diff --git a/.github/workflows/android-app-multiple.yml b/.github/workflows/android-app-multiple.yml
new file mode 100644
index 000000000000..26c1c2eef9fd
--- /dev/null
+++ b/.github/workflows/android-app-multiple.yml
@@ -0,0 +1,165 @@
+---
+name: Android - Multibuild
+on:
+  workflow_dispatch:
+    inputs:
+      override_container_image:
+        description: Override container image
+        type: string
+        required: false
+  pull_request:
+
+permissions: {}
+
+jobs:
+  prepare:
+    name: Prepare
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Use custom container image if specified
+        if: ${{ github.event.inputs.override_container_image != '' }}
+        run:
+          echo "inner_container_image=${{ github.event.inputs.override_container_image }}"
+          >> $GITHUB_ENV
+
+      - name: Use default container image and resolve digest
+        if: ${{ github.event.inputs.override_container_image == '' }}
+        run: |
+          echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
+    outputs:
+      container_image: ${{ env.inner_container_image }}
+
+  build-app:
+    name: Build app (multiple)
+    needs: prepare
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ needs.prepare.outputs.container_image }}
+    strategy:
+      fail-fast: false
+      matrix:
+        attempt:
+          [
+            1,
+            2,
+            3,
+            4,
+            5,
+            6,
+            7,
+            8,
+            9,
+            10,
+            11,
+            12,
+            13,
+            14,
+            15,
+            16,
+            17,
+            18,
+            19,
+            20,
+            21,
+            22,
+            23,
+            24,
+            25,
+            26,
+            27,
+            28,
+            29,
+            30,
+            31,
+            32,
+            33,
+            34,
+            35,
+            36,
+            37,
+            38,
+            39,
+            40,
+            41,
+            42,
+            43,
+            44,
+            45,
+            46,
+            47,
+            48,
+            49,
+            50,
+            51,
+            52,
+            53,
+            54,
+            55,
+            56,
+            57,
+            58,
+            59,
+            60,
+            61,
+            62,
+            63,
+            64,
+            65,
+            66,
+            67,
+            68,
+            69,
+            70,
+            71,
+            72,
+            73,
+            74,
+            75,
+            76,
+            77,
+            78,
+            79,
+            80,
+            81,
+            82,
+            83,
+            84,
+            85,
+            86,
+            87,
+            88,
+            89,
+            90,
+            91,
+            92,
+            93,
+            94,
+            95,
+            96,
+            97,
+            98,
+            99,
+           100,
+          ]
+    steps:
+      # Fix for HOME path overridden by GH runners when building in containers, see:
+      # https://github.com/actions/runner/issues/863
+      - name: Fix HOME path
+        run: echo "HOME=/root" >> $GITHUB_ENV
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Checkout wireguard-go-rs recursively
+        run: |
+          git config --global --add safe.directory '*'
+          git submodule update --init --recursive --depth=1 wireguard-go-rs
+
+      - name: Run build script
+        shell: bash
+        run: ./build-apk.sh --dev-build
diff --git a/.github/workflows/android-app-wrapper.yml b/.github/workflows/android-app-wrapper.yml
new file mode 100644
index 000000000000..f86179547461
--- /dev/null
+++ b/.github/workflows/android-app-wrapper.yml
@@ -0,0 +1,32 @@
+---
+name: Android - Wrapper build
+on:
+  workflow_dispatch:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  build-app:
+    name: Build app (using wrapper)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Checkout wireguard-go-rs recursively
+        run: |
+          git config --global --add safe.directory '*'
+          git submodule update --init --recursive --depth=1 wireguard-go-rs
+
+      - name: Install podman
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install podman
+
+      - name: Run build script
+        shell: bash
+        run: ./building/containerized-build.sh android --dev-build
diff --git a/build-apk.sh b/build-apk.sh
index 190e4e1f2ab2..d0ca1bd0c044 100755
--- a/build-apk.sh
+++ b/build-apk.sh
@@ -77,7 +77,9 @@ mkdir -p "app/build/extraAssets"
 mkdir -p "app/build/extraJni"
 popd
 
