diff --git a/.github/workflows/android-apk.yml b/.github/workflows/android-apk.yml
index 7fbe29d4f..977d07174 100644
--- a/.github/workflows/android-apk.yml
+++ b/.github/workflows/android-apk.yml
@@ -299,6 +299,10 @@ jobs:
         working-directory: openless-all/app
         run: node scripts/patch-android-shizuku-deps.mjs
 
+      - name: Patch rustls-platform-verifier (Core TLS on Android)
+        working-directory: openless-all/app
+        run: node scripts/patch-android-rustls-verifier.mjs
+
       - name: Merge updater / install manifest
         working-directory: openless-all/app
         run: node scripts/merge-android-updater-manifest.mjs
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4d3f9075c..0ed67ff51 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -247,6 +247,9 @@ jobs:
       - name: Patch Shizuku Gradle dependencies
         run: node scripts/patch-android-shizuku-deps.mjs
 
+      - name: Patch rustls-platform-verifier (Core TLS on Android)
+        run: node scripts/patch-android-rustls-verifier.mjs
+
       - name: Run JVM credential tests and compile instrumentation tests
         # These tests are Kotlin-only. The Rust target is checked above; direct Gradle
         # rustBuild requires the live Tauri CLI RPC server used by `tauri android build`.
diff --git a/openless-all/app/android/README.md b/openless-all/app/android/README.md
index 68f47f08b..918093c6f 100644
--- a/openless-all/app/android/README.md
+++ b/openless-all/app/android/README.md
@@ -39,6 +39,7 @@ Manifest 合并脚本：
 - [`scripts/merge-android-overlay-manifest.mjs`](../scripts/merge-android-overlay-manifest.mjs) — 悬浮窗 / 无障碍
 - [`scripts/merge-android-shizuku-manifest.mjs`](../scripts/merge-android-shizuku-manifest.mjs) — Shizuku Provider / 授权 Activity
 - [`scripts/patch-android-shizuku-deps.mjs`](../scripts/patch-android-shizuku-deps.mjs) — Shizuku Gradle 依赖
+- [`scripts/patch-android-rustls-verifier.mjs`](../scripts/patch-android-rustls-verifier.mjs) — rustls-platform-verifier（Core 的 HTTPS 证书校验）Gradle 依赖与 Manifest 调整
 
 ### Rime 拼音输入（Pinyin，可选模式）
 
@@ -88,6 +89,7 @@ node scripts/merge-android-v1-manifest.mjs
 node scripts/merge-android-overlay-manifest.mjs
 node scripts/merge-android-shizuku-manifest.mjs
 node scripts/patch-android-shizuku-deps.mjs
+node scripts/patch-android-rustls-verifier.mjs
 CI=true npm run tauri:android:build
 ```
 
@@ -103,6 +105,7 @@ node scripts/merge-android-v1-manifest.mjs
 node scripts/merge-android-overlay-manifest.mjs
 node scripts/merge-android-shizuku-manifest.mjs
 node scripts/patch-android-shizuku-deps.mjs
+node scripts/patch-android-rustls-verifier.mjs
 npm run tauri:android:build
 ```
 
diff --git a/openless-all/app/scripts/build-android-local.sh b/openless-all/app/scripts/build-android-local.sh
index f22a52992..6d4608e37 100644
--- a/openless-all/app/scripts/build-android-local.sh
+++ b/openless-all/app/scripts/build-android-local.sh
@@ -26,5 +26,6 @@ node scripts/merge-android-v1-manifest.mjs
 node scripts/merge-android-overlay-manifest.mjs
 node scripts/merge-android-shizuku-manifest.mjs
 node scripts/patch-android-shizuku-deps.mjs
+node scripts/patch-android-rustls-verifier.mjs
 node scripts/merge-android-updater-manifest.mjs
 npm run tauri:android:build:debug
diff --git a/openless-all/app/scripts/patch-android-rustls-verifier.mjs b/openless-all/app/scripts/patch-android-rustls-verifier.mjs
new file mode 100644
index 000000000..b55bd7042
--- /dev/null
+++ b/openless-all/app/scripts/patch-android-rustls-verifier.mjs
@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+// openless-core's reqwest 0.13 verifies TLS through rustls-platform-verifier.
