The problem was indeed the non-encrypted endpoint. I was able to work around it by adding the following line to my AndroidManifest.xml:
<application android:usesCleartextTraffic="true">
</application>
Thanks for putting me on the right track!