diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 90150d3a..04f9f636 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,7 +18,7 @@ jobs:
     name: Build aw-server-rust
     runs-on: ubicloud-standard-8
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         submodules: 'recursive'
     - name: Set RELEASE
@@ -26,7 +26,7 @@ jobs:
         echo "RELEASE=${{ startsWith(github.ref_name, 'v') }}" >> $GITHUB_ENV
 
     - name: Cache JNI libs
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       id: cache-jniLibs
       env:
         cache-name: jniLibs
@@ -42,7 +42,7 @@ jobs:
     # Android SDK & NDK
     - name: Set up Android SDK
       if: steps.cache-jniLibs.outputs.cache-hit != 'true'
-      uses: android-actions/setup-android@v2
+      uses: android-actions/setup-android@v3
     - name: Set up Android NDK
       if: steps.cache-jniLibs.outputs.cache-hit != 'true'
       run: |
@@ -54,7 +54,9 @@ jobs:
     # Rust
     - name: Set up Rust
       id: toolchain
-      uses: dtolnay/rust-toolchain@stable
+      # Pin to 1.79.0: aw-server-rust@dc70318 uses `time` crate which fails to compile
+      # on Rust 1.80+ due to tightened type inference (E0282 in Box<_> expressions).
+      uses: dtolnay/rust-toolchain@1.79.0
       if: steps.cache-jniLibs.outputs.cache-hit != 'true'
 
     - name: Set up Rust toolchain for Android NDK
@@ -63,7 +65,7 @@ jobs:
         ./aw-server-rust/install-ndk.sh
 
     - name: Cache cargo build
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       if: steps.cache-jniLibs.outputs.cache-hit != 'true'
       env:
         cache-name: cargo-build-target
@@ -94,21 +96,23 @@ jobs:
       versionCode: ${{ steps.versionCode.outputs.versionCode }}
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         submodules: 'recursive'
 
 
-    # Ruby & Fastlane
-    # version set by .ruby-version
+    # Ruby & Fastlane steps only run on the main repo (not fork PRs, which lack secrets).
+    # Fork PRs fall through to "Output versionCode" which reads directly from build.gradle.
     - name: Set up Ruby and install fastlane
+      if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
       uses: ruby/setup-ruby@v1
       with:
         bundler-cache: true
 
-    # Needed for `fastlane update_version`
     - uses: adnsio/setup-age-action@v1.2.0
+      if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     - name: Load Fastlane secrets
+      if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
       env:
         KEY_FASTLANE_API: ${{ secrets.KEY_FASTLANE_API }}
       run: |
@@ -121,12 +125,16 @@ jobs:
     # Retry this, in case there are concurrent jobs, which may lead to the error:
     #   "Google Api Error: Invalid request - This Edit has been deleted."
     - name: Update versionCode
+      if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
       uses: Wandalen/wretry.action@master
       with:
         command: bundle exec fastlane update_version
         attempt_limit: 3
         attempt_delay: 20000
 
+    # Always reads versionCode from build.gradle.
+    # On non-fork runs, fastlane has already incremented it above.
+    # On fork PRs, this returns the current committed value as a safe fallback.
     - name: Output versionCode
       id: versionCode
       run: |
@@ -136,13 +144,15 @@ jobs:
     name: Build ${{ matrix.type }}
     runs-on: ubicloud-standard-4
     needs: [build-rust, get-versionCode]
+    # Skip on fork PRs: signing secrets are not available and upload would fail anyway.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     strategy:
       fail-fast: true
       matrix:
         type: ['apk', 'aab']
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         submodules: 'recursive'
 
@@ -161,13 +171,14 @@ jobs:
         echo "RELEASE=${{ startsWith(github.ref_name, 'v') }}" >> $GITHUB_ENV
 
     - name: Set up JDK
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@v4
       with:
+        distribution: 'temurin'
         java-version: ${{ env.JAVA_VERSION }}
 
     # Android SDK & NDK
     - name: Set up Android SDK
-      uses: android-actions/setup-android@v2
+      uses: android-actions/setup-android@v3
     - name: Set up Android NDK
       run: |
         sdkmanager "ndk;${{ env.NDK_VERSION }}"
@@ -177,7 +188,7 @@ jobs:
 
