diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4e5050fe8f..348413fc1f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -153,6 +153,8 @@ jobs:
       - name: Checkout Code
         if: matrix.should_run == true
         uses: actions/checkout@v3
+        with:
+          submodules: recursive
 
       - name: Setup swap
         if: matrix.ghc == '8.10.7' && matrix.should_run == true
@@ -498,6 +500,8 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
+        with:
+          submodules: recursive
 
       - name: Prepare build
         uses: ./.github/actions/prepare-build
@@ -607,6 +611,8 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
+        with:
+          submodules: recursive
 
       - name: Prepare build
         uses: ./.github/actions/prepare-build
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000000..38bfea49c2
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "apps/multiplatform/external/nanohttpd/upstream"]
+	path = apps/multiplatform/external/nanohttpd/upstream
+	url = https://github.com/NanoHttpd/nanohttpd
diff --git a/apps/multiplatform/.gitignore b/apps/multiplatform/.gitignore
index bc00225c87..4762a9f2f4 100644
--- a/apps/multiplatform/.gitignore
+++ b/apps/multiplatform/.gitignore
@@ -16,6 +16,7 @@ android/build
 android/release
 common/build
 desktop/build
+external/nanohttpd/build
 release
 
 # Generated SimpleX assets
diff --git a/apps/multiplatform/README.md b/apps/multiplatform/README.md
index 54e17d4c4e..0d3c5b24f4 100644
--- a/apps/multiplatform/README.md
+++ b/apps/multiplatform/README.md
@@ -6,6 +6,15 @@ This is a guide to contributing to the develop of the SimpleX android and deskto
 
 This is the **Kotlin Multiplatform (KMP)** mobile and desktop client for SimpleX Chat, sharing code between Android and Desktop (JVM) platforms using Compose Multiplatform for UI.
 
+## Setup
+
+The desktop app builds nanohttpd from a submodule, Android does not use it. Before building
+the desktop app on a fresh checkout:
+
+```bash
+git submodule update --init --recursive
+```
+
 ## Build Commands
 
 ```bash
diff --git a/apps/multiplatform/common/build.gradle.kts b/apps/multiplatform/common/build.gradle.kts
index 1f55b9c660..43bc114f21 100644
--- a/apps/multiplatform/common/build.gradle.kts
+++ b/apps/multiplatform/common/build.gradle.kts
@@ -148,8 +148,7 @@ kotlin {
         implementation("org.slf4j:slf4j-simple:2.0.12")
         implementation("uk.co.caprica:vlcj:4.8.3")
         implementation("net.java.dev.jna:jna:5.14.0")
-        implementation("com.github.NanoHttpd.nanohttpd:nanohttpd:efb2ebf")
-        implementation("com.github.NanoHttpd.nanohttpd:nanohttpd-websocket:efb2ebf")
+        implementation(project(":external:nanohttpd"))
         implementation("com.squareup.okhttp3:okhttp:4.12.0")
       }
     }
diff --git a/apps/multiplatform/external/nanohttpd/build.gradle.kts b/apps/multiplatform/external/nanohttpd/build.gradle.kts
new file mode 100644
index 0000000000..fb24922208
--- /dev/null
+++ b/apps/multiplatform/external/nanohttpd/build.gradle.kts
@@ -0,0 +1,43 @@
+plugins {
+  `java-library`
+}
+
+// Built from the upstream submodule pinned at efb2ebf85a2b06f7c508aba9eaad5377e3a01e81, because
+// upstream never released the org.nanohttpd packages and JitPack no longer serves or builds that
+// commit. Only the core and websocket modules are used, the samples are not.
+group = "org.nanohttpd"
+version = "efb2ebf"
+
+val upstream = layout.projectDirectory.dir("upstream")
+
+sourceSets {
+  main {
+    java {
+      setSrcDirs(listOf(upstream.dir("core/src/main/java"), upstream.dir("websocket/src/main/java")))
+      exclude("org/nanohttpd/samples/**")
+    }
+    resources.setSrcDirs(listOf(upstream.dir("core/src/main/resources")))
+  }
+}
+
+java {
+  val jvmVersion = JavaVersion.toVersion(providers.gradleProperty("kotlin.jvm.target").get())
+  sourceCompatibility = jvmVersion
+  targetCompatibility = jvmVersion
+}
+
+// Without this the jar records the build machine's timestamps, file order and file modes,
+// which makes the desktop packages unreproducible
+tasks.jar {
+  // Checked here and not during configuration, so that Android builds, which don't use nanohttpd,
+  // work without the submodule
+  doFirst {
+    if (!upstream.file("core/src/main/java").asFile.isDirectory) {
+      throw GradleException("nanohttpd sources are missing, run: git submodule update --init --recursive")
+    }
+  }
+  isPreserveFileTimestamps = false
+  isReproducibleFileOrder = true
+  filePermissions { unix("644") }
+  dirPermissions { unix("755") }
+}
diff --git a/apps/multiplatform/external/nanohttpd/upstream b/apps/multiplatform/external/nanohttpd/upstream
new file mode 160000
index 0000000000..efb2ebf85a
--- /dev/null
+++ b/apps/multiplatform/external/nanohttpd/upstream
@@ -0,0 +1 @@
+Subproject commit efb2ebf85a2b06f7c508aba9eaad5377e3a01e81
diff --git a/apps/multiplatform/settings.gradle.kts b/apps/multiplatform/settings.gradle.kts
index 50a50d531d..461ae54fc3 100644
--- a/apps/multiplatform/settings.gradle.kts
+++ b/apps/multiplatform/settings.gradle.kts
@@ -18,4 +18,4 @@ pluginManagement {
 
 rootProject.name = "app"
 
-include(":android", ":desktop", ":common")
+include(":android", ":desktop", ":common", ":external:nanohttpd")
diff --git a/scripts/simplex-chat-reproduce-builds.sh b/scripts/simplex-chat-reproduce-builds.sh
index d512735bf1..d0f121c6ea 100755
--- a/scripts/simplex-chat-reproduce-builds.sh
+++ b/scripts/simplex-chat-reproduce-builds.sh
@@ -36,7 +36,8 @@ mkdir -p "${init_dir}/${TAG}-${repo_name}/from-source" "${init_dir}/${TAG}-${rep
 
 git -C "${tempdir}" clone "${repo}.git" &&\
     cd "${tempdir}/${repo_name}" &&\
-    git checkout "${TAG}"
+    git checkout "${TAG}" &&\
+    git submodule update --init --recursive
 
 oses="22.04@sha256:5c8b2c0a6c745bc177669abfaa716b4bc57d58e2ea3882fb5da67f4d59e3dda5 24.04@sha256:98ff7968124952e719a8a69bb3cccdd217f5fe758108ac4f21ad22e1df44d237"