diff --git a/stacks/android-emulator/docker/Dockerfile b/stacks/android-emulator/docker/Dockerfile
index cb3912ea..c8542e22 100644
--- a/stacks/android-emulator/docker/Dockerfile
+++ b/stacks/android-emulator/docker/Dockerfile
@@ -4,8 +4,8 @@
 # cmdline-tools and the native libraries the emulator needs at runtime.
 #
 # Rebuild + push (rare — only when tool/library versions bump):
-#   docker build -t forgejo.viktorbarzin.me/viktor/android-emulator:api36-v3 .
-#   docker push forgejo.viktorbarzin.me/viktor/android-emulator:api36-v3
+#   docker build -t forgejo.viktorbarzin.me/viktor/android-emulator:api36-v4 .
+#   docker push forgejo.viktorbarzin.me/viktor/android-emulator:api36-v4
 FROM eclipse-temurin:17-jdk-jammy
 
 ENV DEBIAN_FRONTEND=noninteractive
diff --git a/stacks/android-emulator/docker/entrypoint.sh b/stacks/android-emulator/docker/entrypoint.sh
index 3c4e3b57..530f758b 100644
--- a/stacks/android-emulator/docker/entrypoint.sh
+++ b/stacks/android-emulator/docker/entrypoint.sh
@@ -6,6 +6,11 @@ set -euo pipefail
 
 API_LEVEL="${API_LEVEL:-36}"
 SYSTEM_IMAGE="system-images;android-${API_LEVEL};google_apis;x86_64"
+# Pinned emulator build (36.1.9). The sdkmanager-latest emulator (36.6.11)
+# hangs before executing a single guest instruction in this pod (KVM and TCG
+# alike, all gpu modes) — debugged 2026-06-11; 36.1.9 boots fine. Bump only
+# after verifying a newer build actually boots here.
+EMULATOR_BUILD="${EMULATOR_BUILD:-13823996}"
 AVD_NAME="${AVD_NAME:-lab}"
 EMULATOR_RAM_MB="${EMULATOR_RAM_MB:-4096}"
 SCREEN_GEOMETRY="${SCREEN_GEOMETRY:-1080x2280x24}"
@@ -39,6 +44,16 @@ if [ ! -f "$MARKER" ]; then
   touch "$MARKER"
 fi
 
+# --- pin the emulator build (replaces whatever sdkmanager installed) ---------
+if [ ! -f "/sdk/.emulator-pinned-${EMULATOR_BUILD}" ]; then
+  echo "Pinning emulator build ${EMULATOR_BUILD}..."
+  wget -q "https://dl.google.com/android/repository/emulator-linux_x64-${EMULATOR_BUILD}.zip" -O /sdk/emu.zip
+  rm -rf /sdk/emulator
+  unzip -qo /sdk/emu.zip -d /sdk && rm -f /sdk/emu.zip
+  rm -f /sdk/.emulator-pinned-*
+  touch "/sdk/.emulator-pinned-${EMULATOR_BUILD}"
+fi
+
 # --- AVD (idempotent) --------------------------------------------------------
 # avdmanager IGNORES ANDROID_SDK_ROOT (and has no --sdk_root): it derives the
 # SDK root from its own toolsdir. Run it from a copy of cmdline-tools seeded
@@ -83,8 +98,11 @@ done
 echo "Boot completed."
 
 # Expose the emulator's adbd (localhost:5555) to the pod network. Plain TCP,
-# no auth — reachable only inside the LAN via the MetalLB IP.
-socat TCP-LISTEN:5555,fork,reuseaddr TCP:127.0.0.1:5555 &
+# no auth — reachable only inside the LAN via the MetalLB IP. Bind to the pod
+# IP only: the emulator itself already listens on 127.0.0.1:5555, so a
+# wildcard bind fails with EADDRINUSE.
+POD_IP=$(hostname -i | awk '{print $1}')
+socat "TCP-LISTEN:5555,bind=${POD_IP},fork,reuseaddr" TCP:127.0.0.1:5555 &
 
 # Supervise: if any background process dies, exit so the pod restarts.
 wait -n
diff --git a/stacks/android-emulator/variables.tf b/stacks/android-emulator/variables.tf
index 00832bca..efd8841f 100644
--- a/stacks/android-emulator/variables.tf
+++ b/stacks/android-emulator/variables.tf
@@ -5,6 +5,6 @@ variable "tls_secret_name" {
 
 variable "image_tag" {
   type        = string
-  default     = "api36-v3"
+  default     = "api36-v4"
   description = "android-emulator image tag at forgejo.viktorbarzin.me/viktor/android-emulator. Built + pushed manually from stacks/android-emulator/docker/ (see README.md) — bump this when the image is rebuilt."
 }