diff --git a/.github/workflows/android.yaml b/.github/workflows/android.yaml
index 074f4c6af..4d15372be 100644
--- a/.github/workflows/android.yaml
+++ b/.github/workflows/android.yaml
@@ -23,12 +23,17 @@ jobs:
         add-to-path: false
     - uses: actions/checkout@v7
     - name: Configure ccache environment
-      run: echo "CCACHE_DIR=$RUNNER_TEMP/ccache" >> "$GITHUB_ENV"
+      id: ccache
+      env:
+        CACHE_KEY: srt-ccache-android-r23-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('CMakeLists.txt', 'cmake_object_lib_support.c', 'apps/**', 'common/**', 'configure', 'configure-data.tcl', 'haicrypt/**', 'scripts/**', 'srtcore/**') }}
+      run: |
+        echo "CCACHE_DIR=$RUNNER_TEMP/ccache" >> "$GITHUB_ENV"
+        echo "key=$CACHE_KEY" >> "$GITHUB_OUTPUT"
     - name: Restore ccache
       uses: actions/cache/restore@v6
       with:
         path: ${{ runner.temp }}/ccache
-        key: srt-ccache-android-r23-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('CMakeLists.txt', 'cmake_object_lib_support.c', 'apps/**', 'common/**', 'configure', 'configure-data.tcl', 'haicrypt/**', 'scripts/**', 'srtcore/**') }}
+        key: ${{ steps.ccache.outputs.key }}
         restore-keys: srt-ccache-android-r23-${{ runner.os }}-${{ runner.arch }}-
     - name: Set up ccache
       run: |
@@ -46,7 +51,7 @@ jobs:
       uses: actions/cache/save@v6
       with:
         path: ${{ runner.temp }}/ccache
-        key: srt-ccache-android-r23-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('CMakeLists.txt', 'cmake_object_lib_support.c', 'apps/**', 'common/**', 'configure', 'configure-data.tcl', 'haicrypt/**', 'scripts/**', 'srtcore/**') }}
+        key: ${{ steps.ccache.outputs.key }}
     - name: Show ccache statistics
       if: always()
       run: ccache --show-stats
diff --git a/AGENTS.md b/AGENTS.md
index 8f050772a..01cb8567b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -164,6 +164,10 @@ restore-only so untrusted code cannot seed executable compiler output. Every
 cache is capped at 200 MB, and CMake is wired through
 `CMAKE_C_COMPILER_LAUNCHER=ccache` and
 `CMAKE_CXX_COMPILER_LAUNCHER=ccache`.
+When a build can generate files beneath a hashed source glob, compute the key
+once from the clean post-checkout tree and reuse that immutable value for both
+restore and save. The Android workflow does this because `build-android`
+creates dependency and ABI output beneath its hashed `scripts/**` tree.
 
 | Workflow | Coverage |
 |----------|----------|