles/core/update_checker.h
@@ -46,6 +46,7 @@ public:
 	State state() const;
 	int already() const;
 	int size() const;
+	bool percent() const;
 
 private:
 	const std::shared_ptr<Updater> _updater;
diff --git a/Telegram/SourceFiles/mtproto/dedicated_file_loader.cpp b/Telegram/SourceFiles/mtproto/dedicated_file_loader.cpp
index 057b055e94..1a63c5507e 100644
--- a/Telegram/SourceFiles/mtproto/dedicated_file_loader.cpp
+++ b/Telegram/SourceFiles/mtproto/dedicated_file_loader.cpp
@@ -155,14 +155,22 @@ AbstractDedicatedLoader::AbstractDedicatedLoader(
 	int chunkSize)
 : _filepath(filepath)
 , _chunkSize(chunkSize) {
+	progress() | rpl::on_next([=](Progress progress) {
+		QMutexLocker lock(&_sizesMutex);
+		_alreadySize = progress.already;
+		_totalSize = progress.size;
+		_preferPercent = progress.percent;
+	}, lifetime());
 }
 
 void AbstractDedicatedLoader::start() {
-	if (!validateOutput()
-		|| (!_output.isOpen() && !_output.open(QIODevice::Append))) {
-		QFile(_filepath).remove();
-		threadSafeFailed();
-		return;
+	if (!_filepath.isEmpty()) {
+		if (!validateOutput()
+			|| (!_output.isOpen() && !_output.open(QIODevice::Append))) {
+			QFile(_filepath).remove();
+			threadSafeFailed();
+			return;
+		}
 	}
 
 	LOG(("Update Info: Starting loading '%1' from %2 offset."
@@ -181,6 +189,10 @@ int64 AbstractDedicatedLoader::totalSize() const {
 	return _totalSize;
 }
 
+bool AbstractDedicatedLoader::preferPercent() const {
+	return _preferPercent;
+}
+
 rpl::producer<QString> AbstractDedicatedLoader::ready() const {
 	return _ready.events();
 }
@@ -194,6 +206,9 @@ rpl::producer<> AbstractDedicatedLoader::failed() const {
 }
 
 void AbstractDedicatedLoader::wipeFolder() {
+	if (_filepath.isEmpty()) {
+		return;
+	}
 	QFileInfo info(_filepath);
 	const auto dir = info.dir();
 	const auto all = dir.entryInfoList(QDir::Files);
diff --git a/Telegram/SourceFiles/mtproto/dedicated_file_loader.h b/Telegram/SourceFiles/mtproto/dedicated_file_loader.h
index 4a4e7eb24a..652feb250f 100644
--- a/Telegram/SourceFiles/mtproto/dedicated_file_loader.h
+++ b/Telegram/SourceFiles/mtproto/dedicated_file_loader.h
@@ -54,6 +54,7 @@ public:
 	struct Progress {
 		int64 already = 0;
 		int64 size = 0;
+		bool percent = false;
 
 		inline bool operator<(const Progress &other) const {
 			return (already < other.already)
@@ -70,6 +71,7 @@ public:
 
 	int64 alreadySize() const;
 	int64 totalSize() const;
+	bool preferPercent() const;
 
 	rpl::producer<Progress> progress() const;
 	rpl::producer<QString> ready() const;
@@ -81,6 +83,8 @@ public:
 
 protected:
 	void threadSafeFailed();
+	void threadSafeProgress(Progress progress);
+	void threadSafeReady();
 
 	// Single threaded.
 	void writeChunk(bytes::const_span data, int totalSize);
@@ -89,8 +93,6 @@ private:
 	virtual void startLoading() = 0;
 
 	bool validateOutput();
-	void threadSafeProgress(Progress progress);
-	void threadSafeReady();
 
 	QString _filepath;
 	int _chunkSize = 0;
@@ -98,6 +100,7 @@ private:
 	QFile _output;
 	int64 _alreadySize = 0;
 	int64 _totalSize = 0;
+	bool _preferPercent = false;
 	mutable QMutex _sizesMutex;
 	rpl::event_stream<Progress> _progress;
 	rpl::event_stream<QString> _ready;
diff --git a/Telegram/SourceFiles/platform/linux/launcher_linux.cpp b/Telegram/SourceFiles/platform/linux/launcher_linux.cpp
index 869b79e76f..d31f2838e5 100644
--- a/Telegram/SourceFiles/platform/linux/launcher_linux.cpp
+++ b/Telegram/SourceFiles/platform/linux/launcher_linux.cpp
@@ -12,6 +12,7 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
 #include "webview/platform/linux/webview_linux_webkitgtk.h"
 