+// On Android its Kotlin half (org.rustls:rustls-platform-verifier) must be in
+// the APK, and Rust must initialize it with the app Context
+// (src-tauri/src/android/tls_verifier.rs) — otherwise every Core HTTPS request
+// panics. This wires the Kotlin half into the generated Gradle project.
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import process from 'node:process';
+
+const appDir = fileURLToPath(new URL('../src-tauri/gen/android/app/', import.meta.url));
+const gradlePath = `${appDir}build.gradle.kts`;
+const manifestPath = `${appDir}src/main/AndroidManifest.xml`;
+const proguardPath = `${appDir}proguard-rustls-platform-verifier.pro`;
+
+export const GRADLE_MARKER = '// openless: rustls-platform-verifier';
+
+// The AAR version must equal the rustls-platform-verifier-android crate in
+// src-tauri/Cargo.lock, so Gradle reads it from there at configuration time.
+// A local Maven copy (OPENLESS_RUSTLS_MAVEN, or <cache root>/rustls-maven)
+// is preferred; the project's GitHub Maven archive is the fallback.
+export const GRADLE_SNIPPET = `
+${GRADLE_MARKER} (Kotlin half of Core's TLS verifier; see scripts/patch-android-rustls-verifier.mjs)
+val rustlsVerifierVersion: String = rootProject.file("../../Cargo.lock").readLines().let { lines ->
+    val start = lines.indexOfFirst { it.trim() == "name = \\"rustls-platform-verifier-android\\"" }
+    require(start >= 0) { "rustls-platform-verifier-android not found in src-tauri/Cargo.lock" }
+    lines.drop(start + 1).first { it.trimStart().startsWith("version = ") }
+        .substringAfter('"').substringBefore('"')
+}
+repositories {
+    val localMaven = file(
+        System.getenv("OPENLESS_RUSTLS_MAVEN")
+            ?: ((System.getenv("OPENLESS_CACHE_ROOT") ?: "/data-win/openless-cache") + "/rustls-maven"),
+    )
+    if (localMaven.isDirectory) maven { url = uri(localMaven) }
+    maven { url = uri("https://github.com/rustls/rustls-platform-verifier/raw/maven-archive/android-release-support/maven/") }
+}
+dependencies {
+    implementation("org.rustls:rustls-platform-verifier:$rustlsVerifierVersion")
+}
+`;
+
+export const PROGUARD_RULES = `# The Rust verifier finds these classes by name through JNI.
+-keep class org.rustls.platformverifier.** { *; }
+`;
+
+const TOOLS_NS = 'xmlns:tools="http://schemas.android.com/tools"';
+export const REMOVE_ATTRIBUTE = 'tools:remove="android:networkSecurityConfig"';
+
+export function patchGradle(content) {
+  if (content.includes(GRADLE_MARKER)) return { content, changed: false };
+  return { content: `${content.trimEnd()}\n${GRADLE_SNIPPET}`, changed: true };
+}
+
+// The AAR's manifest sets a networkSecurityConfig that forbids cleartext
+// traffic, which would silently override the app's usesCleartextTraffic.
+// Its revocation checks are soft-fail, so dropping it keeps TLS working.
