diff --git a/src-tauri/gen/android/app/build.gradle.kts b/src-tauri/gen/android/app/build.gradle.kts
index 97e9e3b39..67384e718 100644
--- a/src-tauri/gen/android/app/build.gradle.kts
+++ b/src-tauri/gen/android/app/build.gradle.kts
@@ -57,11 +57,16 @@ android {
             }
         }
         getByName("release") {
-            // R8 off: it barely shrinks this app (size is the native .so libs, which
-            // release strips regardless) and can rename/remove JNI-called Kotlin
-            // (nativeInit, VoltiusKeychain) → launch crash. Keep behavior identical
-            // to the on-device-verified debug build; only signing/debuggable differ.
-            isMinifyEnabled = false
+            // R8 shrinks and obfuscates the libraries (Play flags unobfuscated DEX).
+            // Rust calls our Kotlin by name over JNI (VoltiusKeychain, VoltiusBiometric,
+            // VoltiusTunnelService, ...), so proguard-rules.pro keeps com.voltius.app
+            // whole; Tauri's own classes are kept by the rules its library ships.
+            isMinifyEnabled = true
+            proguardFiles(
+                getDefaultProguardFile("proguard-android-optimize.txt"),
+                "proguard-rules.pro",
+                "proguard-tauri.pro",
+            )
             // Only attach the release signing config when CI provided a keystore;
             // otherwise leave unsigned so a local `release` build still completes.
             if (System.getenv("ANDROID_KEYSTORE_PATH") != null) {
diff --git a/src-tauri/gen/android/app/proguard-rules.pro b/src-tauri/gen/android/app/proguard-rules.pro
index 481bb4348..dc5380e97 100644
--- a/src-tauri/gen/android/app/proguard-rules.pro
+++ b/src-tauri/gen/android/app/proguard-rules.pro
@@ -1,21 +1,13 @@
-# Add project specific ProGuard rules here.
-# You can control the set of applied configuration files using the
-# proguardFiles setting in build.gradle.
-#
-# For more details, see
-#   http://developer.android.com/guide/developing/tools/proguard.html
+# Release builds run R8 (see build.gradle.kts).
 
-# If your project uses WebView with JS, uncomment the following
-# and specify the fully qualified class name to the JavaScript interface
-# class:
-#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
-#   public *;
-#}
+# Rust looks up these classes and methods by name over JNI, and the WebView reaches
+# some through @JavascriptInterface: R8 must not rename or remove any of them.
+-keep class com.voltius.app.** { *; }
+-keepattributes *Annotation*,Signature,InnerClasses,EnclosingMethod,SourceFile,LineNumberTable
 
-# Uncomment this to preserve the line number information for
-# debugging stack traces.
-#-keepattributes SourceFile,LineNumberTable
+# Readable stack traces in Play crash reports (the mapping file is uploaded with the AAB).
+-renamesourcefileattribute SourceFile
 
-# If you keep the line number information, uncomment this to
-# hide the original source file name.
-#-renamesourcefileattribute SourceFile
\ No newline at end of file
+# Tink (via androidx.security:security-crypto) references compile-only annotations.
+-dontwarn javax.annotation.Nullable
+-dontwarn javax.annotation.concurrent.GuardedBy