diff --git a/app/src/main/java/net/kollnig/missioncontrol/data/BlockingMode.java b/app/src/main/java/net/kollnig/missioncontrol/data/BlockingMode.java
index 489d96d71..3aadcfa4f 100644
--- a/app/src/main/java/net/kollnig/missioncontrol/data/BlockingMode.java
+++ b/app/src/main/java/net/kollnig/missioncontrol/data/BlockingMode.java
@@ -80,17 +80,22 @@ public static boolean isStrictMode(Context c) {
     }
 
     /**
-     * Minimal mode normally forces tracker protection on for apps that are in
-     * the VPN route. Browsers are the exception: they stay routed for VPN /
-     * WireGuard privacy, but app-level tracker blocking defaults off because
-     * browser-native blocking is usually more precise.
+     * Tracker protection defaults on for ordinary apps and off for browsers,
+     * where browser-native blocking is usually more precise. An explicit
+     * per-package value always wins, including in Minimal mode, so bulk
+     * include/exclude actions have the behavior promised by the settings UI.
      */
     public static boolean isTrackerProtectionEnabled(Context c,
             SharedPreferences trackerProtectPrefs,
             String packageName) {
-        if (isBrowserApp(c, packageName))
-            return trackerProtectPrefs.getBoolean(packageName, false);
-        return isMinimalMode(c) || trackerProtectPrefs.getBoolean(packageName, true);
+        Boolean configured = trackerProtectPrefs.contains(packageName)
+                ? trackerProtectPrefs.getBoolean(packageName, true)
+                : null;
+        return resolveTrackerProtection(isBrowserApp(c, packageName), configured);
+    }
+
+    static boolean resolveTrackerProtection(boolean browser, Boolean configured) {
+        return configured == null ? !browser : configured;
     }
 
     /**
diff --git a/app/src/main/res/values-sl-rSI/strings.xml b/app/src/main/res/values-sl-rSI/strings.xml
index d5c0a2f0d..abd39a11e 100644
--- a/app/src/main/res/values-sl-rSI/strings.xml
+++ b/app/src/main/res/values-sl-rSI/strings.xml
@@ -204,7 +204,7 @@
     <string name="msg_wg_mullvad_note">TrackerControl ustvari WireGuardov profil Mulvad.  Številka računa se shrani krajevno za bodoče profile Mulvad.  Žetoni se ne shranjujejo in in izbrisa tukajšnjega profila ne odstrani naprave iz Mullvada.</string>
     <string name="msg_wg_mullvad_generating">Ustvarjanje profila WireGuard …</string>
     <string name="msg_wg_mullvad_failed">Nastavitev Mullvada je spodletela: %s</string>
-    <string name="msg_wg_mullvad_countries_failed"></string>
+    <string name="msg_wg_mullvad_countries_failed">Držav Mullvad ni bilo mogoče naložiti: %s</string>
     <string name="vpn_status_connected">%s</string>
     <string name="vpn_status_mullvad_connected">Mullvad - %s</string>
     <string name="vpn_status_mullvad">Mullvad</string>
diff --git a/app/src/test/java/net/kollnig/missioncontrol/data/BlockingModeAndroidTest.java b/app/src/test/java/net/kollnig/missioncontrol/data/BlockingModeAndroidTest.java
index 7c1dc2d1d..c2c232d7c 100644
--- a/app/src/test/java/net/kollnig/missioncontrol/data/BlockingModeAndroidTest.java
+++ b/app/src/test/java/net/kollnig/missioncontrol/data/BlockingModeAndroidTest.java
@@ -87,6 +87,14 @@ public void explicitVpnInclusionWithRealExcludedAppsStopsAutoManagement() throws
         assertFalse(result.autoExcludedApps.contains("com.whatsapp"));
     }
 
+    @Test
+    public void explicitTrackerProtectionOverridesMinimalModeDefaults() {
+        assertTrue(BlockingMode.resolveTrackerProtection(false, null));
+        assertFalse(BlockingMode.resolveTrackerProtection(true, null));
+        assertFalse(BlockingMode.resolveTrackerProtection(false, false));
+        assertTrue(BlockingMode.resolveTrackerProtection(true, true));
+    }
+
     private static String readExcludedAppsAsset() throws IOException {
         return new String(Files.readAllBytes(assetPath("ddg-excluded-apps.json")), StandardCharsets.UTF_8);
     }