+export function patchManifest(content) {
+  let updated = content;
+  if (!/<manifest\b[^>]*xmlns:tools=/.test(updated)) {
+    updated = updated.replace(/<manifest\b/, `<manifest ${TOOLS_NS}`);
+  }
+  if (!updated.includes(REMOVE_ATTRIBUTE)) {
+    const application = /<application\b/.exec(updated);
+    if (!application) throw new Error('application element not found in AndroidManifest.xml');
+    updated = updated.replace(/<application\b/, `<application ${REMOVE_ATTRIBUTE}`);
+  }
+  return { content: updated, changed: updated !== content };
+}
+
+function main() {
+  const dryRun = process.argv.includes('--dry-run');
+  for (const path of [gradlePath, manifestPath]) {
+    if (!existsSync(path)) {
+      throw new Error(`Generated Android file not found: ${path}\nRun "npm run tauri -- android init --ci" first.`);
+    }
+  }
+  const results = [
+    [gradlePath, patchGradle(readFileSync(gradlePath, 'utf8'))],
+    [manifestPath, patchManifest(readFileSync(manifestPath, 'utf8'))],
+    [proguardPath, {
+      content: PROGUARD_RULES,
+      changed: !existsSync(proguardPath) || readFileSync(proguardPath, 'utf8') !== PROGUARD_RULES,
+    }],
+  ];
+  for (const [path, result] of results) {
+    if (!result.changed) {
+      console.log(`rustls-platform-verifier already wired in ${path}; skipping.`);
+    } else if (dryRun) {
+      console.log(`[dry-run] Would patch ${path}`);
+    } else {
+      writeFileSync(path, result.content, 'utf8');
+      console.log(`Patched rustls-platform-verifier into ${path}`);
+    }
+  }
+}
+
+const isDirectRun = Boolean(
+  process.argv[1]?.replace(/\\/g, '/').endsWith('patch-android-rustls-verifier.mjs'),
+);
+if (isDirectRun) {
+  try {
+    main();
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+  }
+}
diff --git a/openless-all/app/scripts/patch-android-rustls-verifier.test.mjs b/openless-all/app/scripts/patch-android-rustls-verifier.test.mjs
new file mode 100644
index 000000000..9ee13989f
--- /dev/null
+++ b/openless-all/app/scripts/patch-android-rustls-verifier.test.mjs
@@ -0,0 +1,59 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import {
+  GRADLE_MARKER,
+  REMOVE_ATTRIBUTE,
+  patchGradle,
+  patchManifest,
+} from './patch-android-rustls-verifier.mjs';
+
+const gradle = 'android {\n}\ndependencies {\n    implementation("androidx.webkit:webkit:1.14.0")\n}\n';
+const patchedGradle = patchGradle(gradle);
+assert.equal(patchedGradle.changed, true);
+assert.match(patchedGradle.content, /implementation\("org\.rustls:rustls-platform-verifier:\$rustlsVerifierVersion"\)/);
+// The AAR version comes from the same Cargo.lock the Rust verifier is resolved from.
+assert.match(patchedGradle.content, /rootProject\.file\("\.\.\/\.\.\/Cargo\.lock"\)/);
+assert.match(patchedGradle.content, /name = \\"rustls-platform-verifier-android\\"/);
+assert.match(patchedGradle.content, /rustls-platform-verifier\/raw\/maven-archive\/android-release-support\/maven\//);
+assert.equal(patchGradle(patchedGradle.content).changed, false);
+assert.equal(patchedGradle.content.split(GRADLE_MARKER).length, 2);
+
+const manifest =
+  '<?xml version="1.0" encoding="utf-8"?>\n<manifest xmlns:android="http://schemas.android.com/apk/res/android">\n' +
+  '<application android:name=".OpenLessApplication"\n        android:usesCleartextTraffic="${usesCleartextTraffic}">\n</application>\n</manifest>\n';
+const patchedManifest = patchManifest(manifest);
+assert.equal(patchedManifest.changed, true);
+assert.match(patchedManifest.content, /<manifest xmlns:tools="http:\/\/schemas\.android\.com\/tools" xmlns:android=/);
+assert.match(patchedManifest.content, new RegExp(`<application ${REMOVE_ATTRIBUTE} android:name="\\.OpenLessApplication"`));
+// The app keeps its own cleartext policy.
