diff --git a/android/build.sh b/android/build.sh
index 478e01f..a6c1518 100755
--- a/android/build.sh
+++ b/android/build.sh
@@ -192,6 +192,17 @@ fi
 if [ -z "${toolchain:-}" ] && [ -n "${NDK_HOME:-}" ]; then
     toolchain=$(echo "$NDK_HOME"/toolchains/llvm/prebuilt/*)
 fi
+# 3.13+: CPython's in-tree Android tooling auto-resolves the NDK under
+# $ANDROID_HOME/ndk/$cpython_ndk_version/ without ever exporting NDK_HOME,
+# so neither of the branches above fires. Walk that path so normalize sees
+# a non-empty build-time toolchain and the relocation block can substitute
+# on consumer hosts.
+if [ -z "${toolchain:-}" ] && [ -n "${ANDROID_HOME:-}" ] && [ -n "${cpython_ndk_version:-}" ]; then
+    candidate="$ANDROID_HOME/ndk/$cpython_ndk_version/toolchains/llvm/prebuilt"
+    if [ -d "$candidate" ]; then
+        toolchain=$(echo "$candidate"/*)
+    fi
+fi
 
 python3 "$script_dir/normalize_mobile_forge_install.py" "$PREFIX" \
     --ndk-toolchain "${toolchain:-}"
diff --git a/android/normalize_mobile_forge_install.py b/android/normalize_mobile_forge_install.py
index f2db369..bc0ca51 100644
--- a/android/normalize_mobile_forge_install.py
+++ b/android/normalize_mobile_forge_install.py
@@ -107,10 +107,17 @@ def _local_toolchain():
     for _key, _value in tuple(build_time_vars.items()):
         if not isinstance(_value, str):
             continue
-        for _old_prefix in _install_prefixes:
-            _value = _value.replace(_old_prefix, _prefix)
+        # NDK substitution must run before install-prefix substitution: when
+        # the build-time NDK lives under one of `_install_prefixes` (e.g. the
+        # GitHub runner places NDK under `/usr/local/lib/android/sdk/ndk/...`),
+        # rewriting the prefix first would mangle the NDK string and leave
+        # nothing for the NDK rule to match. Swapping order keeps both rules
+        # independent: NDK fully resolves to the local toolchain, then any
+        # remaining install-prefix references get re-anchored.
         if _build_ndk and _local_ndk:
             _value = _value.replace(_build_ndk, _local_ndk)
+        for _old_prefix in _install_prefixes:
+            _value = _value.replace(_old_prefix, _prefix)
         build_time_vars[_key] = _value