 #include <QtWidgets/QApplication>
+#include <ksandbox.h>
 #include <glib/glib.hpp>
 
 #ifdef __GLIBC__
@@ -45,24 +46,23 @@ bool Launcher::launchUpdater(UpdaterLaunch action) {
 		return false;
 	}
 
-	const auto justRelaunch = action == UpdaterLaunch::JustRelaunch;
+	const auto justRelaunch = action == UpdaterLaunch::JustRelaunch
+		|| KSandbox::isInside();
+
 	if (action == UpdaterLaunch::PerformUpdate) {
 		_updating = true;
 	}
 
 	std::vector<std::string> argumentsList;
 
-	// What we are launching.
-	const auto launching = justRelaunch
-		? (cExeDir() + cExeName())
-		: cWriteProtected()
-		? GLib::find_program_in_path("run0")
-		? u"run0"_q
-		: u"pkexec"_q
-		: (cExeDir() + u"Updater"_q);
-	argumentsList.push_back(launching.toStdString());
-
-	if (justRelaunch) {
+	if (KSandbox::isFlatpak() && _updating) {
+		argumentsList.push_back("flatpak-spawn");
+		argumentsList.push_back("--latest-version");
+		argumentsList.push_back((cExeDir() + cExeName()).toStdString());
+	} else if (justRelaunch) {
+		// What we are launching.
+		const auto launching = (cExeDir() + cExeName());
+		argumentsList.push_back(launching.toStdString());
 		// argv[0] that is passed to what we are launching.
 		// It should be added explicitly in case of FILE_AND_ARGV_ZERO_.
 		const auto argv0 = !arguments().isEmpty()
@@ -70,9 +70,13 @@ bool Launcher::launchUpdater(UpdaterLaunch action) {
 			: launching;
 		argumentsList.push_back(argv0.toStdString());
 	} else if (cWriteProtected()) {
-		// Elevated process that run0/pkexec should launch.
-		const auto elevated = cWorkingDir() + u"tupdates/temp/Updater"_q;
-		argumentsList.push_back(elevated.toStdString());
+		argumentsList.push_back(GLib::find_program_in_path("run0")
+			? "run0"
+			: "pkexec");
+		argumentsList.push_back(
+			cWorkingDir().toStdString() + "tupdates/temp/Updater");
+	} else {
+		argumentsList.push_back(cExeDir().toStdString() + "Updater");
 	}
 
