diff --git a/.github/actions/build-android/action.yml b/.github/actions/build-android/action.yml
index 07f0c37a..7ec28e4e 100644
--- a/.github/actions/build-android/action.yml
+++ b/.github/actions/build-android/action.yml
@@ -80,17 +80,46 @@ runs:
       shell: bash
       run: echo "ANDROID_NDK_HOME=${ANDROID_HOME}/ndk/23.1.7779620" >> $GITHUB_ENV
 
-    - name: Cache gomobile binary
+    # gomobile bind shells out to gobind, and gobind is the tool that actually
+    # generates the Java bindings and the JNI glue. Caching and installing only
+    # gomobile left gobind to `gomobile init`, which pulls it from @latest: the
+    # driver was pinned while the generator floated, so the generated API could
+    # change without a commit here. Taking the revision from the go.mod the
+    # submodule already carries keeps the two from drifting apart, and lets the
+    # cache key follow a submodule bump on its own.
+    - name: Resolve the gomobile revision
+      id: gomobile-version
+      shell: bash
+      run: |
+        set -euo pipefail
+        version=$(cd netbird && go list -m -f '{{.Version}}' golang.org/x/mobile)
+        if [ -z "$version" ]; then
+          echo "::error::could not resolve the golang.org/x/mobile version from netbird/go.mod"
+          exit 1
+        fi
+        echo "Using gomobile and gobind at $version"
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
+    # The key has to name both tools, not just the revision: entries saved by
+    # the earlier gomobile-only step hold no gobind, so reusing that key would
+    # hit the cache, skip the install and leave the build without a generator.
+    - name: Cache gomobile and gobind
       id: gomobile-cache
       uses: actions/cache@v4
       with:
-        path: ~/go/bin/gomobile
-        key: gomobile-v0.0.0-20251113184115-a159579294ab
+        path: |
+          ~/go/bin/gomobile
+          ~/go/bin/gobind
+        key: gomobile-gobind-${{ steps.gomobile-version.outputs.version }}
 
-    - name: Install gomobile
+    - name: Install gomobile and gobind
       if: steps.gomobile-cache.outputs.cache-hit != 'true'
       shell: bash
-      run: go install golang.org/x/mobile/cmd/gomobile@v0.0.0-20251113184115-a159579294ab
+      run: |
+        set -euo pipefail
+        version='${{ steps.gomobile-version.outputs.version }}'
+        go install "golang.org/x/mobile/cmd/gomobile@$version"
+        go install "golang.org/x/mobile/cmd/gobind@$version"
 
     - name: Build NetBird Go library
       shell: bash
diff --git a/build-android-lib.sh b/build-android-lib.sh
index 39f244a6..8ad49e4d 100755
--- a/build-android-lib.sh
+++ b/build-android-lib.sh
@@ -74,13 +74,51 @@ get_version() {
   echo "ci-$short_hash"
 }
 
+# gomobile bind shells out to gobind, and gobind is the tool that actually
+# generates the Java bindings and the JNI glue. Its own suggestion for a missing
+# gobind is `gomobile init`, which installs it from @latest — that would let the
+# generator float even though the driver is pinned, changing the generated API
+# without a commit here. So both tools are held to the revision go.mod names:
+# the module version embedded in each binary (go version -m) is compared to
+# that pin, and a missing or diverging tool is reinstalled at the pin.
+#
+# GOBIN is prepended to PATH so the binary this function verified or installed
+# is the one `gomobile bind` (and its PATH lookup of gobind) actually runs,
+# even when another copy sits earlier on the caller's PATH.
+#
+# Must run inside the submodule: the pinned version comes from its go.mod.
+ensure_gomobile_tools() {
+  local want
+  want=$(go list -m -f '{{.Version}}' golang.org/x/mobile)
+
+  local gobin
+  gobin=$(go env GOBIN)
+  [ -n "$gobin" ] || gobin="$(go env GOPATH)/bin"
+  export PATH="$gobin:$PATH"
+
+  local tool path have
+  for tool in gomobile gobind; do
+    have=""
+    if path=$(command -v "$tool"); then
+      # `|| true`: go version fails on binaries without build info, and set -e
+      # would abort instead of letting the reinstall below repair the tool.
+      have=$(go version -m "$path" 2>/dev/null \
+        | awk '$1 == "mod" && $2 == "golang.org/x/mobile" {print $3}') || true
+    fi
+    if [ "$have" != "$want" ]; then
+      echo "Installing $tool at the go.mod pin $want (found: ${have:-none})"
+      go install "golang.org/x/mobile/cmd/$tool@$want"
+    fi
+  done
+}
+
 cd netbird
 
 # Get version using the function
 version=$(get_version "${1:-}")
 echo "Using version: $version"
 
-gomobile init
+ensure_gomobile_tools
 
 CGO_ENABLED=0 gomobile bind \
   -o "$app_path/gomobile/netbird.aar" \
diff --git a/netbird b/netbird
index 12546e23..ec6c8328 160000
--- a/netbird
+++ b/netbird
@@ -1 +1 @@
-Subproject commit 12546e231c2c8631c457d093c262dfaed83c1baa
+Subproject commit ec6c8328b74275852218aff2406b1f442c9d0361