diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 6f928bd..b3ba25f 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -70,7 +70,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           # fix hardcode changelog file name
-          body_path: ${{ github.workspace }}/fastlane/metadata/android/en-US/changelogs/32400.txt
+          body_path: ${{ github.workspace }}/fastlane/metadata/android/en-US/changelogs/32500.txt
           tag_name: ${{ github.ref_name }}
           name: Release ${{ github.ref_name }}
           draft: false
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index d01d137..bd4e55e 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -20,9 +20,8 @@
     <!--foreground service exempt android 14-->
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SYSTEM_EXEMPTED"/>
     <uses-permission android:name="android.permission.SCHEDULE_EXACT_ALARM"/>
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE"/>
 
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_LOCATION"/>
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_REMOTE_MESSAGING"/>
     <!--foreground service permissions-->
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
     <uses-permission android:name="android.permission.WAKE_LOCK" />
@@ -46,6 +45,7 @@
     </queries>
     <application
         android:allowBackup="true"
+        android:enableOnBackInvokedCallback="true"
         android:name=".WireGuardAutoTunnel"
         android:dataExtractionRules="@xml/data_extraction_rules"
         android:fullBackupContent="@xml/backup_rules"
@@ -55,7 +55,7 @@
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Theme.WireguardAutoTunnel"
-        tools:targetApi="31">
+        tools:targetApi="tiramisu">
         <activity
             android:name=".ui.MainActivity"
             android:exported="true"
@@ -84,7 +84,8 @@
         <service
             android:name=".service.foreground.ForegroundService"
             android:enabled="true"
-            android:foregroundServiceType="remoteMessaging"
+            android:foregroundServiceType="systemExempted|specialUse"
+            tools:node="merge"
             android:exported="false">
         </service>
         <service
@@ -106,7 +107,8 @@
             android:permission="android.permission.BIND_VPN_SERVICE"
             android:enabled="true"
             android:persistent="true"
-            android:foregroundServiceType="systemExempted"
+            android:foregroundServiceType="systemExempted|specialUse"
+            tools:node="merge"
             android:exported="false">
             <intent-filter>
                 <action android:name="android.net.VpnService"/>
@@ -119,7 +121,8 @@
             android:enabled="true"
             android:stopWithTask="false"
             android:persistent="true"
-            android:foregroundServiceType="systemExempted"
+            android:foregroundServiceType="systemExempted|specialUse"
+            tools:node="merge"
             android:exported="false">
         </service>
         <receiver android:enabled="true" android:name=".receiver.BootReceiver"
diff --git a/app/src/main/java/com/zaneschepke/wireguardautotunnel/service/foreground/WireGuardTunnelService.kt b/app/src/main/java/com/zaneschepke/wireguardautotunnel/service/foreground/WireGuardTunnelService.kt
index a54fc6d..e53ee6a 100644
--- a/app/src/main/java/com/zaneschepke/wireguardautotunnel/service/foreground/WireGuardTunnelService.kt
+++ b/app/src/main/java/com/zaneschepke/wireguardautotunnel/service/foreground/WireGuardTunnelService.kt
@@ -46,6 +46,7 @@ class WireGuardTunnelService : ForegroundService() {
 
     override fun startService(extras: Bundle?) {
         super.startService(extras)
+        // TODO fix grapheneOS calls always-on on install
         launchVpnStartingNotification()
         val tunnelConfigString = extras?.getString(getString(R.string.tunnel_extras_key))
         cancelJob()
@@ -179,7 +180,12 @@ class WireGuardTunnelService : ForegroundService() {
                 showTimestamp = true,
                 description = message
             )
-        super.startForeground(foregroundId, notification)
+        ServiceCompat.startForeground(
+            this,
+            foregroundId,
+            notification,
+            Constants.SYSTEM_EXEMPT_SERVICE_TYPE_ID
+        )
     }
 
     private fun cancelJob() {
diff --git a/buildSrc/src/main/kotlin/Constants.kt b/buildSrc/src/main/kotlin/Constants.kt
index dda8288..17ec898 100644
--- a/buildSrc/src/main/kotlin/Constants.kt
+++ b/buildSrc/src/main/kotlin/Constants.kt
@@ -1,7 +1,7 @@
 object Constants {
-    const val VERSION_NAME = "3.2.4"
+    const val VERSION_NAME = "3.2.5"
     const val JVM_TARGET = "17"
-    const val VERSION_CODE = 32400
+    const val VERSION_CODE = 32500
     const val TARGET_SDK = 34
     const val MIN_SDK = 26
     const val APP_ID = "com.zaneschepke.wireguardautotunnel"
diff --git a/fastlane/metadata/android/en-US/changelogs/32500.txt b/fastlane/metadata/android/en-US/changelogs/32500.txt
new file mode 100644
index 0000000..10f009c
--- /dev/null
+++ b/fastlane/metadata/android/en-US/changelogs/32500.txt
@@ -0,0 +1,2 @@
+Fixes:
+- Android 14 foreground permissions
\ No newline at end of file