 	if (Logs::DebugEnabled()) {
@@ -122,7 +126,9 @@ bool Launcher::launchUpdater(UpdaterLaunch action) {
 			initialWorkingDir().toStdString(),
 			argumentsList,
 			{},
-			GLib::SpawnFlags::FILE_AND_ARGV_ZERO_,
+			KSandbox::isFlatpak() && _updating
+				? GLib::SpawnFlags::SEARCH_PATH_
+				: GLib::SpawnFlags::FILE_AND_ARGV_ZERO_,
 			nullptr,
 			nullptr,
 			nullptr);
diff --git a/Telegram/SourceFiles/platform/linux/org.freedesktop.portal.Flatpak.xml b/Telegram/SourceFiles/platform/linux/org.freedesktop.portal.Flatpak.xml
new file mode 100644
index 0000000000..4f2139355a
--- /dev/null
+++ b/Telegram/SourceFiles/platform/linux/org.freedesktop.portal.Flatpak.xml
@@ -0,0 +1,583 @@
+<!DOCTYPE node PUBLIC
+"-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
+"http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
+
+<!--
+ Copyright (C) 2018 Red Hat, Inc.
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General
+ Public License along with this library; if not, write to the
+ Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+
+ Author: Alexander Larsson <alexl@redhat.com>
+-->
+
+<node name="/" xmlns:doc="http://www.freedesktop.org/dbus/1.0/doc.dtd">
+  <!--
+      org.freedesktop.portal.Flatpak:
+      @short_description: Flatpak portal
+
+      The flatpak portal exposes some interactions with flatpak on the
+      host to the sandbox. For example, it allows you to restart the
+      applications or start a more sandboxed instance.
+
+      This portal is available on the D-Bus session bus under the
+      bus name org.freedesktop.portal.Flatpak and the object path
+      /org/freedesktop/portal/Flatpak.
+
+      This documentation describes version 8 of this interface.
+  -->
+  <interface name='org.freedesktop.portal.Flatpak'>
+    <property name="version" type="u" access="read"/>
+    <!--
+        supports:
+
+        Flags marking what optional features are available.
+         The following flags values are supported:
+         <variablelist>
+           <varlistentry>
+             <term>1 (FLATPAK_SPAWN_SUPPORT_FLAGS_EXPOSE_PIDS)</term>
+             <listitem><para>
+              Supports the expose sandbox pids flag of Spawn.
+              If the version of this interface is 5 or later, this also
+              indicates that the share sandbox pids flag is available.
+             </para></listitem>
+           </varlistentry>
+         </variablelist>
+
+         This was added in version 3 of this interface (available from flatpak 1.6.0 and later).
+        -->
+    <property name="supports" type="u" access="read"/>
+
+    <!--
+         Spawn:
+         @cwd_path: the working directory for the new process
+         @argv: the argv for the new process, starting with the executable to launch
+         @fds: an array of file descriptors to pass to the new process
+         @envs: an array of variable/value pairs for the environment of the new process
+         @flags: flags
+         @options: Vardict with optional further information
+         @pid: the PID of the new process
+
+         This method lets you start a new instance of your
+         application, optionally enabling a tighter sandbox.
+
+         The following flags values are supported:
+         <variablelist>
+           <varlistentry>
+             <term>1 (FLATPAK_SPAWN_FLAGS_CLEAR_ENV)</term>
+             <listitem><para>
+               Clear the environment.
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>2 (FLATPAK_SPAWN_FLAGS_LATEST_VERSION)</term>
+             <listitem><para>
+               Spawn the latest version of the app.
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>4 (FLATPAK_SPAWN_FLAGS_SANDBOX)</term>
+             <listitem><para>
+               Spawn in a sandbox (equivalent of the sandbox option of flatpak run).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>8 (FLATPAK_SPAWN_FLAGS_NO_NETWORK)</term>
+             <listitem><para>
+               Spawn without network (equivalent of the unshare=network option of flatpak run).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>16 (FLATPAK_SPAWN_FLAGS_WATCH_BUS)</term>
+             <listitem><para>
+               Kill the sandbox when the caller disappears from the session bus.
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>32 (FLATPAK_SPAWN_FLAGS_EXPOSE_PIDS)</term>
+             <listitem><para>
+               Expose the sandbox pids in the callers sandbox, only supported if using user namespaces for containers (not setuid), see the support property.
+               </para><para>
+               This was added in version 3 of this interface (available from flatpak 1.6.0 and later).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>64 (FLATPAK_SPAWN_FLAGS_NOTIFY_START)</term>
+             <listitem><para>
+               Emit a SpawnStarted signal once the sandboxed process has been
+               fully started.
+               </para><para>
+               This was added in version 4 of this interface (available from flatpak 1.8.0 and later).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>128 (FLATPAK_SPAWN_FLAGS_SHARE_PIDS)</term>
+             <listitem><para>
+              Expose the sandbox process IDs in the caller's sandbox and
+              the caller's process IDs in the new sandbox. Only supported
+              if using user namespaces for containers (not setuid), see the
+              support property.
+             </para><para>
+               This was added in version 5 of this interface (available from flatpak 1.10.0 and later).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>256 (FLATPAK_SPAWN_FLAGS_EMPTY_APP)</term>
+             <listitem><para>
+               Don't provide app files at <filename>/app</filename> in the
+               new sandbox. Instead, <filename>/app</filename> will be an
+               empty directory. This flag and the <option>app-fd</option>
+               option are mutually exclusive.
+             </para><para>
+               As with the <option>app-fd</option> option, the caller's