-for ARCHITECTURE in ${ARCHITECTURES:-aarch64 armv7 x86_64 i686}; do
+#cargo install --force cbindgen
+
+for ARCHITECTURE in ${ARCHITECTURES:-x86_64}; do
     case "$ARCHITECTURE" in
         "x86_64")
             TARGET="x86_64-linux-android"
@@ -111,6 +113,10 @@ for ARCHITECTURE in ${ARCHITECTURES:-aarch64 armv7 x86_64 i686}; do
     fi
 done
 
+echo "DAEMON BUILT!"
+
+exit 0
+
 echo "Updating relays.json..."
 cargo run --bin relay_list "${CARGO_ARGS[@]}" > android/app/build/extraAssets/relays.json
 
diff --git a/building/container-run.sh b/building/container-run.sh
index 639c71133286..a18aa0ddb9ab 100755
--- a/building/container-run.sh
+++ b/building/container-run.sh
@@ -55,8 +55,4 @@ fi
 set -x
 exec "$CONTAINER_RUNNER" run --rm -it \
     -v "$REPO_DIR:$REPO_MOUNT_TARGET:Z" \
-    -v "$CARGO_TARGET_VOLUME_NAME:/cargo-target:Z" \
-    -v "$CARGO_REGISTRY_VOLUME_NAME:/root/.cargo/registry:Z" \
-    "${optional_gradle_cache_volume[@]}" \
-    "${optional_android_credentials_volume[@]}" \
     "$container_image_name" bash -c "$optional_mold $*"
diff --git a/mullvad-daemon/build.rs b/mullvad-daemon/build.rs
index f89394a688b6..1310450aa919 100644
--- a/mullvad-daemon/build.rs
+++ b/mullvad-daemon/build.rs
@@ -29,13 +29,10 @@ fn main() {
         }
         res.compile().expect("Unable to generate windows resources");
     }
-    let target_os = std::env::var("CARGO_CFG_TARGET_OS").expect("CARGO_CFG_TARGET_OS not set");
 
-    // Enable DAITA by default on desktop
+    // Enable DAITA by default on desktop and android
     println!("cargo::rustc-check-cfg=cfg(daita)");
-    if let "linux" | "windows" | "macos" = target_os.as_str() {
-        println!(r#"cargo::rustc-cfg=daita"#);
-    }
+    println!(r#"cargo::rustc-cfg=daita"#);
 }
 
 fn commit_date() -> String {
diff --git a/mullvad-management-interface/build.rs b/mullvad-management-interface/build.rs
index 569d3379cc78..09f8601a83e3 100644
--- a/mullvad-management-interface/build.rs
+++ b/mullvad-management-interface/build.rs
@@ -1,11 +1,7 @@
 fn main() {
     tonic_build::compile_protos("proto/management_interface.proto").unwrap();
 
