How to fix the eSIM eUICC on a Google Pixel running GrapheneOS

Pretext: broken firmware

I have been running GrapheneOS for some years now, and recently bought a second hand Pixel 9.

After doing a full migration and installing apps, I realised the eSIM capability was broken. I spent a while having to hotspot from my old phone as a compromise. Not ideal.

After some digging it seems that the cause might have been:

• The device was enrolled in the Android developer programme by the previous owner.
• Google pushed out some updates that broke the firmware on the eUICC for the eSIM capabilities.
• There have been genuine reports of some Pixels being shipped with the eUICC broken on the hardware level, but the reports of broken eSIM capability were so wide-spread and across models that I was suspicious if this was actually firmware related.

Finally, a recent post on the GrapheneOS forums thread I have been following confirmed that suspicion.

A user posted a fix on a similar Google issue tracker thread and users started reporting a 5th August OTA update also came with a fix.

I subscribed to the GrapheneOS beta channel and updated to the 2026080500 update that should include the patch. No dice.

The Fix

I started writing a guide on how to apply this fix using GrapheneOS entirely and Magisk, avoiding the need to flash LineageOS. But the attempt failed due to missing ‘Network’ permissions on the eSIM updater utility on GrapheneOS.

See full details by expanding below:

The failed attempt to use GrapheneOS only!

This excellent XDA forums post has a guide to fix your vanilla Pixel eUICC.

I had to tweak this a little to work with Graphene, where root capability is a bit more of a pain:

1. Root Graphene

1. Update to the latest GrapheneOS via OTA.

2. Download the matching .zip image for the release image of your device model from the releases page

3. Extract the contents and save the init_boot.img file inside.

4. Use the Graphene web installer to unlock the bootloader (ensure OEM Unlocking is enabled on-device).

   Warning

   This will wipe your device!

5. Reboot the wiped device, follow setup, then copy the init_boot.img into your Downloads dir on the device. Also make sure you connect to an internet source for the chip flash later.

6. Download the latest Magisk release APK, and also copy this to your device Downloads.

7. Install Magisk, open. Install --> Select and Patch a File --> your init_boot.img file. It will output a magisk_patched-XXXXX.img to your Downloads dir. Copy it to your PC.

8. Ensure USB Debugging is enabled and you have platform-tools or similar for both adb & fastboot on your PC. Run the following:

   adb reboot bootloader
   fastboot flash init_boot magisk_patched-XXXXX.img
   fastboot reboot

You are now rooted.

2. Fix The eUICC

1. Run the following:

   adb shell
   su                              # grant the root prompt on-device
   resetprop ro.build.type eng
   resetprop ro.build.tags eng
   resetprop ro.debuggable 1
   setenforce 0
   stop && sleep 2 && start

2. Keep the adb shell open, wait for the framework to restart (the screen will bounce, this isn’t a full reboot), then:

   am start -n com.google.euiccpixel/com.google.euiccpixel.ui.OtaUpdateMenu

3. Find your config key in the linked XDA forum post or elsewhere. For a Pixel 9 it is P24 (ST54L).

4. Click the ‘Upgrade Firmware’ dropdown on your phone and select the GGL_P24_ST54L_GSMALIVE_534-1.1_DVT_CG7_v2 option. Note the xxx_P24_ST54L_xxx. DO NOT PROCEED if you get a warning, as it could brick your eSIM.

5. Then …

I got to this point in the writeup & found the eSIM updater app doesn’t have network permission on GrapheneOS.

Using some adb logcat I found that it gets to the point of the image handshake from the secure element, then dies the instant it does Sending HTTPS POST with “Unable to resolve host,”.

This means any attempt to update using this app is doomed to fail, and we can’t update the app permissions retroactively…

(I did a fair bit of debugging to confirm this was the case and it wasn’t firewalls, faulty internet, DNS resolution issues).

I decided to pivot and simply follow the XDA guide by installing LineageOS and MindTheGapps.

1. Install LineageOS

1. I flashed back to a clean public build using Google Flash Tool
2. Use the Graphene web installer to unlock the bootloader (ensure OEM Unlocking is enabled on-device). It’s just a fastboot flashing unlock frontend, so using it here is fine.
3. Boot Lineage. Connect Wi-Fi. Toggle USB debugging & Rooted debugging.

2. Update The euiccpixel Package

I had to update to vD.2.0.22 for this to work.

1. Download the official Pixel build for your device from Google.

2. Then get the pkg while keeping my filesystem clean:

   docker run --rm -it -v "$PWD":/work -w /work ubuntu:24.04 bash
   
   apt-get update -qq
   apt-get install -y -qq android-sdk-libsparse-utils e2fsprogs git python3 aapt unzip
   
   unzip -o tokay-cp2a.260805.005-factory-9b3ac3f4.zip
   cd tokay-cp2a.260805.005
   unzip -o image-tokay-*.zip
   
   for P in system_ext product; do
     rm -rf out_$P && mkdir out_$P
     debugfs -R "rdump / out_$P" $P.img >/dev/null 2>&1
   done
   find out_* -iname "*euicc*.apk" | grep -vi overlay | grep -vi EuiccGoogle | grep -vi Permissions
   # out_system_ext/priv-app/EuiccSupportPixel-P23/EuiccSupportPixel-P23.apk
   aapt dump badging out_system_ext/priv-app/EuiccSupportPixel-P23/EuiccSupportPixel-P23.apk | grep versionName
   # package: name='com.google.euiccpixel' versionCode='20225' versionName='D.2.0.22 (15551270)' platformBuildVersionName='D.2.0.22 (15551270)' platformBuildVersionCode='20225' compileSdkVersion='29' compileSdkVersionCodename='10'
   
   # Not ideal! The Google thread above suggests that people managed to get D.2.0.23
   # But I inspected the cert and it's valid until Jan 2027.
   # After testing, this version worked fine, see below.

3. As this was a huge pain in the ass and wasted hours of my life (trying to find D.2.0.23 unnecessarily), I have attached the EuiccSupportPixel-P23.apk extracted from tokay-cp2a.260805.005-factory-9b3ac3f4.zip for you to simply install and save the faff.

   Unmodified, but verify it anyway:

   sha256sum EuiccSupportPixel-P23.apk
   # 14b99f90faed25c23284a6008fabea4e6a2bdc583b8709a04b47859d007ad9a7

3. Fix The eUICC

1. Run the following:

   adb install -r EuiccSupportPixel-P23.apk
   adb root
   adb shell
   setenforce 0
   getenforce
   am start -S com.google.euiccpixel/.ui.OtaUpdateMenu

2. Find your config key in the linked XDA forum post or elsewhere. For a Pixel 9 it is P24 (ST54L).

3. Click the ‘Upgrade Firmware’ dropdown on your phone and select the GGL_P24_ST54L_GSMALIVE_534-1.1_DVT_CG7_v2 option. Note the xxx_P24_ST54L_xxx. DO NOT PROCEED if you get a warning, as it could brick your eSIM.

This should succeed! Check *#*#4636#*#* again for a positive memory value.

4. Reflash GrapheneOS

1. Simply use https://grapheneos.org/install/web to re-install as normal, then re-lock the bootloader.
2. Add an eSIM. Profit!?