+               Flatpak app files and extensions will be mounted on
+               <filename>/run/parent/app</filename>, with
+               filenames like <filename>/run/parent/app/bin/myapp</filename>.
+             </para><para>
+               This was added in version 6 of this interface (available from
+               flatpak 1.12.0 and later).
+             </para></listitem>
+           </varlistentry>
+         </variablelist>
+
+         Unknown (unsupported) flags are an error and will cause Spawn()
+         to fail.
+
+         Unknown (unsupported) options are ignored.
+         The following options are supported:
+         <variablelist>
+           <varlistentry>
+             <term>sandbox-expose as</term>
+             <listitem><para>
+               A list of filenames for files inside the sandbox that will be exposed
+               to the new sandbox, for reading and writing. Note that absolute paths
+               or subdirectories are not allowed.
+             </para><para>
+               The files must be in the <filename>sandbox</filename> subdirectory of
+               the instance directory (i.e. <filename>~/.var/app/$APP_ID/sandbox</filename>).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>sandbox-expose-ro as</term>
+             <listitem><para>
+               A list of filenames for files inside the sandbox that will be exposed
+               to the new sandbox, readonly. Note that absolute paths or subdirectories
+               are not allowed.
+             </para><para>
+               The files must be in the <filename>sandbox</filename> subdirectory of
+               the instance directory (i.e. <filename>~/.var/app/$APP_ID/sandbox</filename>).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>sandbox-expose-fd ah</term>
+             <listitem><para>
+               A list of file descriptor for files inside the sandbox that will be exposed
+               to the new sandbox, for reading and writing (if the caller has write access).
+               The file descriptors must be opened with O_PATH and O_NOFOLLOW and cannot be symlinks.
+             </para><para>
+               This was added in version 3 of this interface (available from flatpak 1.6.0 and later).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>sandbox-expose-fd-ro ah</term>
+             <listitem><para>
+               A list of file descriptor for files inside the sandbox that will be exposed
+               to the new sandbox, readonly. The file descriptors must be opened with O_PATH and O_NOFOLLOW and cannot be symlinks.
+             </para><para>
+               This was added in version 3 of this interface (available from flatpak 1.6.0 and later).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>sandbox-flags u</term>
+             <listitem><para>
+             Flags affecting the created sandbox. The following flags values are supported:
+             <variablelist>
+               <varlistentry>
+                 <term>1</term>
+                 <listitem><para>
+                   Share the display access (X11, wayland) with the caller.
+                 </para></listitem>
+               </varlistentry>
+               <varlistentry>
+                 <term>2</term>
+                 <listitem><para>
+                   Share the sound access (pulseaudio) with the caller.
+                 </para></listitem>
+               </varlistentry>
+               <varlistentry>
+                 <term>4</term>
+                 <listitem><para>
+                   Share the gpu access with the caller.
+                 </para></listitem>
+               </varlistentry>
+               <varlistentry>
+                 <term>8</term>
+                 <listitem><para>
+                   Allow sandbox access to (filtered) session bus.
+                 </para></listitem>
+               </varlistentry>
+               <varlistentry>
+                 <term>16</term>
+                 <listitem><para>
+                   Allow sandbox access to accessibility bus.
+                 </para></listitem>
+               </varlistentry>
+               <varlistentry>
+                 <term>32</term>
+                 <listitem><para>
+                   Allow sandbox access to input devices.
+                 </para></listitem>
+               </varlistentry>
+               <varlistentry>
+                 <term>64</term>
+                 <listitem><para>
+                   Allow sandbox access to USB devices.
+                 </para></listitem>
+               </varlistentry>
+               <varlistentry>
+                 <term>128</term>
+                 <listitem><para>
+                   Allow sandbox access to KVM.
+                 </para></listitem>
+               </varlistentry>
+               <varlistentry>
+                 <term>256</term>
+                 <listitem><para>
+                   Allow sandbox access to shared memory.
+                 </para></listitem>
+               </varlistentry>
+               <varlistentry>
+                 <term>512</term>
+                 <listitem><para>
+                   Allow sandbox access to all devices.
+                 </para></listitem>
+               </varlistentry>
+             </variablelist>
+
+             </para><para>
+             This was added in version 3 of this interface (available from flatpak 1.6.0 and later).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>sandbox-a11y-own-names as</term>
+             <listitem><para>
+               An array of D-Bus names to be owned on the accessibility bus. The
+               names must have the app id as prefix.
+             </para><para>
+               Only applies when `sandbox-flags` contains access to the accessibility
+               bus as well.
+             </para><para>
+               This was added in version 7 of this interface (available from
+               flatpak 1.16.0 and later).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>unset-env as</term>
+             <listitem><para>
+             A list of environment variables to unset (remove from the environment).