+assert.match(patchedManifest.content, /android:usesCleartextTraffic="\$\{usesCleartextTraffic\}"/);
+assert.equal(patchManifest(patchedManifest.content).changed, false);
+
+// The Rust half initializes the verifier when the application Context registers.
+const bridge = readFileSync(
+  fileURLToPath(new URL('../src-tauri/src/android/native_bridge.rs', import.meta.url)),
+  'utf8',
+);
+assert.match(bridge, /nativeRegisterActivityContext[\s\S]{0,400}tls_verifier::init\(env, context\.as_raw\(\)\)/);
+// tokio-tungstenite's wss:// clients need a process-default CryptoProvider.
+// run() installs it, but the Application Context registers before any
+// Activity enters run(), so the verifier init installs it too.
+const tlsVerifier = readFileSync(
+  fileURLToPath(new URL('../src-tauri/src/android/tls_verifier.rs', import.meta.url)),
+  'utf8',
+);
+assert.match(tlsVerifier, /crate::tls_crypto::install_tls_crypto_provider\(\);/);
+
+// Every Android build path wires the Kotlin half in.
+for (const path of [
+  '../../../.github/workflows/android-apk.yml',
+  '../../../.github/workflows/ci.yml',
+  './build-android-local.sh',
+  './run-android-tauri-dev.mjs',
+]) {
+  const content = readFileSync(fileURLToPath(new URL(path, import.meta.url)), 'utf8');
+  assert.match(content, /patch-android-rustls-verifier\.mjs/, path);
+}
+
+console.log('patch-android-rustls-verifier contract checks passed');
diff --git a/openless-all/app/scripts/run-android-tauri-dev.mjs b/openless-all/app/scripts/run-android-tauri-dev.mjs
index 10f953fee..10a6aa3dc 100644
--- a/openless-all/app/scripts/run-android-tauri-dev.mjs
+++ b/openless-all/app/scripts/run-android-tauri-dev.mjs
@@ -63,6 +63,7 @@ async function main() {
     'merge-android-overlay-manifest.mjs',
     'merge-android-shizuku-manifest.mjs',
     'patch-android-shizuku-deps.mjs',
+    'patch-android-rustls-verifier.mjs',
     'merge-android-updater-manifest.mjs',
   ]) {
     runNode(join(appRoot, 'scripts', script), [], env);
diff --git a/openless-all/app/src-tauri/Cargo.lock b/openless-all/app/src-tauri/Cargo.lock
index 1cd00ee98..66676720f 100644
--- a/openless-all/app/src-tauri/Cargo.lock
+++ b/openless-all/app/src-tauri/Cargo.lock
@@ -4400,6 +4400,7 @@ dependencies = [
  "hyper",
  "hyper-util",
  "jni 0.21.1",
+ "jni 0.22.4",
  "keyring",
  "libc",
  "local-ip-address",
@@ -4419,6 +4420,7 @@ dependencies = [
  "regex",
  "reqwest 0.12.28",
  "rustls",
+ "rustls-platform-verifier",
  "security-framework 3.7.0",
  "semver",
  "serde",
diff --git a/openless-all/app/src-tauri/Cargo.toml b/openless-all/app/src-tauri/Cargo.toml
index f6cc5dbf4..77a9369ea 100644
--- a/openless-all/app/src-tauri/Cargo.toml
+++ b/openless-all/app/src-tauri/Cargo.toml
@@ -122,6 +122,12 @@ libc = "0.2"
 jni = "0.21"
 ndk-context = "0.1"
 tao = "0.35"
+# reqwest 0.13 in openless-core verifies TLS through rustls-platform-verifier,
+# which on Android must be handed the JVM and app Context before the first
+# HTTPS request (src/android/tls_verifier.rs). It is built on jni-rs 0.22,
+# hence the renamed second jni major.
