diff --git a/crates/wzp-android/src/engine.rs b/crates/wzp-android/src/engine.rs
index bd993ed..9220076 100644
--- a/crates/wzp-android/src/engine.rs
+++ b/crates/wzp-android/src/engine.rs
@@ -253,33 +253,46 @@ impl WzpEngine {
         token: Option<&str>,
         alias: Option<&str>,
     ) -> Result<(), anyhow::Error> {
-        use wzp_proto::{MediaTransport, SignalMessage};
-
-        let addr: SocketAddr = relay_addr.parse()?;
-        let seed = if seed_hex.is_empty() {
-            wzp_crypto::Seed::generate()
-        } else {
-            wzp_crypto::Seed::from_hex(seed_hex).map_err(|e| anyhow::anyhow!(e))?
-        };
-        let identity = seed.derive_identity();
-        let pub_id = identity.public_identity();
-        let identity_pub = *pub_id.signing.as_bytes();
-        let fp = pub_id.fingerprint.to_string();
+        // Capture lightweight params only — all crypto work happens on the spawned thread
+        let addr_str = relay_addr.to_string();
+        let seed_str = seed_hex.to_string();
         let token = token.map(|s| s.to_string());
         let alias = alias.map(|s| s.to_string());
         let state = self.state.clone();
-        let seed_bytes = seed.0;
-
-        info!(fingerprint = %fp, relay = %addr, "starting signaling");
 
         self.state.running.store(true, Ordering::Release);
-        let signal_state = state.clone();
 
-        // Spawn on a dedicated thread with sufficient stack (Android IO dispatcher stack is too small)
+        // Spawn on a dedicated thread — Android's Kotlin dispatcher has ~1MB stack,
+        // too small for rustls + QUIC + tokio + crypto. Do ALL work on this thread.
         std::thread::Builder::new()
             .name("wzp-signal".into())
-            .stack_size(4 * 1024 * 1024) // 4MB stack
+            .stack_size(8 * 1024 * 1024) // 8MB stack
             .spawn(move || {
+                use wzp_proto::{MediaTransport, SignalMessage};
+
+                let _ = rustls::crypto::ring::default_provider().install_default();
+
+                let addr: SocketAddr = match addr_str.parse() {
+                    Ok(a) => a,
+                    Err(e) => { error!("bad relay addr: {e}"); return; }
+                };
+                let seed = if seed_str.is_empty() {
+                    wzp_crypto::Seed::generate()
+                } else {
+                    match wzp_crypto::Seed::from_hex(&seed_str) {
+                        Ok(s) => s,
+                        Err(e) => { error!("bad seed: {e}"); return; }
+                    }
+                };
+                let identity = seed.derive_identity();
+                let pub_id = identity.public_identity();
+                let identity_pub = *pub_id.signing.as_bytes();
+                let fp = pub_id.fingerprint.to_string();
+
+                info!(fingerprint = %fp, relay = %addr, "starting signaling");
+
+                let signal_state = state.clone();
+
                 let rt = tokio::runtime::Builder::new_current_thread()
                     .enable_all()
                     .build()