As Peter Braun and I talked, also change the name of the UPS secret to something deterministic while doing these work.
eg --> https://localhost:9000/dev-console/project/aaa/browse/secrets/ups-secret-myapp-android-l7pef
to --> https://localhost:9000/dev-console/project/aaa/browse/secrets/ups-secret-myapp-android

no need to add random bits because we only allow 1 variant/binding per client in UPS.