     # Restores jniLibs from cache
     # `actions/cache/restore` only restores, without saving back in a post-hook
-    - uses: actions/cache/restore@v3
+    - uses: actions/cache/restore@v4
       id: cache-jniLibs
       env:
         cache-name: jniLibs
@@ -222,35 +233,36 @@ jobs:
         make dist/aw-android.${{ matrix.type }}
 
     - name: Upload
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: aw-android
         path: dist/aw-android*.${{ matrix.type }}
 
   test:
     name: Test
-    runs-on: ubuntu-22.04
+    runs-on: ubicloud-standard-4
     needs: [build-rust]
     env:
       SUPPLY_TRACK: production   # used by fastlane to determine track to publish to
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
-        submodules: 'recursive'
+        submodules: 'true'  # non-recursive: aw-webui (nested) isn't needed for unit tests; recursive fails auth on fork PRs
 
     - name: Set RELEASE
       run: |
         echo "RELEASE=${{ startsWith(github.ref_name, 'v') }}" >> $GITHUB_ENV
 
     - name: Set up JDK
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@v4
       with:
+        distribution: 'temurin'
         java-version: ${{ env.JAVA_VERSION }}
 
     # Android SDK & NDK
     - name: Set up Android SDK
-      uses: android-actions/setup-android@v2
+      uses: android-actions/setup-android@v3
     - name: Set up Android NDK
       run: |
         sdkmanager "ndk;${{ env.NDK_VERSION }}"
@@ -261,7 +273,7 @@ jobs:
 
     # Restores jniLibs from cache
     # `actions/cache/restore` only restores, without saving back in a post-hook
-    - uses: actions/cache/restore@v3
+    - uses: actions/cache/restore@v4
       id: cache-jniLibs
       env:
         cache-name: jniLibs
@@ -282,7 +294,7 @@ jobs:
   test-e2e:
     name: Test E2E
     needs: [build-rust]
-    #if: false  # disabled
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     #runs-on: "macos-12"  # macOS-latest
     runs-on: ubicloud-standard-8
     env:
@@ -301,9 +313,9 @@ jobs:
           #   android_emu_version: 32
     steps:
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
-        submodules: 'recursive'
+        submodules: 'true'  # non-recursive: aw-webui (nested inside aw-server-rust) isn't needed for E2E; recursive fails auth on fork PRs
 
     - name: Set RELEASE
       run: |
@@ -311,7 +323,7 @@ jobs:
 
     # Restores jniLibs from cache
     # `actions/cache/restore` only restores, without saving back in a post-hook
-    - uses: actions/cache/restore@v3
+    - uses: actions/cache/restore@v4
       id: cache-jniLibs
       env:
         cache-name: jniLibs
@@ -328,16 +340,61 @@ jobs:
       if: runner.os == 'macOS'
       run: brew install intel-haxm
 
+    - name: Enable KVM group perms
+      if: runner.os == 'Linux'
+      run: |
+        echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+        sudo udevadm control --reload-rules
+        sudo udevadm trigger --name-match=kvm
+
+    - name: Set up Android SDK
+      uses: android-actions/setup-android@v3
+
     # # # Below code is majorly from https://github.com/actions/runner-images/issues/6152#issuecomment-1243718140
     - name: Create Android emulator
       run: |
-        # Install AVD files
-        echo "y" | $ANDROID_HOME/tools/bin/sdkmanager --install 'system-images;android-'$MATRIX_E_SDK';default;x86_64'
-        echo "y" | $ANDROID_HOME/tools/bin/sdkmanager --licenses
+        find_android_tool() {
+          local tool_path="$1"
+          local tool_name="$2"
+
+          if [ -x "$tool_path" ]; then
+            printf '%s\n' "$tool_path"
+            return 0
+          fi
+
+          if command -v "$tool_name" >/dev/null 2>&1; then
+            command -v "$tool_name"
+            return 0
+          fi
+
+          echo "Missing required Android tool: $tool_name" >&2
+          return 1
+        }
+
+        SDKMANAGER="$(find_android_tool "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" sdkmanager)"
+        AVDMANAGER="$(find_android_tool "$ANDROID_HOME/cmdline-tools/latest/bin/avdmanager" avdmanager)"
 
