diff --git a/plugins/with-release-signing.js b/plugins/with-release-signing.js
index 5270aa5..27fecee 100644
--- a/plugins/with-release-signing.js
+++ b/plugins/with-release-signing.js
@@ -2,7 +2,10 @@
    Keystore: $HEALTH_KEYSTORE or ~/.android-keys/health-app-release.jks
    Password: $KEYSTORE_PASSWORD or ~/.android-keys/health-app-release.password
    Falls back to the debug keystore when neither exists. */
-const { withAppBuildGradle } = require('expo/config-plugins');
+const { withAppBuildGradle, withGradleProperties } = require('expo/config-plugins');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
 
 const SIGNING = `        release {
             // keystore lives outside the repo; password from env or ~/.android-keys
@@ -18,7 +21,27 @@ const SIGNING = `        release {
         }
     }`;
 
+/* RN's CMake tooling breaks on JDK 24+ (native-access restrictions); pin a
+   local JDK 17–21 for Gradle when one is present under ~/.jdks. */
+function findJdk21() {
+  const dir = path.join(os.homedir(), '.jdks');
+  if (!fs.existsSync(dir)) return null;
+  const hit = fs
+    .readdirSync(dir)
+    .filter((d) => /^jdk-(17|21)/.test(d))
+    .sort()
+    .pop();
+  return hit ? path.join(dir, hit) : null;
+}
+
 module.exports = function withReleaseSigning(config) {
+  config = withGradleProperties(config, (cfg) => {
+    const jdk = findJdk21();
+    if (jdk && !cfg.modResults.some((p) => p.key === 'org.gradle.java.home')) {
+      cfg.modResults.push({ type: 'property', key: 'org.gradle.java.home', value: jdk });
+    }
+    return cfg;
+  });
   return withAppBuildGradle(config, (cfg) => {
     let g = cfg.modResults.contents;
     if (!g.includes('def ksPath')) {