diff --git a/android/src/main/AndroidManifest.xml b/android/src/main/AndroidManifest.xml
index 9633e2b2bd..872963a302 100644
--- a/android/src/main/AndroidManifest.xml
+++ b/android/src/main/AndroidManifest.xml
@@ -57,6 +57,30 @@
             <intent-filter>
                 <action android:name="android.service.quicksettings.action.QS_TILE_PREFERENCES" />
             </intent-filter>
+            <!-- Static app shortcuts must be attached to the LAUNCHER activity. -->
+            <meta-data
+                android:name="android.app.shortcuts"
+                android:resource="@xml/shortcuts" />
+        </activity>
+
+        <!--
+            Transparent, no-UI trampoline that connects or disconnects the VPN. Exported so the
+            actions show up in the launcher long-press shortcut menu, Samsung Modes & Routines, and
+            can be sent from Tasker. Starting an activity (rather than IPNReceiver's broadcast)
+            reliably wakes a stopped app so connect can start the foreground VPN service.
+        -->
+        <activity
+            android:name="AutomationActivity"
+            android:exported="true"
+            android:excludeFromRecents="true"
+            android:noHistory="true"
+            android:taskAffinity=""
+            android:theme="@android:style/Theme.NoDisplay">
+            <intent-filter>
+                <action android:name="com.tailscale.ipn.CONNECT_VPN" />
+                <action android:name="com.tailscale.ipn.DISCONNECT_VPN" />
+                <category android:name="android.intent.category.DEFAULT" />
+            </intent-filter>
         </activity>
         <activity
             android:name="ShareActivity"
diff --git a/android/src/main/java/com/tailscale/ipn/AutomationActivity.kt b/android/src/main/java/com/tailscale/ipn/AutomationActivity.kt
new file mode 100644
index 0000000000..043d0355e3
--- /dev/null
+++ b/android/src/main/java/com/tailscale/ipn/AutomationActivity.kt
@@ -0,0 +1,63 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+package com.tailscale.ipn
+
+import android.app.Activity
+import android.content.Intent
+import android.net.VpnService
+import android.os.Bundle
+import com.tailscale.ipn.util.TSLog
+
+/**
+ * AutomationActivity is a transparent, no-UI trampoline that connects or disconnects the VPN and
+ * finishes immediately. It backs the launcher long-press shortcuts and can also be invoked from
+ * Samsung Modes and Routines or Tasker.
+ *
+ * It is an activity rather than an extension of [IPNReceiver]'s broadcasts because starting an
+ * activity reliably wakes an app that the OS has force-stopped or put into deep sleep, e.g. under
+ * Samsung battery management. The brief foreground also lets connect start the VPN service without
+ * hitting the Android 12+ restriction on starting a foreground service from the background, which
+ * the broadcast path can trip when the app has been idle.
+ */
+class AutomationActivity : Activity() {
+
+  override fun onCreate(savedInstanceState: Bundle?) {
+    super.onCreate(savedInstanceState)
+
+    when (intent?.action) {
+      IPNReceiver.INTENT_CONNECT_VPN -> connect()
+      IPNReceiver.INTENT_DISCONNECT_VPN -> UninitializedApp.get().stopVPN()
+      else -> TSLog.w(TAG, "unknown action: ${intent?.action}")
+    }
+
+    // Never show any UI: finish before this activity becomes visible.
+    finish()
+  }
+
+  /**
+   * Starts the VPN directly when it is ready and consent is already granted. Otherwise (not set up,
+   * or consent not yet granted) opens the app, which handles login and the consent prompt.
+   */
+  private fun connect() {
+    val app = UninitializedApp.get()
+    if (app.isAbleToStartVPN() && VpnService.prepare(this) == null) {
+      app.startVPN()
+    } else {
+      launchMainActivity()
+    }
+  }
+
+  private fun launchMainActivity() {
+    val intent =
+        Intent(this, MainActivity::class.java).apply { addFlags(Intent.FLAG_ACTIVITY_NEW_TASK) }
+    try {
+      startActivity(intent)
+    } catch (e: Exception) {
+      TSLog.e(TAG, "Failed to launch MainActivity: $e")
+    }
+  }
+
+  companion object {
+    private const val TAG = "AutomationActivity"
+  }
+}
diff --git a/android/src/main/res/values/strings.xml b/android/src/main/res/values/strings.xml
index 608f1f2a2e..1e3f1fb664 100644
--- a/android/src/main/res/values/strings.xml
+++ b/android/src/main/res/values/strings.xml
@@ -378,4 +378,10 @@
     <string name="enable_hardware_attestation">Enable hardware attestation</string>
     <string name="use_hardware_backed_keys_to_bind_node_identity_to_the_device">Use hardware-backed keys to bind node identity to the device</string>
 
+    <!-- App shortcuts (launcher long-press, Tasker, Samsung Modes &amp; Routines) -->
+    <string name="shortcut_connect_short">Connect</string>
+    <string name="shortcut_connect_long">Connect to Tailscale</string>
+    <string name="shortcut_disconnect_short">Disconnect</string>
+    <string name="shortcut_disconnect_long">Disconnect from Tailscale</string>
+
 </resources>
diff --git a/android/src/main/res/xml/shortcuts.xml b/android/src/main/res/xml/shortcuts.xml
new file mode 100644
index 0000000000..a4a1a3164f
--- /dev/null
+++ b/android/src/main/res/xml/shortcuts.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) Tailscale Inc & AUTHORS -->
+<!-- SPDX-License-Identifier: BSD-3-Clause -->
+<shortcuts xmlns:android="http://schemas.android.com/apk/res/android">
+    <shortcut
+        android:shortcutId="connect"
+        android:enabled="true"
+        android:icon="@drawable/ic_launcher_foreground"
+        android:shortcutShortLabel="@string/shortcut_connect_short"
+        android:shortcutLongLabel="@string/shortcut_connect_long">
+        <intent
+            android:action="com.tailscale.ipn.CONNECT_VPN"
+            android:targetPackage="com.tailscale.ipn"
+            android:targetClass="com.tailscale.ipn.AutomationActivity" />
+    </shortcut>
+
+    <shortcut
+        android:shortcutId="disconnect"
+        android:enabled="true"
+        android:icon="@drawable/ic_launcher_foreground"
+        android:shortcutShortLabel="@string/shortcut_disconnect_short"
+        android:shortcutLongLabel="@string/shortcut_disconnect_long">
+        <intent
+            android:action="com.tailscale.ipn.DISCONNECT_VPN"
+            android:targetPackage="com.tailscale.ipn"
+            android:targetClass="com.tailscale.ipn.AutomationActivity" />
+    </shortcut>
+</shortcuts>