-        # Create emulator
-        $ANDROID_HOME/tools/bin/avdmanager create avd -n $MATRIX_AVD -d pixel --package 'system-images;android-'$MATRIX_E_SDK';default;x86_64'
-        $ANDROID_HOME/emulator/emulator -list-avds
+        # Pin the AVD home so avdmanager and emulator agree on the path
+        mkdir -p "$HOME/.android/avd"
+        echo "ANDROID_AVD_HOME=$HOME/.android/avd" >> "$GITHUB_ENV"
+        export ANDROID_AVD_HOME="$HOME/.android/avd"
+
+        # Install AVD files
+        echo "y" | "$SDKMANAGER" --install \
+          emulator \
+          'system-images;android-'$MATRIX_E_SDK';default;x86_64'
+        echo "y" | "$SDKMANAGER" --licenses
+
+        # Resolve emulator path after installing the package.
+        EMULATOR="$(find_android_tool "$ANDROID_HOME/emulator/emulator" emulator)"
+
+        # Create emulator (pipe "no" to skip custom hardware profile prompt)
+        echo "no" | "$AVDMANAGER" create avd -n $MATRIX_AVD -d pixel --package 'system-images;android-'$MATRIX_E_SDK';default;x86_64' \
+          || { echo "::error::avdmanager create avd failed"; exit 1; }
+        echo "AVDs after creation:"
+        "$EMULATOR" -list-avds
+        "$EMULATOR" -list-avds | grep -q "^$MATRIX_AVD$" \
+          || { echo "::error::AVD $MATRIX_AVD not found after creation"; ls -la "$ANDROID_AVD_HOME/" 2>/dev/null || echo "avd dir missing"; exit 1; }
         if false; then
         emulator_config=~/.android/avd/$MATRIX_AVD.avd/config.ini
         # The following madness is to support empty OR populated config.ini files,
@@ -361,23 +418,47 @@ jobs:
         cat "$emulator_config"
         fi
 
+    - name: Install emulator runtime dependencies
+      if: runner.os == 'Linux'
+      run: sudo apt-get update -qq && sudo apt-get install -y libpulse0
+
     - name: Start Android emulator
       timeout-minutes: 30 # ~4min normal - 3x DOSafety
       env:
         SUFFIX: ${{ matrix.android_avd }}-eAPI-${{ matrix.android_emu_version }}
         HOMEBREW_NO_INSTALL_CLEANUP: 1
       run: |
+        EMULATOR="$ANDROID_HOME/emulator/emulator"
+        if [ ! -x "$EMULATOR" ]; then
+          EMULATOR="$(command -v emulator || true)"
+        fi
+        if [ -z "$EMULATOR" ]; then
+          echo "Missing required Android tool: emulator" >&2
+          exit 1
+        fi
+        ADB="$ANDROID_HOME/platform-tools/adb"
+        if [ ! -x "$ADB" ]; then
+          ADB="$(command -v adb || true)"
+        fi
+        if [ -z "$ADB" ]; then
+          echo "Missing required Android tool: adb" >&2
+          exit 1
+        fi
         echo "Starting emulator and waiting for boot to complete...."
-        ls -la $ANDROID_HOME/emulator
-        $ANDROID_HOME/tools/emulator --accel-check  # check for hardware acceleration
-        nohup $ANDROID_HOME/tools/emulator -avd $MATRIX_AVD -gpu host -no-audio -no-boot-anim -camera-back none -camera-front none -qemu -m 2048 2>&1 &
-        $ANDROID_HOME/platform-tools/adb wait-for-device shell 'while [[ -z $(getprop sys.boot_completed | tr -d '\r') ]]; do echo "wait..."; sleep 1; done; input keyevent 82'
+        ls -la "${EMULATOR%/*}"
+        if ! "$EMULATOR" -accel-check; then
+          echo "Hardware acceleration unavailable; continuing with emulator default acceleration mode."
+        fi
+        nohup "$EMULATOR" -avd $MATRIX_AVD -gpu host -no-audio -no-boot-anim -camera-back none -camera-front none -qemu -m 2048 2>&1 &
+        "$ADB" wait-for-device shell 'while [[ -z $(getprop sys.boot_completed | tr -d '\r') ]]; do echo "wait..."; sleep 1; done; input keyevent 82'
         echo "Emulator has finished booting"
-        $ANDROID_HOME/platform-tools/adb devices
+        "$ADB" devices
         sleep 30
         mkdir -p screenshots
-        screencapture screenshots/screenshot-$SUFFIX.jpg
-        $ANDROID_HOME/platform-tools/adb exec-out screencap -p > screenshots/emulator-$SUFFIX.png
+        if command -v screencapture >/dev/null 2>&1; then
+          screencapture screenshots/screenshot-$SUFFIX.jpg
+        fi
+        "$ADB" exec-out screencap -p > screenshots/emulator-$SUFFIX.png
 
