diff --git a/android/container_violations.go b/android/container_violations.go
index 4251484..efbc8da 100644
--- a/android/container_violations.go
+++ b/android/container_violations.go
@@ -15,6 +15,10 @@
 package android
 
 var ContainerDependencyViolationAllowlist = map[string][]string{
+	"adservices-service-core": {
+		"gson", // apex [com.android.adservices, com.android.extservices] -> apex [com.android.virt]
+	},
+
 	"android.car-module.impl": {
 		"modules-utils-preconditions", // apex [com.android.car.framework] -> apex [com.android.adservices, com.android.appsearch, com.android.cellbroadcast, com.android.extservices, com.android.ondevicepersonalization, com.android.tethering, com.android.uwb, com.android.wifi, test_com.android.cellbroadcast, test_com.android.wifi]
 	},
@@ -46,6 +50,11 @@
 		"modules-utils-shell-command-handler", // apex [com.android.car.framework] -> apex [com.android.adservices, com.android.art, com.android.art.debug, com.android.art.testing, com.android.btservices, com.android.configinfrastructure, com.android.mediaprovider, com.android.nfcservices, com.android.permission, com.android.scheduling, com.android.tethering, com.android.uwb, com.android.wifi, test_com.android.mediaprovider, test_com.android.permission, test_com.android.wifi, test_imgdiag_com.android.art, test_jitzygote_com.android.art]
 	},
 
+	"cellbroadcastreceiver_aconfig_flags_lib": {
+		"ext",       // apex [com.android.cellbroadcast, test_com.android.cellbroadcast] -> system
+		"framework", // apex [com.android.cellbroadcast, test_com.android.cellbroadcast] -> system
+	},
+
 	"connectivity-net-module-utils-bpf": {
 		"net-utils-device-common-struct-base", // apex [com.android.tethering] -> system
 	},
@@ -161,6 +170,10 @@
 		"framework", // cts -> unstable
 	},
 
+	"CtsAppFunctionTestCases": {
+		"framework", // cts -> unstable
+	},
+
 	"CtsAppOpsTestCases": {
 		"framework", // cts -> unstable
 	},
@@ -701,6 +714,10 @@
 		"framework", // cts -> unstable
 	},
 
+	"CtsTvInputTestCases": {
+		"framework", // cts -> unstable
+	},
+
 	"CtsTvTunerTestCases": {
 		"framework", // cts -> unstable
 	},
@@ -822,6 +839,10 @@
 		"app-compat-annotations", // apex [com.android.btservices] -> system
 	},
 
+	"framework-configinfrastructure.impl": {
+		"configinfra_framework_flags_java_lib", // apex [com.android.configinfrastructure] -> system
+	},
+
 	"framework-connectivity-t.impl": {
 		"app-compat-annotations",            // apex [com.android.tethering] -> system
 		"framework-connectivity-pre-jarjar", // apex [com.android.tethering] -> system
@@ -832,6 +853,7 @@
 	},
 
 	"framework-ondevicepersonalization.impl": {
+		"app-compat-annotations",            // apex [com.android.ondevicepersonalization] -> system
 		"ondevicepersonalization_flags_lib", // apex [com.android.ondevicepersonalization] -> system
 	},
 
diff --git a/apex/apex.go b/apex/apex.go
index 0e40d7c..381ff0f 100644
--- a/apex/apex.go
+++ b/apex/apex.go
@@ -147,9 +147,6 @@
 	// Default: true.
 	Installable *bool
 
-	// Deprecated. Do not use. TODO(b/350644693) remove this after removing all usage
-	Use_vndk_as_stable *bool
-
 	// The type of filesystem to use. Either 'ext4', 'f2fs' or 'erofs'. Default 'ext4'.
 	Payload_fs_type *string
 
@@ -157,10 +154,6 @@
 	// Default is false.
 	Ignore_system_library_special_case *bool
 
-	// Whenever apex_payload.img of the APEX should include dm-verity hashtree.
-	// Default value is true.
-	Generate_hashtree *bool
-
 	// Whenever apex_payload.img of the APEX should not be dm-verity signed. Should be only
 	// used in tests.
 	Test_only_unsigned_payload *bool
@@ -1336,11 +1329,6 @@
 	return !a.properties.PreventInstall && (a.properties.Installable == nil || proptools.Bool(a.properties.Installable))
 }
 
-// See the generate_hashtree property
-func (a *apexBundle) shouldGenerateHashtree() bool {
-	return proptools.BoolDefault(a.properties.Generate_hashtree, true)
-}
-
 // See the test_only_unsigned_payload property
 func (a *apexBundle) testOnlyShouldSkipPayloadSign() bool {
 	return proptools.Bool(a.properties.Test_only_unsigned_payload)
diff --git a/apex/apex_test.go b/apex/apex_test.go
index 6e92959..348b3c5 100644
--- a/apex/apex_test.go
+++ b/apex/apex_test.go
@@ -7446,7 +7446,6 @@
 	module := ctx.ModuleForTests("myapex", "android_common_myapex")
 	args := module.Rule("apexRule").Args
 	ensureContains(t, args["opt_flags"], "--manifest_json "+module.Output("apex_manifest.json").Output.String())
-	ensureNotContains(t, args["opt_flags"], "--no_hashtree")
 
 	// The copies of the libraries in the apex should have one more dependency than
 	// the ones outside the apex, namely the unwinder. Ideally we should check
diff --git a/apex/builder.go b/apex/builder.go
index e5ae106..41e2511 100644
--- a/apex/builder.go
+++ b/apex/builder.go
@@ -764,18 +764,6 @@
 	implicitInputs = append(implicitInputs, noticeAssetPath)
 	optFlags = append(optFlags, "--assets_dir "+filepath.Dir(noticeAssetPath.String()))
 
-	// Apexes which are supposed to be installed in builtin dirs(/system, etc)
-	// don't need hashtree for activation. Therefore, by removing hashtree from
-	// apex bundle (filesystem image in it, to be specific), we can save storage.
-	needHashTree := moduleMinSdkVersion.LessThanOrEqualTo(android.SdkVersion_Android10) ||
-		a.shouldGenerateHashtree()
-	if ctx.Config().ApexCompressionEnabled() && a.isCompressable() {
-		needHashTree = true
-	}
-	if !needHashTree {
-		optFlags = append(optFlags, "--no_hashtree")
-	}
-
 	if a.testOnlyShouldSkipPayloadSign() {
 		optFlags = append(optFlags, "--unsigned_payload")
 	}