diff --git a/.github/scatterlab/android-prebuilt.md b/.github/scatterlab/android-prebuilt.md
index a56ad7d18d9..f6ad17cb57e 100644
--- a/.github/scatterlab/android-prebuilt.md
+++ b/.github/scatterlab/android-prebuilt.md
@@ -64,6 +64,7 @@ env ORG_GRADLE_PROJECT_react.internal.useHermesStable=true \
 - `isSnapshot`을 켜지 않는다. 켜면 버전에 `-SNAPSHOT`이 붙어 좌표가 어긋난다.
 - ABI는 기본값(`armeabi-v7a,arm64-v8a,x86,x86_64`)을 그대로 둔다. 소비자의 `reactNativeArchitectures`와 같아야 한다.
 - Debug·Release 두 variant는 `components.default` 멀티 variant 퍼블리시로 한 번에 나온다(`publish.gradle`).
+- 빌드는 상류와 같은 `reactnativecommunity/react-native-android` 컨테이너에서 돈다 — 러너 이미지에 Android SDK·NDK·CMake가 없다. **digest로 고정**한다: 툴체인이 밑에서 움직이면 같은 커밋의 두 빌드가 달라지고, 이 워크플로가 증명하려는 것이 바로 그 동일성이다. base가 고정이면 요구 툴체인도 고정이므로 **base를 올릴 때만** 다시 핀한다.
 - ccache를 러너에 유지한다. 없으면 매 실행이 전체 C++ 재컴파일이다.
 - 빌드 산출물은 수 GB다. `if: always()`로 정리한다.
 
diff --git a/.github/workflows/scatterlab-prebuild-android.yml b/.github/workflows/scatterlab-prebuild-android.yml
index c5d722ebfa7..cafc61740c8 100644
--- a/.github/workflows/scatterlab-prebuild-android.yml
+++ b/.github/workflows/scatterlab-prebuild-android.yml
@@ -119,6 +119,24 @@ jobs:
   build:
     needs: prepare
     runs-on: arc-messenger-dev
+    # The runner image carries no Android SDK, NDK or CMake, and ReactAndroid needs all
+    # three. Upstream builds these same artifacts inside this image (`publish-npm.yml`'s
+    # `build_android`), so it is the toolchain the sources expect. `arc-messenger-dev` is a
+    # dind scale set, so it can run a job container.
+    #
+    # Pinned by digest, not `:latest`: this workflow exists to prove the AAR was built from
+    # the sources its version claims, and a toolchain that moves underneath makes two builds
+    # of the same commit differ. `VERSION_NAME` is pinned to the upstream base, so the NDK
+    # and CMake this needs are fixed too - re-pin when the base moves, not before.
+    # sha256:24ca7ab5... is `v21.0` (2026-06-19), which `:latest` pointed at.
+    container:
+      image: reactnativecommunity/react-native-android@sha256:24ca7ab5a70ec0b78a81bdc5eeea5924c2531531d53971b6f2321aff08446c36
+      env:
+        TERM: 'dumb'
+        # Gradle mis-decompresses tar.gz inside containers under some locales.
+        # https://github.com/gradle/gradle/issues/23391#issuecomment-1878979127
+        LC_ALL: C.UTF8
+        GRADLE_OPTS: '-Dorg.gradle.daemon=false'
     permissions:
       contents: write
     outputs:
@@ -132,14 +150,6 @@ jobs:
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/yarn-install
 
-      # The runner image ships no JDK, and `./gradlew` below needs one. Same version and
-      # distribution as the `prepare` job so both halves of this workflow build against
-      # the same toolchain.
-      - uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: '17'
-
       # Without a warm ccache every run is a full C++ rebuild of ReactCommon.
       - name: Restore the Android ccache
         uses: actions/cache/restore@v4