+rustls-platform-verifier = "0.7.1"
+jni022 = { package = "jni", version = "0.22.4" }
 
 # Local ASR on arm64 Android: the crate has no Android prebuilt download, so
 # scripts/run-android-tauri-build.mjs points SHERPA_ONNX_LIB_DIR at the
diff --git a/openless-all/app/src-tauri/src/android/mod.rs b/openless-all/app/src-tauri/src/android/mod.rs
index d5da8bbcb..aecbf28ed 100644
--- a/openless-all/app/src-tauri/src/android/mod.rs
+++ b/openless-all/app/src-tauri/src/android/mod.rs
@@ -13,6 +13,8 @@ pub mod native_bridge;
 pub mod overlay;
 pub mod shizuku;
 #[cfg(target_os = "android")]
+pub(crate) mod tls_verifier;
+#[cfg(target_os = "android")]
 pub mod updater;
 pub mod updater_logic;
 pub use crate::types::android_types as types;
diff --git a/openless-all/app/src-tauri/src/android/native_bridge.rs b/openless-all/app/src-tauri/src/android/native_bridge.rs
index 268185d36..66455e1c8 100644
--- a/openless-all/app/src-tauri/src/android/native_bridge.rs
+++ b/openless-all/app/src-tauri/src/android/native_bridge.rs
@@ -1615,6 +1615,9 @@ mod jni_exports {
         _class: JClass,
         context: JObject,
     ) {
+        // OpenLessApplication.onCreate registers the application Context here,
+        // before Core sends its first HTTPS request.
+        crate::android::tls_verifier::init(env, context.as_raw());
         let result = with_jni_context(env, context, |env, context| {
             crate::android::jni::android::register_active_activity(env, context)
         });
diff --git a/openless-all/app/src-tauri/src/android/tls_verifier.rs b/openless-all/app/src-tauri/src/android/tls_verifier.rs
new file mode 100644
index 000000000..7eee17e8a
--- /dev/null
+++ b/openless-all/app/src-tauri/src/android/tls_verifier.rs
@@ -0,0 +1,37 @@
+//! TLS setup for Core's network clients on Android.
+//!
+//! openless-core uses reqwest 0.13, which verifies certificates through
+//! rustls-platform-verifier. On Android that verifier asks the platform
+//! TrustManager through JNI and panics on the first HTTPS request unless it
+//! was first given the JVM and the application Context — every LLM request
+//! and provider validation then dies inside its task. The Kotlin half of the
+//! verifier ships as the `org.rustls:rustls-platform-verifier` AAR, added to
+//! the generated Gradle project by scripts/patch-android-rustls-verifier.mjs.
+//!
+//! The WebSocket ASR clients additionally need rustls' process-default
+//! CryptoProvider, which `run()` installs first thing (`crate::tls_crypto`).
+//! It is also installed here because this runs from
+//! `OpenLessApplication.onCreate`, before any Activity enters `run()`.
+//!
+//! The verifier is built on jni-rs 0.22 while this crate uses 0.21, so the raw
+//! JNIEnv and Context pointers are handed across.
+
+/// Installs the process-default CryptoProvider and initializes the verifier
+/// from a JNI entry point that received the application Context. Idempotent:
+/// both keep their first successful initialization, so every Context
+/// registration may call this.
+///
+/// # Safety
+/// `raw_env` must be the JNIEnv of the current native call and `raw_context`
+/// a valid local or global reference to an `android.content.Context`.
+pub(crate) unsafe fn init(raw_env: *mut jni::sys::JNIEnv, raw_context: jni::sys::jobject) {
+    crate::tls_crypto::install_tls_crypto_provider();
+    let mut env = jni022::EnvUnowned::from_raw(raw_env.cast());
+    env.with_env(|env| -> Result<(), jni022::errors::Error> {
+        let context = jni022::objects::JObject::from_raw(env, raw_context.cast());
+        rustls_platform_verifier::android::init_with_env(env, context)
+    })
+    .resolve_with::<jni022::errors::LogContextErrorAndDefault, _>(|| {
+        "[android-tls] rustls-platform-verifier initialization".to_string()
+    });
+}