diff --git a/.github/workflows/android-app.yml b/.github/workflows/android-app.yml
index 6d0638463465..44f76959bae7 100644
--- a/.github/workflows/android-app.yml
+++ b/.github/workflows/android-app.yml
@@ -132,7 +132,7 @@ jobs:
         env:
           RUSTFLAGS: --deny warnings
         run: |
-          mkdir -p android/app/build/extraAssets/
+          mkdir -p android/app/build/extraAssets
           cargo run --bin relay_list > android/app/build/extraAssets/relays.json
 
       - name: Upload
@@ -284,7 +284,7 @@ jobs:
       - name: Checkout wireguard-go-rs recursively
         run: |
           git config --global --add safe.directory '*'
-          git submodule update --init --recursive --depth=1 wireguard-go-rs    
+          git submodule update --init --recursive --depth=1 wireguard-go-rs
 
       - uses: actions/download-artifact@v4
         with:
diff --git a/android/docker/Dockerfile b/android/docker/Dockerfile
index cccd589abb9c..3eb4a67c9666 100644
--- a/android/docker/Dockerfile
+++ b/android/docker/Dockerfile
@@ -68,6 +68,9 @@ ENV AR_x86_64_linux_android=${NDK_TOOLCHAIN_DIR}/llvm-ar \
     CC_x86_64_linux_android=${NDK_TOOLCHAIN_DIR}/x86_64-linux-android${MIN_SDK_VERSION}-clang \
     CARGO_TARGET_X86_64_LINUX_ANDROID_LINKER=${NDK_TOOLCHAIN_DIR}/x86_64-linux-android${MIN_SDK_VERSION}-clang
 
+# Set up python3 path for rust gradle plugin
+ENV RUST_ANDROID_GRADLE_PYTHON_COMMAND=/usr/bin/python3
+
 # === Install/set up the image ===
 
 RUN apt-get update -y && apt-get install -y \
diff --git a/building/android-container-image.txt b/building/android-container-image.txt
index b8e53a9d8681..973dbf7a5cf2 100644
--- a/building/android-container-image.txt
+++ b/building/android-container-image.txt
@@ -1 +1 @@
-mullvadvpn-app-build:latest
+ghcr.io/mullvad/mullvadvpn-app-build-android:7b6bc0f44
\ No newline at end of file
diff --git a/building/container-run.sh b/building/container-run.sh
index deb5e66a19d8..639c71133286 100755
--- a/building/container-run.sh
+++ b/building/container-run.sh
@@ -15,7 +15,7 @@ CARGO_TARGET_VOLUME_NAME=${CARGO_TARGET_VOLUME_NAME:-"cargo-target"}
 CARGO_REGISTRY_VOLUME_NAME=${CARGO_REGISTRY_VOLUME_NAME:-"cargo-registry"}
 GRADLE_CACHE_VOLUME_NAME=${GRADLE_CACHE_VOLUME_NAME:-"gradle-cache"}
 ANDROID_CREDENTIALS_DIR=${ANDROID_CREDENTIALS_DIR:-""}
-CONTAINER_RUNNER=${CONTAINER_RUNNER:-"docker"}
+CONTAINER_RUNNER=${CONTAINER_RUNNER:-"podman"}
 # Temporarily do not use mold for linking by default due to it causing build errors.
 # There's a separate issue (DES-1177) to address this problem.
 # Build servers also opt out of this and instead use GNU ld.
@@ -34,10 +34,10 @@ case ${1-:""} in
     ;;
     android)
         container_image_name=$(cat "$SCRIPT_DIR/android-container-image.txt")
-        optional_gradle_cache_volume=(-v "$GRADLE_CACHE_VOLUME_NAME:/root/.gradle")
+        optional_gradle_cache_volume=(-v "$GRADLE_CACHE_VOLUME_NAME:/root/.gradle:Z")
 
         if [ -n "$ANDROID_CREDENTIALS_DIR" ]; then
-            optional_android_credentials_volume=(-v "$ANDROID_CREDENTIALS_DIR:$REPO_MOUNT_TARGET/android/credentials")
+            optional_android_credentials_volume=(-v "$ANDROID_CREDENTIALS_DIR:$REPO_MOUNT_TARGET/android/credentials:Z")
         fi
 
         shift 1
@@ -54,8 +54,9 @@ fi
 
 set -x
 exec "$CONTAINER_RUNNER" run --rm -it \
-    -v "$REPO_DIR:$REPO_MOUNT_TARGET" \
-    -v "$CARGO_TARGET_VOLUME_NAME:/cargo-target" \
-    -v "$CARGO_REGISTRY_VOLUME_NAME:/root/.cargo/registry" \
+    -v "$REPO_DIR:$REPO_MOUNT_TARGET:Z" \
+    -v "$CARGO_TARGET_VOLUME_NAME:/cargo-target:Z" \
+    -v "$CARGO_REGISTRY_VOLUME_NAME:/root/.cargo/registry:Z" \
     "${optional_gradle_cache_volume[@]}" \
+    "${optional_android_credentials_volume[@]}" \
     "$container_image_name" bash -c "$optional_mold $*"