diff --git a/FDroid/Android.mk b/FDroid/Android.mk
index 2fe22a8..9db520a 100644
--- a/FDroid/Android.mk
+++ b/FDroid/Android.mk
@@ -1,9 +1,9 @@
 LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE := FDroid
 LOCAL_SRC_FILES := FDroid.apk
 LOCAL_MODULE_CLASS := APPS
 LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
 LOCAL_CERTIFICATE := PRESIGNED
+LOCAL_PRODUCT_MODULE := true
 include $(BUILD_PREBUILT)
diff --git a/FDroidPrivilegedExtension/Android.mk b/FDroidPrivilegedExtension/Android.mk
index b6e8279..3c0cd63 100644
--- a/FDroidPrivilegedExtension/Android.mk
+++ b/FDroidPrivilegedExtension/Android.mk
@@ -2,14 +2,12 @@ LOCAL_PATH := $(call my-dir)
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := privapp-permissions-org.fdroid.fdroid.privileged.xml
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/permissions
+LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT_ETC)/permissions
 LOCAL_SRC_FILES := $(LOCAL_MODULE)
 include $(BUILD_PREBUILT)
 
 include $(CLEAR_VARS)
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE := FDroidPrivilegedExtension
 LOCAL_SRC_FILES := FDroidPrivilegedExtension.apk
 LOCAL_MODULE_CLASS := APPS
@@ -17,5 +15,6 @@ LOCAL_PRIVILEGED_MODULE := true
 LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
 LOCAL_CERTIFICATE := PRESIGNED
 LOCAL_REQUIRED_MODULES := privapp-permissions-org.fdroid.fdroid.privileged.xml
+LOCAL_PRODUCT_MODULE := true
 include $(BUILD_PREBUILT)
 
diff --git a/FakeStore/Android.mk b/FakeStore/Android.mk
index 74c8f26..63907ba 100644
--- a/FakeStore/Android.mk
+++ b/FakeStore/Android.mk
@@ -2,20 +2,26 @@ LOCAL_PATH := $(call my-dir)
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := privapp-permissions-com.android.vending.xml
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/permissions
+LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT_ETC)/permissions
+LOCAL_SRC_FILES := $(LOCAL_MODULE)
+include $(BUILD_PREBUILT)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := default-permissions-com.android.vending.xml
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT_ETC)/default-permissions
 LOCAL_SRC_FILES := $(LOCAL_MODULE)
 include $(BUILD_PREBUILT)
 
 include $(CLEAR_VARS)
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE := FakeStore
 LOCAL_SRC_FILES := FakeStore.apk
 LOCAL_MODULE_CLASS := APPS
 LOCAL_PRIVILEGED_MODULE := true
 LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
 LOCAL_CERTIFICATE := PRESIGNED
-LOCAL_REQUIRED_MODULES := privapp-permissions-com.android.vending.xml
+LOCAL_REQUIRED_MODULES := privapp-permissions-com.android.vending.xml default-permissions-com.android.vending.xml
+LOCAL_PRODUCT_MODULE := true
 include $(BUILD_PREBUILT)
 
diff --git a/FakeStore/default-permissions-com.android.vending.xml b/FakeStore/default-permissions-com.android.vending.xml
new file mode 100644
index 0000000..01f6aa2
--- /dev/null
+++ b/FakeStore/default-permissions-com.android.vending.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<exceptions>
+    <exception package="com.android.vending">
+        <!-- for permissive signature spoofing, where the permission is "dangerous" -->
+        <permission name="android.permission.FAKE_PACKAGE_SIGNATURE" fixed="false"/>
+    </exception>
+</exceptions>
diff --git a/FakeStore/privapp-permissions-com.android.vending.xml b/FakeStore/privapp-permissions-com.android.vending.xml
index 82f0402..1c718df 100644
--- a/FakeStore/privapp-permissions-com.android.vending.xml
+++ b/FakeStore/privapp-permissions-com.android.vending.xml
@@ -1,6 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <permissions>
     <privapp-permissions package="com.android.vending">
+        <!-- for restrictive signature spoofing, where the permission is "signature|privileged" -->
         <permission name="android.permission.FAKE_PACKAGE_SIGNATURE"/>
     </privapp-permissions>
 </permissions>
diff --git a/GmsCore/Android.mk b/GmsCore/Android.mk
index a8b5985..c92839d 100644
--- a/GmsCore/Android.mk
+++ b/GmsCore/Android.mk
@@ -2,22 +2,26 @@ LOCAL_PATH := $(call my-dir)
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := privapp-permissions-com.google.android.gms.xml
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/permissions
+LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT_ETC)/permissions
+LOCAL_SRC_FILES := $(LOCAL_MODULE)
+include $(BUILD_PREBUILT)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := default-permissions-com.google.android.gms.xml
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT_ETC)/default-permissions
 LOCAL_SRC_FILES := $(LOCAL_MODULE)
 include $(BUILD_PREBUILT)
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := sysconfig-com.google.android.gms.xml
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/sysconfig
+LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT_ETC)/sysconfig
 LOCAL_SRC_FILES := $(LOCAL_MODULE)
 include $(BUILD_PREBUILT)
 
