diff --git a/CLAUDE.md b/CLAUDE.md
index 881cbc2e..0bff38e3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -92,9 +92,8 @@ TUN 10.5.0.0/24 egress -> WfbNgVpnService -> :8001 -> TxFrame (FEC k=1,n=5, radi
   decaying 0–5 `fec_change` value and the thresholds are user-tunable (README "Auto-FEC" section,
   `nativeSetFecThresholds`). `SignalQualityCalculator` is a singleton fed from the RX callback.
 - `gs.key` is copied from assets (or a user-picked file) to the app files dir; native code opens
-  it by the hard-coded path in `WfbngLink.hpp` (`/data/user/0/com.openipc.pixelpilot/files/gs.key`),
-  so the applicationId cannot change without updating that constant. devourer's per-adapter lock
-  file is pointed at the same dir because `/tmp` does not exist on Android.
+  it from the same dir, which `WfbngLink` takes from `Context.getFilesDir()` at construction.
+  devourer's per-adapter lock file is pointed at the same dir because `/tmp` does not exist on Android.
 - One `WfbNgLink.start()` per USB device spawns a thread running `nativeRun`, which blocks in
   devourer's `StartRxLoop` until `nativeStop` → `StopRxLoop`. Multi-adapter is supported by
   keying `rtl_devices` on the USB fd. Hot-plug is handled by `WfbLinkManager` (a
diff --git a/app/wfbngrtl8812/src/main/cpp/WfbngLink.cpp b/app/wfbngrtl8812/src/main/cpp/WfbngLink.cpp
index 1ce0c8dd..6e7b2ef1 100644
--- a/app/wfbngrtl8812/src/main/cpp/WfbngLink.cpp
+++ b/app/wfbngrtl8812/src/main/cpp/WfbngLink.cpp
@@ -48,8 +48,27 @@ std::string generate_random_string(size_t length) {
     return result;
 }
 
+// The app's files dir, taken from the Context so it follows the applicationId.
+static std::string appFilesDir(JNIEnv *env, jobject context) {
+    jclass ctxClass = env->GetObjectClass(context);
+    jobject dir = env->CallObjectMethod(context, env->GetMethodID(ctxClass, "getFilesDir", "()Ljava/io/File;"));
+    jclass fileClass = env->GetObjectClass(dir);
+    auto path =
+        (jstring)env->CallObjectMethod(dir, env->GetMethodID(fileClass, "getAbsolutePath", "()Ljava/lang/String;"));
+    const char *c = env->GetStringUTFChars(path, nullptr);
+    std::string out(c);
+    env->ReleaseStringUTFChars(path, c);
+    env->DeleteLocalRef(path);
+    env->DeleteLocalRef(fileClass);
+    env->DeleteLocalRef(dir);
+    env->DeleteLocalRef(ctxClass);
+    return out;
+}
+
 WfbngLink::WfbngLink(JNIEnv *env, jobject context)
         : current_fd(-1), adaptive_link_enabled(true), adaptive_tx_power(30) {
+    filesDir = appFilesDir(env, context);
+    keyPath = filesDir + "/gs.key";
     initAgg();
     log = std::make_shared<Logger>(); // routes to logcat under the "devourer" tag
     wifi_driver = std::make_unique<WiFiDriver>(log);
@@ -118,7 +137,7 @@ int WfbngLink::run(JNIEnv *env, jobject context, jint wifiChannel, jint bw, jint
     cfg.rx.enable_with_tx = true;
     // The per-adapter advisory lock defaults to /tmp, which doesn't exist on
     // Android — use the app's files dir (same location as gs.key).
-    cfg.usb.lock_dir = "/data/user/0/com.openipc.pixelpilot/files";
+    cfg.usb.lock_dir = filesDir;
     // Keep the RX ring on plain heap buffers. The zerocopy dev-mem path
     // (libusb_dev_mem_alloc / USBDEVFS mmap) is unvalidated on Android vendor
     // kernels; if the mmap succeeds but the HCD's zerocopy path is broken,
diff --git a/app/wfbngrtl8812/src/main/cpp/WfbngLink.hpp b/app/wfbngrtl8812/src/main/cpp/WfbngLink.hpp
index f761e54e..251f1d8f 100644
--- a/app/wfbngrtl8812/src/main/cpp/WfbngLink.hpp
+++ b/app/wfbngrtl8812/src/main/cpp/WfbngLink.hpp
@@ -183,7 +183,8 @@ class WfbngLink {
         withDevice(current_fd.load(), [](IRtlDevice &dev) { dev.StopRxLoop(); });
     }
 
-    const char *keyPath = "/data/user/0/com.openipc.pixelpilot/files/gs.key";
+    std::string filesDir; // Context.getFilesDir(): where VideoActivity copies gs.key
+    std::string keyPath;  // filesDir + "/gs.key"
     std::recursive_mutex thread_mutex;
     std::unique_ptr<WiFiDriver> wifi_driver;
     std::shared_ptr<TxFrame> txFrame;