+             </para><para>
+             This was added in version 5 of this interface (available from flatpak 1.10.0 and later).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>usr-fd h</term>
+             <listitem><para>
+               A file descriptor for the directory that will be used as
+               <filename>/usr</filename> in the new sandbox, instead of the
+               <filename>files</filename> directory
+               from the caller's Flatpak runtime.
+               The new sandbox's <filename>/etc</filename> will be based
+               on the <filename>etc</filename> subdirectory of the given
+               directory, and compatibility symlinks in its
+               root directory (<filename>/lib</filename>,
+               <filename>/bin</filename> and so on) will point into the
+               given directory. The caller's Flatpak runtime and its
+               extensions will be mounted on
+               <filename>/run/parent/usr</filename>, with filenames like
+               <filename>/run/parent/usr/bin/env</filename>,
+               and compatibility symlinks like
+               <filename>/run/parent/bin</filename> →
+               <filename>usr/bin</filename>.
+             </para><para>
+               The file descriptor must be opened with O_PATH and
+               O_NOFOLLOW and cannot be a symlink.
+             </para><para>
+               This was added in version 6 of this interface (available from
+               flatpak 1.12.0 and later).
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>app-fd h</term>
+             <listitem><para>
+               A file descriptor for the directory that will be used as
+               <filename>/app</filename> in the new sandbox, instead of the
+               <filename>files</filename> directory
+               from the caller's Flatpak app. The caller's Flatpak app
+               files and extensions will be
+               mounted on <filename>/run/parent/app</filename>, with
+               filenames like <filename>/run/parent/app/bin/myapp</filename>.
+             </para><para>
+               This option and the
+               <option>FLATPAK_SPAWN_FLAGS_EMPTY_APP</option>
+               flag are mutually exclusive.
+             </para><para>
+               The file descriptor must be opened with O_PATH and
+               O_NOFOLLOW and cannot be a symlink.
+             </para><para>
+               This was added in version 6 of this interface (available from
+               flatpak 1.12.0 and later).
+             </para></listitem>
+           </varlistentry>
+         </variablelist>
+
+    -->
+    <method name="Spawn">
+      <annotation name="org.gtk.GDBus.C.UnixFD" value="true"/>
+      <arg type='ay' name='cwd_path' direction='in'/>
+      <arg type='aay' name='argv' direction='in'/>
+      <arg type='a{uh}' name='fds' direction='in'/>
+      <arg type='a{ss}' name='envs' direction='in'/>
+      <arg type='u' name='flags' direction='in'/>
+      <arg type="a{sv}" name="options" direction="in"/>
+      <arg type='u' name='pid' direction='out'/>
+    </method>
+
+    <!--
+        SpawnSignal:
+        @pid: the PID inside the container to signal
+        @signal: the signal to send (see <citerefentry><refentrytitle>signal</refentrytitle><manvolnum>7</manvolnum></citerefentry>)
+        @to_process_group: whether to send the signal to the process group
+
+        This method lets you send a Unix signal to a process
+        that was started with org.freedesktop.portal.Flatpak.Spawn().
+        The @pid argument here should be the PID that is returned
+        by the Spawn() call: it is not necessarily valid in the caller's
+        PID namespace.
+      -->
+    <method name="SpawnSignal">
+      <arg type='u' name='pid' direction='in'/>
+      <arg type='u' name='signal' direction='in'/>
+      <arg type='b' name='to_process_group' direction='in'/>
+    </method>
+
+    <!--
+        SpawnStarted:
+        @pid: the PID of the process that has been started
+        @relpid: the PID of the process relative to the current namespace.
+        This is only non-zero if the expose PIDs flag (32) or the share
+        PIDs flag (128) was passed to
+        org.freedesktop.portal.Flatpak.Spawn(), and it may still be zero if
+        the process exits before its relative PID could be read.
+
+        Emitted when a process started by org.freedesktop.portal.Flatpak.Spawn()
+        has fully started. In other words, org.freedesktop.portal.Flatpak.Spawn() returns once the sandbox
+        has been started, and this signal is emitted once the process inside
+        itself is started.
+
+        Only emitted by version 4 of this interface (available from flatpak
+        1.8.0 and later) and if the notify start flag (64) was passed to
+        org.freedesktop.portal.Flatpak.Spawn().
+    -->
+    <signal name="SpawnStarted">
+      <arg type='u' name='pid' direction='out'/>
+      <arg type='u' name='relpid' direction='out'/>
+    </signal>
+
+    <!--
+        SpawnExited:
+        @pid: the PID of the process that has ended
+        @exit_status: the wait status (see <citerefentry><refentrytitle>waitpid</refentrytitle><manvolnum>2</manvolnum></citerefentry>)
+
+        Emitted when a process started by org.freedesktop.portal.Flatpak.Spawn()
+        exits.
+        Use g_spawn_check_exit_status(), or the macros such as
+        WIFEXITED documented in
+        <citerefentry><refentrytitle>waitpid</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
+        to interpret the @exit_status.
+
+        This signal is not emitted for processes that were not launched
+        directly by Spawn(), for example if a process launched by
+        Spawn() runs foreground or background child processes.
+    -->
+    <signal name="SpawnExited">
+      <arg type='u' name='pid' direction='out'/>
+      <arg type='u' name='exit_status' direction='out'/>
+    </signal>
+
+    <!--
+        CreateUpdateMonitor:
+        @options: Vardict with optional further information
