diff --git a/android/gradle/libs.versions.toml b/android/gradle/libs.versions.toml
index edeb7ef..fcbc46d 100644
--- a/android/gradle/libs.versions.toml
+++ b/android/gradle/libs.versions.toml
@@ -35,7 +35,10 @@ junit = "4.13.2"
 # Coil draws a link preview's image (Scribe #3307), the first image this client
 # loads. Coil 3 ships its networking separately; the OkHttp fetcher is the one its
 # docs name as the default, and it registers itself, so no loader is configured.
-coil = "3.6.3"
+# Held at 3.5.0: 3.6.0 moved to compileSdk 37 and Compose 1.12, which need AGP 9.1.
+# This project is on compileSdk 36 and AGP 9.0.1, so 3.6.x fails the AAR metadata
+# check. Move it up together with agp and compileSdk.
+coil = "3.5.0"
 
 [libraries]
 androidx-core-ktx = { module = "androidx.core:core-ktx", version = "1.13.1" }