diff --git a/amethyst/src/main/jniLibs/arm64-v8a/libarti_android.so b/amethyst/src/main/jniLibs/arm64-v8a/libarti_android.so
index ef38605879..b29a78dbe1 100755
Binary files a/amethyst/src/main/jniLibs/arm64-v8a/libarti_android.so and b/amethyst/src/main/jniLibs/arm64-v8a/libarti_android.so differ
diff --git a/amethyst/src/main/jniLibs/x86_64/libarti_android.so b/amethyst/src/main/jniLibs/x86_64/libarti_android.so
index 6865674ca5..4a473042a9 100755
Binary files a/amethyst/src/main/jniLibs/x86_64/libarti_android.so and b/amethyst/src/main/jniLibs/x86_64/libarti_android.so differ
diff --git a/tools/arti-build/ARTI_VERSION b/tools/arti-build/ARTI_VERSION
index c0095959b7..5c804c82cf 100644
--- a/tools/arti-build/ARTI_VERSION
+++ b/tools/arti-build/ARTI_VERSION
@@ -1 +1 @@
-arti-v2.2.0
+arti-v2.3.0
\ No newline at end of file
diff --git a/tools/arti-build/Cargo.toml b/tools/arti-build/Cargo.toml
index dccb35ba13..b7d8c377e8 100644
--- a/tools/arti-build/Cargo.toml
+++ b/tools/arti-build/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "arti-android"
-version = "2.2.0"
+version = "2.3.0"
 edition = "2021"
 
 [lib]
@@ -9,14 +9,19 @@ crate-type = ["cdylib"]
 [workspace]
 
 [dependencies]
-arti-client = { version = "0.41", default-features = false, features = [
+arti-client = { version = "0.42", default-features = false, features = [
     "tokio",
     "rustls",
     "compression",
     "onion-service-client",
     "static-sqlite",
 ] }
-tor-rtcompat = { version = "0.41", default-features = false, features = ["tokio", "rustls"] }
+tor-rtcompat = { version = "0.42", default-features = false, features = ["tokio", "rustls"] }
+# Direct dep on rustls so we can install the `ring` crypto provider ourselves —
+# arti-v2.3.0's tor-rtcompat no longer installs one implicitly. `ring` matches
+# what arti-v2.2.0 effectively used and avoids the Android build pain of
+# aws-lc-rs (which became Arti's default in 2.3.0).
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
 jni = "0.21"
 tokio = { version = "1", features = ["rt-multi-thread", "net", "io-util", "time", "macros"] }
 anyhow = "1"
diff --git a/tools/arti-build/src/lib.rs b/tools/arti-build/src/lib.rs
index c762584d81..f0a7d05304 100644
--- a/tools/arti-build/src/lib.rs
+++ b/tools/arti-build/src/lib.rs
@@ -131,6 +131,12 @@ pub extern "C" fn Java_com_vitorpamplona_amethyst_ui_tor_ArtiNative_initialize(
     log_info!("Initializing Arti with data directory: {}", data_dir_str);
 
     INIT_ONCE.call_once(|| {
+        // arti-v2.3.0's tor-rtcompat no longer installs a rustls CryptoProvider
+        // implicitly — without this, TorClient::create_bootstrapped panics on
+        // first TLS handshake. install_default() returns Err if a provider is
+        // already installed, which is fine; we just want at-least-one.
+        let _ = rustls::crypto::ring::default_provider().install_default();
+
         match tokio::runtime::Builder::new_multi_thread()
             .enable_all()
             .build()