diff --git a/tool/patch_android.py b/tool/patch_android.py
index 4d6b54b..2b99963 100644
--- a/tool/patch_android.py
+++ b/tool/patch_android.py
@@ -33,12 +33,16 @@ open(man, "w").write(s)
 # 3) build.gradle : signature + schéma OIDC
 gr = "android/app/build.gradle"
 s = open(gr).read()
+# ⚠️ Rien n'est autorisé AVANT le bloc plugins {} → on insère juste avant `android {`
 if "keystoreProperties" not in s:
-    s = (
+    s = s.replace(
+        "android {",
         'def keystoreProperties = new Properties()\n'
         'def keystorePropertiesFile = rootProject.file("key.properties")\n'
         'if (keystorePropertiesFile.exists()) { keystoreProperties.load(new FileInputStream(keystorePropertiesFile)) }\n\n'
-    ) + s
+        'android {',
+        1,
+    )
 if "appAuthRedirectScheme" not in s:
     s = s.replace(
         "defaultConfig {",