diff --git a/.forgejo/workflows/android.yml b/.forgejo/workflows/android.yml
index 72e3e8f..a8eed46 100644
--- a/.forgejo/workflows/android.yml
+++ b/.forgejo/workflows/android.yml
@@ -169,6 +169,16 @@ jobs:
       - name: Build the native library and bindings
         run: ./gradlew generateUniffiBindings -PINKWELL_CARGO_PROFILE=${{ steps.build.outputs.profile }}
 
+      # The core ships inside this APK (through android/ffi), so its checks have to
+      # gate the APK HERE, in this workflow's graph. desktop.yml runs them too, but a
+      # red run there cannot stop this lane publishing (rule 177, #5237). Host
+      # target: the crates' own tests, not the cross-compiled .so.
+      - name: Rust clippy and tests (core and FFI)
+        working-directory: .
+        run: |
+          cargo clippy --locked -p inkwell-core -p inkwell-ffi --all-targets -- -D warnings
+          cargo test --locked -p inkwell-core -p inkwell-ffi
+
       # The image's PINNED CLIs, not Gradle plugins. ci-rust-android carries both
       # (M12 step 3) precisely so this lane needs no second image, and going
       # through Gradle plugins would mean a second version of each tool resolved
@@ -185,8 +195,8 @@ jobs:
       - name: Unit tests
         # Host-JVM tests only. Anything touching the core needs an Android
         # runtime to load the .so, so those are instrumented tests and belong on
-        # an emulator, not here — the Rust side is covered by the workspace
-        # tests in the desktop lane.
+        # an emulator, not here — the Rust side is covered by the cargo step
+        # above.
         #
         # DEBUG regardless of what is being packaged: AGP creates unit-test tasks
         # only for `testBuildType`, which is debug, so `testReleaseUnitTest` does