diff --git a/core/img/manifest.json b/core/img/manifest.json
new file mode 100644
index 0000000000..fcecb85661
--- /dev/null
+++ b/core/img/manifest.json
@@ -0,0 +1,14 @@
+{
+	"name": "Nextcloud",
+	"start_url": "../../",
+	"icons": [{
+		"src": "favicon-touch.png",
+		"type": "image/png",
+		"sizes": "128x128"
+	}, {
+		"src": "favicon-mask.svg",
+		"type": "image/svg+xml",
+		"sizes": "16x16"
+	}],
+    "display": "standalone"
+}
diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php
index 31a5a1764f..439567fe6a 100644
--- a/core/templates/layout.user.php
+++ b/core/templates/layout.user.php
@@ -20,6 +20,7 @@
 		<link rel="icon" href="<?php print_unescaped(image_path($_['appid'], 'favicon.ico')); /* IE11+ supports png */ ?>">
 		<link rel="apple-touch-icon-precomposed" href="<?php print_unescaped(image_path($_['appid'], 'favicon-touch.png')); ?>">
 		<link rel="mask-icon" sizes="any" href="<?php print_unescaped(image_path($_['appid'], 'favicon-mask.svg')); ?>" color="<?php p($theme->getMailHeaderColor()); ?>">
+		<link rel="manifest" href="<?php print_unescaped(image_path($_['appid'], 'manifest.json')); ?>">
 		<?php if (isset($_['inline_ocjs'])): ?>
 			<script nonce="<?php p(\OC::$server->getContentSecurityPolicyNonceManager()->getNonce()) ?>" type="text/javascript">
 				<?php print_unescaped($_['inline_ocjs']); ?>
diff --git a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php
index c53b5b2146..09eb5a1c15 100644
--- a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php
+++ b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php
@@ -336,6 +336,7 @@ class EmptyContentSecurityPolicy {
 	public function buildPolicy() {
 		$policy = "default-src 'none';";
 		$policy .= "base-uri 'none';";
+		$policy .= "manifest-src 'self';";
 
 		if(!empty($this->allowedScriptDomains) || $this->inlineScriptAllowed || $this->evalScriptAllowed) {
 			$policy .= 'script-src ';