diff --git a/scripts/init-wireguard-submodule.sh b/scripts/init-wireguard-submodule.sh
index c33dbf5..734b83a 100755
--- a/scripts/init-wireguard-submodule.sh
+++ b/scripts/init-wireguard-submodule.sh
@@ -3,11 +3,34 @@
 set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$ROOT"
-if ! grep -q 'third-party/wireguard-android' .gitmodules 2>/dev/null; then
-  echo "error: .gitmodules missing third-party/wireguard-android — use repo .gitmodules from git" >&2
+
+SUB_PATH="third-party/wireguard-android"
+SUB_NAME="third-party/wireguard-android"
+
+if ! grep -q "$SUB_PATH" .gitmodules 2>/dev/null; then
+  echo "error: .gitmodules missing $SUB_PATH" >&2
   exit 1
 fi
-git submodule sync third-party/wireguard-android
-git submodule update --init --recursive third-party/wireguard-android
-echo "wireguard-android ready under third-party/wireguard-android"
-echo "Gradle includes :tunnel when third-party/wireguard-android/tunnel exists."
+
+# .gitmodules without a gitlink in the tree breaks plain `git submodule update`.
+if ! git cat-file -e "HEAD:$SUB_PATH" 2>/dev/null \
+   && ! git ls-files --stage "$SUB_PATH" | grep -q '^160000'; then
+  url="$(git config -f .gitmodules --get "submodule.$SUB_NAME.url" || true)"
+  if [ -z "$url" ]; then
+    echo "error: no url for submodule.$SUB_NAME in .gitmodules" >&2
+    exit 1
+  fi
+  sha="$(git ls-remote "$url" HEAD | awk 'NR==1 {print $1}')"
+  if [ -z "$sha" ]; then
+    echo "error: could not resolve HEAD for $url" >&2
+    exit 1
+  fi
+  echo "registering missing gitlink for $SUB_PATH at $sha"
+  git update-index --add --cacheinfo 160000,"$sha","$SUB_PATH"
+  echo "warning: gitlink was missing from the tree — commit third-party/wireguard-android after init" >&2
+fi
+
+git submodule sync "$SUB_PATH"
+git submodule update --init --recursive "$SUB_PATH"
+echo "wireguard-android ready under $SUB_PATH"
+echo "Gradle includes :tunnel when $SUB_PATH/tunnel exists."
diff --git a/third-party/wireguard-android b/third-party/wireguard-android
new file mode 160000
index 0000000..e7b3a3c
--- /dev/null
+++ b/third-party/wireguard-android
@@ -0,0 +1 @@
+Subproject commit e7b3a3c118836e112620b1302a8ba1873ad4daac