-    let target_os = std::env::var("CARGO_CFG_TARGET_OS").expect("CARGO_CFG_TARGET_OS not set");
-
-    // Enable DAITA by default on desktop
+    // Enable DAITA by default on desktop and android
     println!("cargo::rustc-check-cfg=cfg(daita)");
-    if let "linux" | "windows" | "macos" = target_os.as_str() {
-        println!(r#"cargo::rustc-cfg=daita"#);
-    }
+    println!(r#"cargo::rustc-cfg=daita"#);
 }
diff --git a/mullvad-management-interface/src/client.rs b/mullvad-management-interface/src/client.rs
index b0876093fa2a..3b2cabc33ea7 100644
--- a/mullvad-management-interface/src/client.rs
+++ b/mullvad-management-interface/src/client.rs
@@ -3,7 +3,7 @@
 use crate::types;
 #[cfg(not(target_os = "android"))]
 use futures::{Stream, StreamExt};
-#[cfg(daita)]
+#[cfg(all(daita, not(target_os = "android")))]
 use mullvad_types::wireguard::DaitaSettings;
 use mullvad_types::{
     access_method::AccessMethodSetting,
diff --git a/mullvad-relay-selector/build.rs b/mullvad-relay-selector/build.rs
index 678311e004e4..810204ba1032 100644
--- a/mullvad-relay-selector/build.rs
+++ b/mullvad-relay-selector/build.rs
@@ -1,9 +1,5 @@
 fn main() {
-    let target_os = std::env::var("CARGO_CFG_TARGET_OS").expect("CARGO_CFG_TARGET_OS not set");
-
-    // Enable DAITA by default on desktop
+    // Enable DAITA by default on desktop and android
     println!("cargo::rustc-check-cfg=cfg(daita)");
-    if let "linux" | "windows" | "macos" = target_os.as_str() {
-        println!(r#"cargo::rustc-cfg=daita"#);
-    }
+    println!(r#"cargo::rustc-cfg=daita"#);
 }
diff --git a/mullvad-types/build.rs b/mullvad-types/build.rs
index 678311e004e4..810204ba1032 100644
--- a/mullvad-types/build.rs
+++ b/mullvad-types/build.rs
@@ -1,9 +1,5 @@
 fn main() {
-    let target_os = std::env::var("CARGO_CFG_TARGET_OS").expect("CARGO_CFG_TARGET_OS not set");
-
-    // Enable DAITA by default on desktop
+    // Enable DAITA by default on desktop and android
     println!("cargo::rustc-check-cfg=cfg(daita)");
-    if let "linux" | "windows" | "macos" = target_os.as_str() {
-        println!(r#"cargo::rustc-cfg=daita"#);
-    }
+    println!(r#"cargo::rustc-cfg=daita"#);
 }
diff --git a/talpid-types/build.rs b/talpid-types/build.rs
index 678311e004e4..810204ba1032 100644
--- a/talpid-types/build.rs
+++ b/talpid-types/build.rs
@@ -1,9 +1,5 @@
 fn main() {
-    let target_os = std::env::var("CARGO_CFG_TARGET_OS").expect("CARGO_CFG_TARGET_OS not set");
-
-    // Enable DAITA by default on desktop
+    // Enable DAITA by default on desktop and android
     println!("cargo::rustc-check-cfg=cfg(daita)");
-    if let "linux" | "windows" | "macos" = target_os.as_str() {
-        println!(r#"cargo::rustc-cfg=daita"#);
-    }
+    println!(r#"cargo::rustc-cfg=daita"#);
 }
diff --git a/talpid-wireguard/build.rs b/talpid-wireguard/build.rs
index 1eb322606160..7d38f75118d2 100644
--- a/talpid-wireguard/build.rs
+++ b/talpid-wireguard/build.rs
@@ -14,11 +14,9 @@ fn add_wireguard_go_cfg(target_os: &str) {
         println!("cargo::rustc-cfg=wireguard_go");
     }
 
-    // Enable DAITA by default on desktop
+    // Enable DAITA by default on desktop and android
     println!("cargo::rustc-check-cfg=cfg(daita)");
-    if matches!(target_os, "linux" | "macos" | "windows") {
-        println!(r#"cargo::rustc-cfg=daita"#);
-    }
+    println!(r#"cargo::rustc-cfg=daita"#);
 }
 
 fn declare_libs_dir(base: &str) {
diff --git a/wireguard-go-rs/Cargo.toml b/wireguard-go-rs/Cargo.toml
index 062c80de34d2..e8a97ad12b0e 100644
--- a/wireguard-go-rs/Cargo.toml
+++ b/wireguard-go-rs/Cargo.toml
@@ -12,7 +12,7 @@ thiserror.workspace = true
 log.workspace = true
 zeroize = "1.8.1"
 
