diff --git a/genrule/allowlists.go b/genrule/allowlists.go
index 02b1145..012c59c 100644
--- a/genrule/allowlists.go
+++ b/genrule/allowlists.go
@@ -115,6 +115,11 @@
 		"nos_app_weaver_service_genc++_headers",
 		"nos_app_weaver_service_genc++_mock",
 		"nos_generator_test_service_genc++",
+		"framework-cppstream-protos",
+		"framework-javastream-protos",
+		"aidl_camera_build_version",
+		"cronet_aml_base_android_runtime_unchecked_jni_headers",
+		"cronet_aml_base_android_runtime_jni_headers",
 	}
 
 	SandboxingDenyPathList = []string{
diff --git a/java/app_import.go b/java/app_import.go
index 8427217..e25bcd1 100644
--- a/java/app_import.go
+++ b/java/app_import.go
@@ -335,11 +335,19 @@
 	// Sign or align the package if package has not been preprocessed
 
 	if proptools.Bool(a.properties.Preprocessed) {
-		output := srcApk
+		var output android.WritablePath
 		if !proptools.Bool(a.properties.Skip_preprocessed_apk_checks) {
-			writableOutput := android.PathForModuleOut(ctx, "validated-prebuilt", apkFilename)
-			a.validatePreprocessedApk(ctx, srcApk, writableOutput)
-			output = writableOutput
+			output = android.PathForModuleOut(ctx, "validated-prebuilt", apkFilename)
+			a.validatePreprocessedApk(ctx, srcApk, output)
+		} else {
+			// If using the input APK unmodified, still make a copy of it so that the output filename has the
+			// right basename.
+			output = android.PathForModuleOut(ctx, apkFilename)
+			ctx.Build(pctx, android.BuildParams{
+				Rule:   android.Cp,
+				Input:  srcApk,
+				Output: output,
+			})
 		}
 		a.outputFile = output
 		a.certificate = PresignedCertificate