 include $(CLEAR_VARS)
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE := GmsCore
 LOCAL_SRC_FILES := GmsCore.apk
 LOCAL_MODULE_CLASS := APPS
@@ -25,6 +29,8 @@ LOCAL_PRIVILEGED_MODULE := true
 LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
 LOCAL_CERTIFICATE := PRESIGNED
 LOCAL_OVERRIDES_PACKAGES := com.qualcomm.location
-LOCAL_REQUIRED_MODULES := privapp-permissions-com.google.android.gms.xml sysconfig-com.google.android.gms.xml
+LOCAL_REQUIRED_MODULES := privapp-permissions-com.google.android.gms.xml default-permissions-com.google.android.gms.xml sysconfig-com.google.android.gms.xml
+LOCAL_PRODUCT_MODULE := true
+LOCAL_USES_LIBRARIES := com.android.location.provider
 include $(BUILD_PREBUILT)
 
diff --git a/GmsCore/default-permissions-com.google.android.gms.xml b/GmsCore/default-permissions-com.google.android.gms.xml
new file mode 100644
index 0000000..d1d40be
--- /dev/null
+++ b/GmsCore/default-permissions-com.google.android.gms.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<exceptions>
+    <exception package="com.google.android.gms">
+        <!-- for permissive signature spoofing, where the permission is "dangerous" -->
+        <permission name="android.permission.FAKE_PACKAGE_SIGNATURE" fixed="false"/>
+    </exception>
+</exceptions>
diff --git a/GmsCore/privapp-permissions-com.google.android.gms.xml b/GmsCore/privapp-permissions-com.google.android.gms.xml
index 068be89..33b9554 100644
--- a/GmsCore/privapp-permissions-com.google.android.gms.xml
+++ b/GmsCore/privapp-permissions-com.google.android.gms.xml
@@ -1,9 +1,11 @@
 <?xml version="1.0" encoding="utf-8"?>
 <permissions>
     <privapp-permissions package="com.google.android.gms">
+        <!-- for restrictive signature spoofing, where the permission is "signature|privileged" -->
         <permission name="android.permission.FAKE_PACKAGE_SIGNATURE"/>
+
         <permission name="android.permission.INSTALL_LOCATION_PROVIDER"/>
         <permission name="android.permission.CHANGE_DEVICE_IDLE_TEMP_WHITELIST"/>
         <permission name="android.permission.UPDATE_APP_OPS_STATS"/>
-</privapp-permissions>
+    </privapp-permissions>
 </permissions>
diff --git a/GsfProxy/Android.mk b/GsfProxy/Android.mk
index a284908..248d922 100644
--- a/GsfProxy/Android.mk
+++ b/GsfProxy/Android.mk
@@ -1,9 +1,9 @@
 LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE := GsfProxy
 LOCAL_SRC_FILES := GsfProxy.apk
 LOCAL_MODULE_CLASS := APPS
 LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
 LOCAL_CERTIFICATE := PRESIGNED
+LOCAL_PRODUCT_MODULE := true
 include $(BUILD_PREBUILT)
diff --git a/IchnaeaNlpBackend/Android.mk b/IchnaeaNlpBackend/Android.mk
index c63ce3a..e98539f 100644
--- a/IchnaeaNlpBackend/Android.mk
+++ b/IchnaeaNlpBackend/Android.mk
@@ -1,9 +1,9 @@
 LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE := IchnaeaNlpBackend
 LOCAL_SRC_FILES := IchnaeaNlpBackend.apk
 LOCAL_MODULE_CLASS := APPS
 LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
 LOCAL_CERTIFICATE := PRESIGNED
+LOCAL_PRODUCT_MODULE := true
 include $(BUILD_PREBUILT)
diff --git a/NominatimGeocoderBackend/Android.mk b/NominatimGeocoderBackend/Android.mk
index 47838e8..1689d20 100644
--- a/NominatimGeocoderBackend/Android.mk
+++ b/NominatimGeocoderBackend/Android.mk
@@ -1,9 +1,9 @@
 LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE := NominatimGeocoderBackend
 LOCAL_SRC_FILES := NominatimGeocoderBackend.apk
 LOCAL_MODULE_CLASS := APPS
 LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
 LOCAL_CERTIFICATE := PRESIGNED
+LOCAL_PRODUCT_MODULE := true
 include $(BUILD_PREBUILT)
diff --git a/additional_repos.xml/Android.mk b/additional_repos.xml/Android.mk
index 7ad9d57..87892d4 100644
--- a/additional_repos.xml/Android.mk
+++ b/additional_repos.xml/Android.mk
@@ -2,9 +2,8 @@ LOCAL_PATH := $(call my-dir)
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := additional_repos.xml
-LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/org.fdroid.fdroid
+LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT_ETC)/org.fdroid.fdroid
 LOCAL_SRC_FILES := additional_repos.xml
 include $(BUILD_PREBUILT)