-[target.'cfg(any(target_os = "linux", target_os = "macos"))'.dependencies]
+[target.'cfg(not(target_os = "windows"))'.dependencies]
 # The app does not depend on maybenot-ffi itself, but adds it as a dependency to expose FFI symbols to wireguard-go.
 # This is done, instead of using the makefile in wireguard-go to build maybenot-ffi into its archive, to prevent
 # name clashes induced by link-time optimization.
diff --git a/wireguard-go-rs/build.rs b/wireguard-go-rs/build.rs
index da981770d0bf..5c7feebb6bf9 100644
--- a/wireguard-go-rs/build.rs
+++ b/wireguard-go-rs/build.rs
@@ -20,7 +20,7 @@ fn main() -> anyhow::Result<()> {
     match target_os.as_str() {
         "linux" => build_static_lib(Os::Linux, true)?,
         "macos" => build_static_lib(Os::MacOs, true)?,
-        "android" => build_android_dynamic_lib(false)?,
+        "android" => build_android_dynamic_lib(true)?,
         // building wireguard-go-rs for windows is not implemented
         _ => {}
     }
@@ -192,7 +192,12 @@ fn build_android_dynamic_lib(daita: bool) -> anyhow::Result<()> {
         .env("ANDROID_ARCH_NAME", android_arch_name(target))
         .env("GOPATH", &go_path)
         // Note: -w -s results in a stripped binary
-        .env("LDFLAGS", format!("-L{out_dir} -w -s"));
+        .env("LDFLAGS", format!("-L{out_dir} -w -s"))
+        // Note: the build container overrides CARGO_TARGET_DIR, which will cause problems
+        // since we will spawn another cargo process as part of building maybenot (which we
+        // link into libwg). A work around is to simply override the overridden value, and we
+        // do this by pointing to a target folder in our temporary build folder.
+        .env("CARGO_TARGET_DIR", tmp_build_dir.join("target"));
 
     exec(build_command)?;
 
diff --git a/wireguard-go-rs/libwg/Android.mk b/wireguard-go-rs/libwg/Android.mk
index 9cb87b24717b..f847aa66d276 100644
--- a/wireguard-go-rs/libwg/Android.mk
+++ b/wireguard-go-rs/libwg/Android.mk
@@ -29,11 +29,15 @@ GOBUILDVERSION := 1.21.3
 GOBUILDTARBALL := https://go.dev/dl/go$(GOBUILDVERSION).$(GOBUILDOS)-$(GOBUILDARCH).tar.gz
 GOBUILDVERSION_NEEDED := go version go$(GOBUILDVERSION) $(GOBUILDOS)/$(GOBUILDARCH)
 
+
 $(DESTDIR)/libwg.so:
 	mkdir -p $(DESTDIR)
-	go get -tags "linux android"
+	# Build libmaybenot
+	make --directory wireguard-go libmaybenot.a LIBDEST="$(DESTDIR)" TARGET="$(TARGET)" CARGO_TARGET_DIR="$(CARGO_TARGET_DIR)"
+	# Build wireguard-go
+	go get -tags "linux android daita"
 	chmod -fR +w "$(GOPATH)/pkg/mod"
-	go build -tags "linux android" -ldflags="-X main.socketDirectory=/data/data/$(ANDROID_PACKAGE_NAME)/cache/wireguard" -v -o "$@" -buildmode c-shared
+	go build -tags "linux android daita" -ldflags="-X main.socketDirectory=/data/data/$(ANDROID_PACKAGE_NAME)/cache/wireguard" -v -o "$@" -buildmode c-shared
 	rm -f $(DESTDIR)/libwg.h
 
 
diff --git a/wireguard-go-rs/libwg/wireguard-go b/wireguard-go-rs/libwg/wireguard-go
index de174ac6de29..5252ded45e00 160000
--- a/wireguard-go-rs/libwg/wireguard-go
+++ b/wireguard-go-rs/libwg/wireguard-go
@@ -1 +1 @@
-Subproject commit de174ac6de2934dc82d9b8301c17de87cbd575f3
+Subproject commit 5252ded45e00db704e83f5c749620fbe7b87fd50