     # # # Have to re-setup everything since we need to run emulator for faster performance on masOS ? Other os'es emulator will not startup ?
     # TODO: Optimize the steps taking into consideration all software present by default on macOS runner image
@@ -417,13 +498,14 @@ jobs:
     #     ffmpeg -f avfoundation -i 0 -t 120 out$SUFFIX.mov &
 
     - name: Set up JDK
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@v4
       with:
+        distribution: 'temurin'
         java-version: ${{ env.JAVA_VERSION }}
 
     # Android SDK & NDK
     - name: Set up Android SDK
-      uses: android-actions/setup-android@v2
+      uses: android-actions/setup-android@v3
     - name: Set up Android NDK
       run: |
         sdkmanager "ndk;${{ env.NDK_VERSION }}"
@@ -449,15 +531,26 @@ jobs:
       env:
         SUFFIX: ${{ matrix.android_avd }}-eAPI-${{ matrix.android_emu_version }}
       run: |
-        adb shell monkey -p net.activitywatch.android.debug 1
+        ADB="$ANDROID_HOME/platform-tools/adb"
+        if [ ! -x "$ADB" ]; then
+          ADB="$(command -v adb || true)"
+        fi
+        if [ -z "$ADB" ]; then
+          echo "Missing required Android tool: adb" >&2
+          exit 1
+        fi
+        "$ADB" shell monkey -p net.activitywatch.android.debug 1
         sleep 10
-        screencapture screenshots/pscreenshot-$SUFFIX.jpg
-        $ANDROID_HOME/platform-tools/adb exec-out screencap -p > screenshots/pemulator-$SUFFIX.png
+        mkdir -p screenshots
+        if command -v screencapture >/dev/null 2>&1; then
+          screencapture screenshots/pscreenshot-$SUFFIX.jpg
+        fi
+        "$ADB" exec-out screencap -p > screenshots/pemulator-$SUFFIX.png
         ls -alh screenshots/
 
     - name: Upload logcat
       if: ${{ success() || steps.test.conclusion == 'failure'}}
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: logcat
         # mobile\build\outputs\connected_android_test_additional_output\debugAndroidTest\connected\Pixel_XL_API_32(AVD) - 12\ScreenshotTest_saveDeviceScreenBitmap.png
@@ -473,7 +566,7 @@ jobs:
     #     path: ./*.mov # out.mov
 
     - name: Upload screenshots
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       if: ${{ success() || steps.test.conclusion == 'failure'}}
       with:
         name: screenshots
@@ -497,10 +590,10 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')  # only on runs triggered from tag
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
     - name: Download APK & AAB
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: aw-android
         path: dist
@@ -517,7 +610,7 @@ jobs:
         bundler-cache: true
 
     # detect if version tag is stable/beta
-    - uses: nowsprinting/check-version-format-action@v2
+    - uses: nowsprinting/check-version-format-action@v4
       id: version
       with:
         prefix: 'v'
@@ -556,7 +649,7 @@ jobs:
 
     # Will download all artifacts to path
     - name: Download release APK & AAB
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: aw-android
         path: dist
@@ -566,14 +659,14 @@ jobs:
       run: ls -R
 
     # detect if version tag is stable/beta
-    - uses: nowsprinting/check-version-format-action@v2
+    - uses: nowsprinting/check-version-format-action@v4
       id: version
       with:
         prefix: 'v'
 
     # create a release
     - name: Release
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@v2
       with:
         draft: true
         prerelease: ${{ !(steps.version.outputs.is_stable == 'true') }}  # must compare to true, since boolean outputs are actually just strings, and "false" is truthy since it's not empty: https://github.com/actions/runner/issues/1483#issuecomment-994986996
@@ -581,4 +674,3 @@ jobs:
           dist/*.apk
           dist/*.aab
         # body_path: dist/release_notes/release_notes.md
-