+        @handle: Object path for the #org.freedesktop.portal.Flatpak.UpdateMonitor object
+
+        Creates an update monitor object that will emit
+        signals when an update for the caller becomes
+        available, and can be used to install it.
+
+        The handle will be of the form /org/freedesktop/portal/Flatpak/update_monitor/SENDER/TOKEN,
+        where SENDER is the caller's unique name, with the initial ':' removed and
+        all '.' replaced by '_', and TOKEN is a unique token that the caller can optionally provide
+        with the 'handle_token' key in the options vardict.
+
+        Currently, no other options are accepted.
+
+        This was added in version 2 of this interface (available from flatpak 1.5.0 and later).
+    -->
+    <method name="CreateUpdateMonitor">
+      <arg type="a{sv}" name="options" direction="in"/>
+      <arg type="o" name="handle" direction="out"/>
+    </method>
+  </interface>
+
+  <interface name="org.freedesktop.portal.Flatpak.UpdateMonitor">
+
+    <!--
+        Close:
+
+        Ends the update monitoring and cancels any ongoing
+        installation.
+    -->
+    <method name="Close">
+    </method>
+
+    <!--
+        UpdateAvailable:
+        @update_info: More information about the available update
+
+        Gets emitted when a new update is available. This is only
+        sent once with the same information, but can be sent many
+        times if new updates appear.
+
+        The following information may be included in the
+        @update_info dictionary:
+        <variablelist>
+          <varlistentry>
+            <term>running-commit s</term>
+            <listitem><para>
+              The commit of the currently running instance.
+            </para></listitem>
+          </varlistentry>
+          <varlistentry>
+            <term>local-commit s</term>
+            <listitem><para>
+              The commit that is currently installed. Restarting
+              the application will cause this commit to be used.
+            </para></listitem>
+          </varlistentry>
+          <varlistentry>
+            <term>remote-commit s</term>
+            <listitem><para>
+              The commit that is available as an update from the
+              remote. Updating the application will deploy this
+              commit.
+            </para></listitem>
+          </varlistentry>
+        </variablelist>
+    -->
+    <signal name="UpdateAvailable">
+      <arg type="a{sv}" name="update_info" direction="out"/>
+    </signal>
+
+    <!--
+        Update:
+        @parent_window: Identifier for the application window,
+          see <link linkend="parent_window">Common Conventions</link>
+        @options: Vardict with optional further information
+
+        Asks to install an update of the calling app.
+        During the installation,
+        #org.freedesktop.portal.Flatpak.UpdateMonitor::Progress
+        signals will be emitted to communicate the status
+        and progress.
+
+        Note that updates are only allowed if the new version
+        has the same permissions (or less) than the currently installed
+        version. If the new version requires a new permission then the
+        operation will fail with the error org.freedesktop.DBus.Error.NotSupported
+        and updates has to be done with the system tools.
+
+        Currently, no options are accepted.
+    -->
+    <method name="Update">
+      <arg type="s" name="parent_window" direction="in"/>
+      <arg type="a{sv}" name="options" direction="in"/>
+    </method>
+
+    <!--
+      Progress:
+      @handle: the handle of the Request
+      @info: More information about the update progress
+
+      Gets emitted to indicate progress of the installation.  It's
+      undefined exactly how often this is sent, but it will be emitted
+      at least once at the end with non-zero status field. For each
+      successful operation in the update we're also guaranteed to send
+      one (and only one) signal with progress 100.
+
+      The following fields may be included in the info:
+         <variablelist>
+           <varlistentry>
+             <term>n_ops u</term>
+             <listitem><para>
+               The number of operations that the update
+               consists of.
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>op u</term>
+             <listitem><para>
+               The position of the currently active
+               operation.
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>progress u</term>
+             <listitem><para>
+               The progress of the currently active
+               operation, as a number between 0 and 100.
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>status u</term>
+             <listitem><para>
+               The overall status of the update.
+               <simplelist>
+                 <member>0: Running</member>
+                 <member>1: Empty. No update to install</member>
+                 <member>2: Done</member>
+                 <member>3: Failed</member>
+               </simplelist>
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>error s</term>
+             <listitem><para>
+               The error name, sent when status is Failed
+             </para></listitem>
+           </varlistentry>
+           <varlistentry>
+             <term>error_message s</term>
+             <listitem><para>
+               The error message, sent when status is Failed
+             </para></listitem>
+           </varlistentry>
+         </variablelist>
+    -->
+    <signal name="Progress">
+      <arg type="a{sv}" name="info" direction="out"/>
+    </signal>
+
+  </interface>
+
+</node>
diff --git a/Telegram/SourceFiles/platform/linux/specific_linux.cpp b/Telegram/SourceFiles/platform/linux/specific_linux.cpp
index abe2197966..b970da0b01 100644
--- a/Telegram/SourceFiles/platform/linux/specific_linux.cpp
+++ b/Telegram/SourceFiles/platform/linux/specific_linux.cpp
@@ -470,7 +470,10 @@ void InstallLauncher() {
 		"DESKTOPINTEGRATION");
 
