diff --git a/.gitea/workflows/pr-checks.yml b/.gitea/workflows/pr-checks.yml
index bdb2815..8917e43 100644
--- a/.gitea/workflows/pr-checks.yml
+++ b/.gitea/workflows/pr-checks.yml
@@ -8,10 +8,13 @@
 #     * Enable Status Check
 #     * Status check patterns:  PR Checks / *
 #
-# Runner: the org's self-hosted `ubuntu-latest`, on a bare `ubuntu:latest`
-# container that lacks git/curl/unzip (needed by checkout + sdkmanager) -- so the
-# first step installs them. (Faster later: switch to a prebuilt Android-SDK
-# container image so nothing installs per-run.)
+# Runner: the org's self-hosted `ubuntu-latest`. The container lacks
+# git/curl/unzip (needed by checkout + sdkmanager), so the first step installs
+# them. It also installs JDK 17 from the Ubuntu archive rather than using
+# actions/setup-java, because this runner can't resolve api.adoptium.net (that
+# download fails with EAI_AGAIN) while the Ubuntu mirrors are reachable.
+# (Faster later: switch to a prebuilt Android-SDK+JDK container image so nothing
+# installs per-run.)
 
 name: PR Checks
 
@@ -27,23 +30,29 @@ jobs:
   android-build:
     runs-on: ubuntu-latest
     steps:
-      # Bare ubuntu:latest is missing the tools checkout + the SDK installer need.
-      - name: Install base tools
+      # Install the tools checkout + the SDK installer need, plus JDK 17 (see the
+      # header note on why we avoid actions/setup-java on this runner).
+      - name: Install base tools + JDK 17
         run: |
           apt-get update
-          apt-get install -y git curl unzip
+          apt-get install -y git curl unzip openjdk-17-jdk-headless
+          echo "JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64" >> "$GITHUB_ENV"
 
       - uses: actions/checkout@v4
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: "17"
-
       - name: Set up Android SDK
         uses: android-actions/setup-android@v3
 
+      # Install exactly what the build targets so it never depends on AGP's
+      # build-time auto-download. `yes |` accepts any license prompts; `set
+      # +o pipefail` so `yes` dying with SIGPIPE (exit 141) once sdkmanager
+      # closes the pipe doesn't fail the step -- sdkmanager's own exit, last in
+      # the pipeline, still gates success.
+      - name: Install Android SDK packages
+        run: |
+          set +o pipefail
+          yes | sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
+
       - name: Cache Gradle
         uses: actions/cache@v4
         with:
@@ -54,5 +63,9 @@ jobs:
           restore-keys: |
             gradle-${{ runner.os }}-
 
+      # chmod defensively: this runner's checkout doesn't preserve the git
+      # executable bit, so `./gradlew` alone fails with "Permission denied".
       - name: Lint, test, assemble debug
-        run: ./gradlew --no-daemon lint test assembleDebug
+        run: |
+          chmod +x ./gradlew
+          ./gradlew --no-daemon lint test assembleDebug
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 209e0ea..c107df1 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -20,7 +20,6 @@
         <activity
             android:name=".MainActivity"
             android:exported="true"
-            android:label="@string/app_name"
             android:theme="@style/Theme.RunicGateway">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
diff --git a/app/src/test/java/com/runicgateway/app/ScaffoldSanityTest.kt b/app/src/test/java/com/runicgateway/app/ScaffoldSanityTest.kt
index 0210009..9a49730 100644
--- a/app/src/test/java/com/runicgateway/app/ScaffoldSanityTest.kt
+++ b/app/src/test/java/com/runicgateway/app/ScaffoldSanityTest.kt
@@ -10,6 +10,9 @@ import org.junit.Test
 /**
  * Placeholder JVM unit test so the `test` CI gate has something to run in M0.
  * Real repository / view-model tests arrive with the functional pass (M1+).
+ *
+ * Assertions must be variant-agnostic: the `test` task runs both the debug and
+ * release unit-test variants, so nothing here may depend on `BuildConfig.DEBUG`.
  */
 class ScaffoldSanityTest {
     @Test
@@ -18,8 +21,7 @@ class ScaffoldSanityTest {
     }
 
     @Test
-    fun buildConfigIsDebuggableInTest() {
-        // Unit tests run against the debug variant.
-        assertTrue(BuildConfig.DEBUG)
+    fun versionNameIsSet() {
+        assertTrue(BuildConfig.VERSION_NAME.isNotBlank())
     }
 }
diff --git a/gradlew b/gradlew
old mode 100644
new mode 100755