diff --git a/ota/h5/index-stable.html b/ota/h5/index-stable.html
index 0a22af3..606be61 100644
--- a/ota/h5/index-stable.html
+++ b/ota/h5/index-stable.html
@@ -58,7 +58,7 @@ function checkUpdate(){
  var v=h5.min_version.replace(/[^0-9]/g,''),my=(document.getElementById('ver').innerText||'').replace(/[^0-9]/g,'');
  if(parseInt(my||'0')<parseInt(v||'0')){log('ERR: APK too old (need v'+h5.min_version+')');return}
  dlUrl=h5.url;dlSha=h5.sha256||'';
- if(!dlSha||/^0{64}$/.test(dlSha)){log('ERR: channel no build');return}
+ if(!dlSha||/^(0{64}|TBD)/.test(dlSha)){log('ERR: channel no build');return}
  if(h5.latest!==document.getElementById('ver').innerText){
   dlVer=h5.latest;document.getElementById('btnApply').classList.add('show');log('*** NEW VERSION ***')}
  else log('up to date')
diff --git a/packages/client-android/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock b/packages/client-android/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock
index 954802b..7cbc274 100644
Binary files a/packages/client-android/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock and b/packages/client-android/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock differ
diff --git a/packages/client-android/android/app/src/main/assets/frame.html b/packages/client-android/android/app/src/main/assets/frame.html
index e0668e0..f185378 100644
Binary files a/packages/client-android/android/app/src/main/assets/frame.html and b/packages/client-android/android/app/src/main/assets/frame.html differ
diff --git a/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt b/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
index 45e1563..c52185b 100644
--- a/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
+++ b/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
@@ -58,7 +58,7 @@ class MainActivity : AppCompatActivity() {
 
         @android.webkit.JavascriptInterface
         fun fetchText(path: String): String {
-            val safe = path.replace("..", "").replace("\\", "/")
+            val safe = path.replace("..", "").replace("..", "").replace("\\", "/")
             val url = "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota/$safe"
             return try {
                 URL(url).openConnection().apply { connectTimeout = 10000; readTimeout = 10000 }