 	// don't update desktop file for alpha version or if updater is disabled
-	if (cAlphaVersion() || Core::UpdaterDisabled() || DisabledByEnv) {
+	if (cAlphaVersion()
+			|| Core::UpdaterDisabled()
+			|| KSandbox::isInside()
+			|| DisabledByEnv) {
 		return;
 	}
 
diff --git a/Telegram/SourceFiles/settings/sections/settings_advanced.cpp b/Telegram/SourceFiles/settings/sections/settings_advanced.cpp
index ece7d62581..1a99cc92f3 100644
--- a/Telegram/SourceFiles/settings/sections/settings_advanced.cpp
+++ b/Telegram/SourceFiles/settings/sections/settings_advanced.cpp
@@ -78,6 +78,8 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
 #include "spellcheck/platform/platform_spellcheck.h"
 #endif // !TDESKTOP_DISABLE_SPELLCHECK
 
+#include <ksandbox.h>
+
 namespace Settings {
 namespace {
 
@@ -1014,7 +1016,7 @@ void BuildUpdateSection(SectionBuilder &builder, bool atTop) {
 	auto install = (Ui::SettingsButton*)nullptr;
 	auto check = (Ui::SettingsButton*)nullptr;
 	builder.scope([&] {
-		install = cAlphaVersion()
+		install = (cAlphaVersion() || KSandbox::isInside())
 			? nullptr
 			: builder.addButton({
 				.id = u"advanced/install_beta"_q,
@@ -1050,11 +1052,32 @@ void BuildUpdateSection(SectionBuilder &builder, bool atTop) {
 			update->moveToLeft(0, 0);
 		}, update->lifetime());
 
