diff --git a/apps/CtsVerifier/AndroidManifest.xml b/apps/CtsVerifier/AndroidManifest.xml
index 0ed1126..f104bf3 100644
--- a/apps/CtsVerifier/AndroidManifest.xml
+++ b/apps/CtsVerifier/AndroidManifest.xml
@@ -80,6 +80,7 @@
 
     <!-- Needed for Telecom self-managed ConnectionService tests. -->
     <uses-permission android:name="android.permission.MANAGE_OWN_CALLS" />
+    <uses-permission android:name="android.permission.QUERY_ALL_PACKAGES" />
 
     <application android:networkSecurityConfig="@xml/network_security_config"
             android:label="@string/app_name"
diff --git a/apps/CtsVerifier/res/values/strings.xml b/apps/CtsVerifier/res/values/strings.xml
index 80ab389..81566be 100755
--- a/apps/CtsVerifier/res/values/strings.xml
+++ b/apps/CtsVerifier/res/values/strings.xml
@@ -2445,9 +2445,12 @@
 
         3. Tap \"Prepare VPN\" button below and consent to the VPN connection.\n
 
-        4. Finish all three test cases listed below.\n
+        4. Once connected, verify that the system shows disclosure (on some devices this is shown in
+           the notification area) that network traffic is being routed through the VPN app.\n
 
-        5. Repeat step 1 to remove CtsVpnFirewallApp.
+        5. Finish all three test cases listed below.\n
+
+        6. Repeat step 1 to remove CtsVpnFirewallApp.
     </string>
     <string name="provisioning_byod_always_on_vpn_prepare_button">Prepare VPN</string>
     <string name="provisioning_byod_always_on_vpn_vpn_not_found_note">