diff --git a/patches/0004-Add-offline-accounts.patch b/patches/0004-Add-offline-accounts.patch
index c92c898..e8feddb 100644
--- a/patches/0004-Add-offline-accounts.patch
+++ b/patches/0004-Add-offline-accounts.patch
@@ -42,11 +42,12 @@ which offered Microsoft and nothing else:
  .../src/components/ui/OfflineAccountModal.vue | 136 ++++++++++++++++++
  .../MinecraftRequiredModal.vue                |  30 +++-
  apps/app-frontend/src/helpers/auth.js         |  13 ++
+ apps/app/build.rs                             |   1 +
  apps/app/src/api/auth.rs                      |   7 +
  packages/app-lib/Cargo.toml                   |   1 +
  packages/app-lib/src/api/minecraft_auth.rs    |  39 +++++
  packages/app-lib/src/state/minecraft_auth.rs  |  68 +++++++++
- 11 files changed, 330 insertions(+), 8 deletions(-)
+ 12 files changed, 331 insertions(+), 8 deletions(-)
  create mode 100644 apps/app-frontend/src/components/ui/OfflineAccountModal.vue
 
 diff --git a/Cargo.lock b/Cargo.lock
@@ -437,6 +438,18 @@ index 94bd13e..cb7319a 100644
  /**
   * Retrieves the default user
   * @return {Promise<UUID | undefined>}
+diff --git a/apps/app/build.rs b/apps/app/build.rs
+index c4becf9..f8de273 100644
+--- a/apps/app/build.rs
++++ b/apps/app/build.rs
+@@ -14,6 +14,7 @@ fn main() {
+                     .commands(&[
+                         "check_reachable",
+                         "login",
++                        "login_offline",
+                         "remove_user",
+                         "get_default_user",
+                         "set_default_user",
 diff --git a/apps/app/src/api/auth.rs b/apps/app/src/api/auth.rs
 index 8227d94..f4eded6 100644
 --- a/apps/app/src/api/auth.rs
diff --git a/patches/0006-Add-Ely.by-accounts.patch b/patches/0006-Add-Ely.by-accounts.patch
index a70e925..a0dc17a 100644
--- a/patches/0006-Add-Ely.by-accounts.patch
+++ b/patches/0006-Add-Ely.by-accounts.patch
@@ -31,13 +31,14 @@ Modrinth Enhanced yet.
  .../src/components/ui/ElyAccountModal.vue     | 166 ++++++++++++++
  .../MinecraftRequiredModal.vue                |  29 ++-
  apps/app-frontend/src/helpers/auth.js         |  15 ++
+ apps/app/build.rs                             |   1 +
  apps/app/src/api/auth.rs                      |  10 +
  packages/app-lib/src/api/minecraft_auth.rs    |  34 +++
  packages/app-lib/src/launcher/mod.rs          |  16 ++
  packages/app-lib/src/state/minecraft_auth.rs  | 213 +++++++++++++++++-
  packages/app-lib/src/util/authlib_injector.rs |  77 +++++++
  packages/app-lib/src/util/mod.rs              |   1 +
- 10 files changed, 578 insertions(+), 13 deletions(-)
+ 11 files changed, 579 insertions(+), 13 deletions(-)
  create mode 100644 apps/app-frontend/src/components/ui/ElyAccountModal.vue
  create mode 100644 packages/app-lib/src/util/authlib_injector.rs
 
@@ -400,6 +401,18 @@ index cb7319a..57580ff 100644
  /**
   * Retrieves the default user
   * @return {Promise<UUID | undefined>}
+diff --git a/apps/app/build.rs b/apps/app/build.rs
+index f8de273..1fdb8e1 100644
+--- a/apps/app/build.rs
++++ b/apps/app/build.rs
+@@ -15,6 +15,7 @@ fn main() {
+                         "check_reachable",
+                         "login",
+                         "login_offline",
++                        "login_ely",
+                         "remove_user",
+                         "get_default_user",
+                         "set_default_user",
 diff --git a/apps/app/src/api/auth.rs b/apps/app/src/api/auth.rs
 index f4eded6..dea07b2 100644
 --- a/apps/app/src/api/auth.rs
diff --git a/patches/0007-Sign-in-to-Microsoft-in-the-player-s-own-browser.patch b/patches/0007-Sign-in-to-Microsoft-in-the-player-s-own-browser.patch
index 1b2917a..5f51dc1 100644
--- a/patches/0007-Sign-in-to-Microsoft-in-the-player-s-own-browser.patch
+++ b/patches/0007-Sign-in-to-Microsoft-in-the-player-s-own-browser.patch
@@ -24,9 +24,10 @@ modal for anyone the browser does not work out for.
  .../src/components/ui/MicrosoftLoginModal.vue | 213 ++++++++++++++++++
  .../MinecraftRequiredModal.vue                |  29 +--
  apps/app-frontend/src/helpers/auth.js         |  25 ++
+ apps/app/build.rs                             |   2 +
  apps/app/src/api/auth.rs                      |  77 +++++++
  packages/app-lib/src/api/mod.rs               |  12 +-
- 6 files changed, 331 insertions(+), 42 deletions(-)
+ 7 files changed, 333 insertions(+), 42 deletions(-)
  create mode 100644 apps/app-frontend/src/components/ui/MicrosoftLoginModal.vue
 
 diff --git a/apps/app-frontend/src/components/ui/AccountsCard.vue b/apps/app-frontend/src/components/ui/AccountsCard.vue
@@ -403,6 +404,19 @@ index 57580ff..c25af95 100644
  /**
   * Adds an offline account with the given username and makes it the active one.
   *
+diff --git a/apps/app/build.rs b/apps/app/build.rs
+index 1fdb8e1..5c797ab 100644
+--- a/apps/app/build.rs
++++ b/apps/app/build.rs
+@@ -14,6 +14,8 @@ fn main() {
+                     .commands(&[
+                         "check_reachable",
+                         "login",
++                        "login_browser_begin",
++                        "login_browser_finish",
+                         "login_offline",
+                         "login_ely",
+                         "remove_user",
 diff --git a/apps/app/src/api/auth.rs b/apps/app/src/api/auth.rs
 index dea07b2..5c3648c 100644
 --- a/apps/app/src/api/auth.rs
diff --git a/scripts/check.sh b/scripts/check.sh
index a45198e..13ccc48 100755
--- a/scripts/check.sh
+++ b/scripts/check.sh
@@ -52,6 +52,16 @@ check "it is reachable with no account yet" \
 check "the checklist offers the same choice" \
 	contains "$WORKTREE/apps/app-frontend/src/App.vue" '@login-minecraft="minecraftRequiredModal?.show()"'
 
+# A Tauri command that is not listed in build.rs compiles, ships, and then
+# fails at runtime with "not allowed by ACL". Nothing else here would catch it.
+log "Tauri command permissions"
+while read -r command; do
+	[ -n "$command" ] || continue
+	check "$command is allowed by the ACL" \
+		contains "$WORKTREE/apps/app/build.rs" "\"$command\","
+done < <(grep -A2 '#\[tauri::command\]' "$WORKTREE/apps/app/src/api/auth.rs" |
+	grep -oE 'pub async fn [a-z_]+' | awk '{print $4}' | sort -u)
+
 log "Microsoft sign-in"
 check "the browser flow is registered" \
 	contains "$WORKTREE/apps/app/src/api/auth.rs" 'login_browser_begin,'