diff --git a/.forgejo/workflows/build-apk.yml b/.forgejo/workflows/build-apk.yml
index 5a37e39..db592dd 100644
--- a/.forgejo/workflows/build-apk.yml
+++ b/.forgejo/workflows/build-apk.yml
@@ -53,11 +53,21 @@ jobs:
       - name: Run client tests
         run: npm test --workspace parksmarter-client
 
-      # RN 0.79 wants a specific NDK; install it if the image doesn't ship it (best-effort).
-      - name: Ensure NDK
+      # Pre-install the NDK + CMake the RN native modules need. Do it here (not via
+      # Gradle's mid-build auto-install) and retry: the SDK mirror sometimes serves
+      # a truncated archive ("Archive is not a ZIP archive"), which self-heals on a
+      # clean retry. Clearing the partial dir between tries avoids reusing the bad file.
+      - name: Ensure NDK + CMake
         run: |
           yes | sdkmanager --licenses >/dev/null 2>&1 || true
-          sdkmanager "ndk;27.1.12297006" >/dev/null 2>&1 || true
+          ok=0
+          for i in 1 2 3; do
+            if sdkmanager "ndk;27.1.12297006" "cmake;3.22.1"; then ok=1; break; fi
+            echo "sdkmanager attempt $i failed; clearing partial CMake and retrying"
+            rm -rf "${ANDROID_HOME:-/opt/android}/cmake/3.22.1" "${ANDROID_SDK_ROOT:-/opt/android}/cmake/3.22.1" 2>/dev/null || true
+            sleep 5
+          done
+          [ "$ok" = 1 ] || echo "WARNING: NDK/CMake pre-install did not confirm; the build may retry it."
 
       - name: Restore signing keystore
         run: echo "${{ secrets.ANDROID_KEYSTORE_B64 }}" | base64 -d > "${{ github.workspace }}/app/release.keystore"