diff --git a/contrib/android/Dockerfile b/contrib/android/Dockerfile
index d462bd4d23bb..be455d106044 100644
--- a/contrib/android/Dockerfile
+++ b/contrib/android/Dockerfile
@@ -196,17 +196,16 @@ RUN apt -y update -qq \
 
 
 # create new user to avoid using root; but with sudo access and no password for convenience.
-ARG UID=1000
-RUN if [ "$UID" != "0" ] ; then useradd --uid $UID --create-home --shell /bin/bash "user" ; fi
-RUN usermod -append --groups sudo $(id -nu $UID || echo "user")
+# NOTE: UID *MUST* align with buildozer's Dockerfile "user"
+RUN useradd -u 1000 -m -s /usr/bin/bash -d /home/user user
+RUN usermod -aG sudo user
 RUN echo "%sudo ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-RUN HOME_DIR=$(getent passwd $UID | cut -d: -f6)
-ENV WORK_DIR="${HOME_DIR}/wspace" \
-    PATH="${HOME_DIR}/.local/bin:${PATH}"
+ENV HOME_DIR=/home/user
+ENV WORK_DIR="${HOME_DIR}/wspace"
+ENV PATH="${HOME_DIR}/.local/bin:${PATH}"
 WORKDIR ${WORK_DIR}
-RUN chown --recursive ${UID} ${WORK_DIR} ${ANDROID_SDK_HOME}
-RUN chown ${UID} /opt
-USER ${UID}
+RUN chown -R user ${WORK_DIR} ${ANDROID_SDK_HOME} /opt
+USER user
 
 # build cpython. FIXME we can't use the python3 from apt, as it is too new o.O
 # - p4a and buildozer require cython<3 (see https://github.com/kivy/python-for-android/issues/2919)
@@ -233,8 +232,8 @@ ENV VIRTUAL_ENV=/opt/venv
 RUN "/opt/cpython/install/bin/python3" -m venv ${VIRTUAL_ENV}
 ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
 
-COPY contrib/deterministic-build/requirements-build-base.txt /opt/deterministic-build/
-COPY contrib/deterministic-build/requirements-build-android.txt /opt/deterministic-build/
+COPY --chown=user contrib/deterministic-build/requirements-build-base.txt /opt/deterministic-build/
+COPY --chown=user contrib/deterministic-build/requirements-build-android.txt /opt/deterministic-build/
 RUN /opt/venv/bin/python3 -m pip install --no-build-isolation --no-dependencies \
     -r /opt/deterministic-build/requirements-build-base.txt
 RUN /opt/venv/bin/python3 -m pip install --no-build-isolation --no-dependencies --no-binary :all: \
diff --git a/contrib/android/build.sh b/contrib/android/build.sh
index a156838eb5c5..ea8b01bfef44 100755
--- a/contrib/android/build.sh
+++ b/contrib/android/build.sh
@@ -86,6 +86,7 @@ docker run --rm \
     -v "$PROJECT_ROOT_OR_FRESHCLONE_ROOT":/home/user/wspace/electrum \
     -v "$PROJECT_ROOT_OR_FRESHCLONE_ROOT"/.buildozer/.gradle:/home/user/.gradle \
     $DOCKER_RUN_FLAGS \
+    --user user \
     --workdir /home/user/wspace/electrum \
     electrum-android-builder-img \
     ./contrib/android/make_apk.sh "$@"
diff --git a/contrib/android/make_apk.sh b/contrib/android/make_apk.sh
index 2b6ee7360f25..3f75c35fa404 100755
--- a/contrib/android/make_apk.sh
+++ b/contrib/android/make_apk.sh
@@ -34,12 +34,21 @@ info "apk building phase starts."
 # Uncomment and change below to set a custom android package id,
 # e.g. to allow simultaneous mainnet and testnet installs of the apk.
 # defaults:
+#
 #   export APP_PACKAGE_NAME=Electrum
 #   export APP_PACKAGE_DOMAIN=org.electrum
-# FIXME: changing "APP_PACKAGE_NAME" seems to require a clean rebuild of ".buildozer/",
-#        to avoid that, maybe change "APP_PACKAGE_DOMAIN" instead.
-# So, in particular, to build a testnet apk, simply uncomment:
+#
+# FIXME: changing "APP_PACKAGE_NAME" seems to require a clean rebuild of ".buildozer/".
+#        However, even with a clean build, the build appears to break in the final stages (~4.7.0).
+#        To avoid these issues; only change "APP_PACKAGE_DOMAIN" instead.
+#
+# So, in particular, to build testnet APKs, simply uncomment one of the following at a time (per-build):
+#
+# Testnet3
 #export APP_PACKAGE_DOMAIN=org.electrum.testnet
+#
+# Testnet4
+#export APP_PACKAGE_DOMAIN=org.electrum.testnet4
 
 if [ $CI ]; then
     # override log level specified in buildozer.spec to "debug":