diff --git a/stacks/android-emulator/docker/Dockerfile b/stacks/android-emulator/docker/Dockerfile
index ef08b245..1de82e9a 100644
--- a/stacks/android-emulator/docker/Dockerfile
+++ b/stacks/android-emulator/docker/Dockerfile
@@ -4,8 +4,8 @@
 # cmdline-tools and the native libraries the emulator needs at runtime.
 #
 # Rebuild + push (rare — only when tool/library versions bump):
-#   docker build -t forgejo.viktorbarzin.me/viktor/android-emulator:api36-v5 .
-#   docker push forgejo.viktorbarzin.me/viktor/android-emulator:api36-v5
+#   docker build -t forgejo.viktorbarzin.me/viktor/android-emulator:api36-v6 .
+#   docker push forgejo.viktorbarzin.me/viktor/android-emulator:api36-v6
 FROM eclipse-temurin:17-jdk-jammy
 
 ENV DEBIAN_FRONTEND=noninteractive
diff --git a/stacks/android-emulator/docker/entrypoint.sh b/stacks/android-emulator/docker/entrypoint.sh
index ff2638f2..511d9bb0 100644
--- a/stacks/android-emulator/docker/entrypoint.sh
+++ b/stacks/android-emulator/docker/entrypoint.sh
@@ -4,6 +4,11 @@
 # emulator windowed into it, and expose its adbd on :5555 for the LAN.
 set -euo pipefail
 
+# Containerd grants an effectively unbounded RLIMIT_NOFILE (2^31); x11vnc's
+# connection handling sweeps the whole fd table with fcntl per fd, so every
+# VNC connect hung for ages. Cap it for everything we launch.
+ulimit -n 65536
+
 API_LEVEL="${API_LEVEL:-36}"
 SYSTEM_IMAGE="system-images;android-${API_LEVEL};google_apis;x86_64"
 # Pinned emulator build (36.1.9). The sdkmanager-latest emulator (36.6.11)
@@ -79,7 +84,7 @@ export DISPLAY=:0
 Xvfb :0 -screen 0 "$SCREEN_GEOMETRY" -nolisten tcp &
 sleep 1
 openbox &
-x11vnc -display :0 -nopw -forever -shared -quiet -bg
+x11vnc -display :0 -nopw -forever -shared -quiet -nolookup -bg
 websockify --web /usr/share/novnc 6080 localhost:5900 &
 
 # --- emulator -----------------------------------------------------------------
diff --git a/stacks/android-emulator/variables.tf b/stacks/android-emulator/variables.tf
index bf9062d5..230384ca 100644
--- a/stacks/android-emulator/variables.tf
+++ b/stacks/android-emulator/variables.tf
@@ -5,6 +5,6 @@ variable "tls_secret_name" {
 
 variable "image_tag" {
   type        = string
-  default     = "api36-v5"
+  default     = "api36-v6"
   description = "android-emulator image tag at forgejo.viktorbarzin.me/viktor/android-emulator. Built + pushed manually from stacks/android-emulator/docker/ (see README.md) — bump this when the image is rebuilt."
 }