diff --git a/.github/workflows/info-plist-check.yml b/.github/workflows/info-plist-check.yml
index 38e17428..9b931961 100644
--- a/.github/workflows/info-plist-check.yml
+++ b/.github/workflows/info-plist-check.yml
@@ -13,6 +13,9 @@ on:
       - 'src-tauri/Info.plist'
       - 'scripts/check-info-plist.cjs'
 
+permissions:
+  contents: read
+
 jobs:
   # Quick syntactic / duplicate-key check that runs on every platform.
   source-check:
diff --git a/src/components/Search/Camera.tsx b/src/components/Search/Camera.tsx
index 557315e1..6dcc0971 100644
--- a/src/components/Search/Camera.tsx
+++ b/src/components/Search/Camera.tsx
@@ -233,6 +233,9 @@ const Camera = () => {
         console.error(
           `[Camera] initialization failed: ${classified.name} - ${classified.message}`
         );
+        // Always release any probe stream we may have acquired before
+        // the failure, otherwise the camera light stays on.
+        stopCurrentStream();
         if (!cancelled) {
           setLastError({
             name: classified.name,