diff --git a/InterlinedList/InterlinedList.entitlements b/InterlinedList/InterlinedList.entitlements
index 903def2..309bfe6 100644
--- a/InterlinedList/InterlinedList.entitlements
+++ b/InterlinedList/InterlinedList.entitlements
@@ -4,5 +4,9 @@
 <dict>
 	<key>aps-environment</key>
 	<string>development</string>
+	<key>com.apple.developer.associated-domains</key>
+	<array>
+		<string>applinks:interlinedlist.com</string>
+	</array>
 </dict>
 </plist>
diff --git a/InterlinedList/InterlinedListApp.swift b/InterlinedList/InterlinedListApp.swift
index afa7615..886260a 100644
--- a/InterlinedList/InterlinedListApp.swift
+++ b/InterlinedList/InterlinedListApp.swift
@@ -63,10 +63,11 @@ struct InterlinedListApp: App {
         }
     }
 
-    // TODO(A2): Universal Links (a tapped https://interlinedlist.com link opening the
-    // app directly) need the backend to publish apple-app-site-association plus the
-    // Associated Domains entitlement. `parse` already accepts https permalinks, so
-    // onOpenURL will route them once that server asset ships.
+    // A2: Universal Links (a tapped https://interlinedlist.com link opening the app
+    // directly). The Associated Domains entitlement (applinks:interlinedlist.com) is now
+    // in place and `parse` already accepts https permalinks, so onOpenURL will route them
+    // once the backend publishes apple-app-site-association and the Associated Domains
+    // capability is enabled for the App ID / provisioning profile.
     private func handleDeepLink(_ url: URL) {
         // OAuth callbacks are captured by ASWebAuthenticationSession itself; the
         // app-level handler is a fallback for a torn-down session (safe to ignore).
diff --git a/InterlinedList/Services/OAuthCoordinator.swift b/InterlinedList/Services/OAuthCoordinator.swift
index efeff9b..819ab7b 100644
--- a/InterlinedList/Services/OAuthCoordinator.swift
+++ b/InterlinedList/Services/OAuthCoordinator.swift
@@ -35,12 +35,11 @@ enum OAuthProvider: String, CaseIterable {
     }
 
     /// Whether this provider's OAuth callback supports the native custom-scheme
-    /// token handoff. GitHub's callback has no mobile branch — it sets a web
-    /// session cookie and redirects to /dashboard, so it never returns
-    /// `interlinedlist://oauth/callback?token=…` and can't complete inside
-    /// `ASWebAuthenticationSession`. Hidden until the backend adds that branch.
-    /// (Backend auth contract — Open Dependency #1.)
-    var supportsNativeAuth: Bool { self != .github }
+    /// token handoff. All providers now return `interlinedlist://oauth/callback?token=…`
+    /// and complete inside `ASWebAuthenticationSession`. GitHub is enabled pending
+    /// the backend A1 deploy that adds its mobile branch; until that ships the
+    /// GitHub button will 401. (Backend auth contract — A1.)
+    var supportsNativeAuth: Bool { true }
 }
 
 enum OAuthError: Error {