-		const auto showDownloadProgress = [=](int64 ready, int64 total) {
+		const auto showDownloadProgress = [=](
+				int64 ready,
+				int64 total,
+				bool preferPercent) {
+			const auto formatted = [&] {
+				if (!preferPercent) {
+					return Ui::FormatDownloadText(ready, total);
+				}
+				const auto percent = (total > 0)
+					? std::clamp((ready * 100) / float64(total), 0., 100.)
+					: 0.;
+				auto result = QString::number(percent, 'f', 2);
+				if (result.contains('.')) {
+					while (result.endsWith('0')) {
+						result.chop(1);
+					}
+					if (result.endsWith('.')) {
+						result.chop(1);
+					}
+				}
+				return result + '%';
+			}();
 			texts->fire(tr::lng_settings_downloading_update(
 				tr::now,
 				lt_progress,
-				Ui::FormatDownloadText(ready, total)));
+				formatted));
 			downloading->fire(true);
 		};
 		const auto setDefaultStatus = [=](
@@ -1063,7 +1086,10 @@ void BuildUpdateSection(SectionBuilder &builder, bool atTop) {
 			const auto state = checker.state();
 			switch (state) {
 			case State::Download:
-				showDownloadProgress(checker.already(), checker.size());
+				showDownloadProgress(
+					checker.already(),
+					checker.size(),
+					checker.percent());
 				break;
 			case State::Ready:
 				texts->fire(tr::lng_settings_update_ready(tr::now));
@@ -1120,7 +1146,10 @@ void BuildUpdateSection(SectionBuilder &builder, bool atTop) {
 		}, options->lifetime());
 		checker.progress(
 		) | rpl::on_next([=](Core::UpdateChecker::Progress progress) {
-			showDownloadProgress(progress.already, progress.size);
+			showDownloadProgress(
+				progress.already,
+				progress.size,
+				progress.percent);
 		}, options->lifetime());
 		checker.failed() | rpl::on_next([=] {
 			options->setAttribute(Qt::WA_TransparentForMouseEvents, false);
@@ -1344,7 +1373,7 @@ void SetupUpdate(not_null<Ui::VerticalLayout*> container) {
 			container,
 			object_ptr<Ui::VerticalLayout>(container)));
 	const auto inner = options->entity();
-	const auto install = cAlphaVersion()
+	const auto install = (cAlphaVersion() || KSandbox::isInside())
 		? nullptr
 		: inner->add(object_ptr<Button>(
 			inner,
@@ -1375,11 +1404,32 @@ void SetupUpdate(not_null<Ui::VerticalLayout*> container) {
 	}, label->lifetime());
 	label->setAttribute(Qt::WA_TransparentForMouseEvents);
 
-	const auto showDownloadProgress = [=](int64 ready, int64 total) {
+	const auto showDownloadProgress = [=](
+			int64 ready,
+			int64 total,
+			bool preferPercent) {
+		const auto formatted = [&] {
+			if (!preferPercent) {
+				return Ui::FormatDownloadText(ready, total);
+			}
+			const auto percent = (total > 0)
+				? std::clamp((ready * 100) / float64(total), 0., 100.)
+				: 0.;
+			auto result = QString::number(percent, 'f', 2);
+			if (result.contains('.')) {
+				while (result.endsWith('0')) {
+					result.chop(1);
+				}
+				if (result.endsWith('.')) {
+					result.chop(1);
+				}
+			}
+			return result + '%';
+		}();
 		texts->fire(tr::lng_settings_downloading_update(
 			tr::now,
 			lt_progress,
-			Ui::FormatDownloadText(ready, total)));
+			formatted));
 		downloading->fire(true);
 	};
 	const auto setDefaultStatus = [=](const Core::UpdateChecker &checker) {
@@ -1387,7 +1437,10 @@ void SetupUpdate(not_null<Ui::VerticalLayout*> container) {
 		const auto state = checker.state();
 		switch (state) {
 		case State::Download:
-			showDownloadProgress(checker.already(), checker.size());
+			showDownloadProgress(
+				checker.already(),
+				checker.size(),
+				checker.percent());
 			break;
 		case State::Ready:
 			texts->fire(tr::lng_settings_update_ready(tr::now));
@@ -1455,7 +1508,10 @@ void SetupUpdate(not_null<Ui::VerticalLayout*> container) {
 	}, options->lifetime());
 	checker.progress(
 	) | rpl::on_next([=](Core::UpdateChecker::Progress progress) {
-		showDownloadProgress(progress.already, progress.size);
+		showDownloadProgress(
+			progress.already,
+			progress.size,
+			progress.percent);
 	}, options->lifetime());
 	checker.failed() | rpl::on_next([=] {
 		options->setAttribute(Qt::WA_TransparentForMouseEvents, false);
diff --git a/cmake b/cmake
index e57c27e81a..3907b8c27d 160000
--- a/cmake
+++ b/cmake
@@ -1 +1 @@
-Subproject commit e57c27e81a217f982ebf63528057119fd8780728
+Subproject commit 3907b8c27d9c6a4b5bc5805eaa01567dc0cdd90d