diff --git a/.github/actions/build-android/action.yml b/.github/actions/build-android/action.yml
index 7ea46d2..d3fe023 100644
--- a/.github/actions/build-android/action.yml
+++ b/.github/actions/build-android/action.yml
@@ -18,6 +18,9 @@ outputs:
   bundle_path:
     description: 'Path to the built AAB bundle'
     value: ${{ steps.build-info.outputs.bundle_path }}
+  aar_path:
+    description: 'Path to the built NetBird Go library AAR'
+    value: gomobile/netbird.aar
 
 runs:
   using: 'composite'
@@ -83,4 +86,4 @@ runs:
       run: |
         BUILD_TYPE="${{ inputs.build_type }}"
         echo "apk_path=app/build/outputs/apk/${BUILD_TYPE}/netbird-${{ inputs.version_name }}.apk" >> $GITHUB_OUTPUT
-        echo "bundle_path=app/build/outputs/bundle/${BUILD_TYPE}/netbird-${{ inputs.version_name }}.aab" >> $GITHUB_OUTPUT
\ No newline at end of file
+        echo "bundle_path=app/build/outputs/bundle/${BUILD_TYPE}/netbird-${{ inputs.version_name }}.aab" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/build-debug.yml b/.github/workflows/build-debug.yml
index cdda328..e88de0d 100644
--- a/.github/workflows/build-debug.yml
+++ b/.github/workflows/build-debug.yml
@@ -3,6 +3,9 @@ name: build debug
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build-debug:
     runs-on: ubuntu-latest
@@ -36,3 +39,95 @@ jobs:
             ${{ steps.build.outputs.apk_path }}
             ${{ steps.build.outputs.bundle_path }}
           retention-days: 3
+
+      - name: Upload AAR artifact for tests
+        uses: actions/upload-artifact@v4
+        with:
+          name: netbird-aar
+          path: ${{ steps.build.outputs.aar_path }}
+          retention-days: 1
+
+  unit-tests:
+    needs: build-debug
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          java-version: "17"
+          distribution: "adopt"
+          cache: "gradle"
+
+      - name: Download AAR artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: netbird-aar
+          path: gomobile
+
+      - name: Run unit tests
+        run: ./gradlew test --no-daemon
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: unit-test-results
+          path: |
+            app/build/reports/tests/
+            tool/build/reports/tests/
+          retention-days: 3
+
+  instrumented-tests:
+    needs: build-debug
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          java-version: "17"
+          distribution: "adopt"
+          cache: "gradle"
+
+      - name: Download AAR artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: netbird-aar
+          path: gomobile
+
+      - name: Enable KVM group perms
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      - name: Run instrumented tests
+        uses: reactivecircus/android-emulator-runner@v2
+        with:
+          api-level: 30
+          target: google_apis
+          arch: x86_64
+          profile: pixel_3a
+          disk-size: 4096M
+          heap-size: 512M
+          disable-animations: true
+          script: ./gradlew connectedDebugAndroidTest --no-daemon
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: instrumented-test-results
+          path: |
+            app/build/reports/androidTests/
+            tool/build/reports/androidTests/
+          retention-days: 3
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 9f0df71..26ea5f9 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -4,6 +4,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: write
+
 jobs:
   build-release:
     runs-on: ubuntu-latest
@@ -56,4 +59,4 @@ jobs:
           files: |
             ${{ steps.build.outputs.apk_path }}
             ${{ steps.build.outputs.bundle_path }}
-          tag_name: ${{ github.event.release.tag_name }}
\ No newline at end of file
+          tag_name: ${{ github.event.release.tag_name }}