diff --git a/crates/ccc-crypto-wolfssl/build.rs b/crates/ccc-crypto-wolfssl/build.rs
index 7ec7b2f..31dab33 100644
--- a/crates/ccc-crypto-wolfssl/build.rs
+++ b/crates/ccc-crypto-wolfssl/build.rs
@@ -13,6 +13,11 @@
 //! * `WOLFSSL_INSTALL_DIR` – If set, skip the CMake build and link against
 //!   a pre-installed wolfSSL at this path.  The path must contain
 //!   `include/wolfssl/` and `lib/libwolfssl.a`.
+//! * `ANDROID_NDK_ROOT` (or `ANDROID_NDK_HOME`) – Required when targeting
+//!   Android.  Set to the NDK root directory so that CMake can locate the
+//!   Android toolchain.  Cargokit/Gradle sets this automatically; when
+//!   invoking `cargo` directly make sure the variable is exported in your
+//!   shell session.
 
 use std::{
     env,
@@ -99,6 +104,31 @@ fn build_wolfssl_cmake(source_dir: &Path, _out_dir: &Path) -> (PathBuf, PathBuf)
 
     let mut cfg = cmake::Config::new(source_dir);
 
+    // ── Android NDK ───────────────────────────────────────────────────────────
+    // When cross-compiling for Android the cmake crate already sets
+    // CMAKE_SYSTEM_NAME=Android and the clang compiler paths.  The only
+    // missing piece that Android-Determine.cmake checks first is
+    // CMAKE_ANDROID_NDK — once it is set all other NDK detection succeeds.
+    //
+    // We read it from ANDROID_NDK_ROOT (standard SDK Manager layout) or the
+    // legacy ANDROID_NDK_HOME.  Cargokit/Gradle sets ANDROID_NDK_ROOT, and the
+    // same variable must be visible in the shell when using cargo directly.
+    let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
+    if target_os == "android" {
+        let ndk_root = env::var("ANDROID_NDK_ROOT")
+            .or_else(|_| env::var("ANDROID_NDK_HOME"))
+            .unwrap_or_else(|_| {
+                panic!(
+                    "\n\nAndroid target requires ANDROID_NDK_ROOT (or ANDROID_NDK_HOME) \
+                     to be set.\nSet it to the NDK directory, e.g.:\n  \
+                     export ANDROID_NDK_ROOT=$HOME/apps/android-sdk/ndk/28.x.x\n"
+                )
+            });
+        cfg.define("CMAKE_ANDROID_NDK", &ndk_root);
+        println!("cargo:rerun-if-env-changed=ANDROID_NDK_ROOT");
+        println!("cargo:rerun-if-env-changed=ANDROID_NDK_HOME");
+    }
+
     // ── Core algorithm selection ─────────────────────────────────────────────
     // wolfSSL cmake uses add_option() with "yes"/"no" string values (not ON/OFF).
     // Option names must exactly match the `add_option("NAME" ...)` calls in