diff --git a/android/override_module.go b/android/override_module.go
index fa08566..97acc5c 100644
--- a/android/override_module.go
+++ b/android/override_module.go
@@ -215,7 +215,14 @@
 	ctx.BottomUp("override_deps", overrideModuleDepsMutator).Parallel()
 	ctx.TopDown("register_override", registerOverrideMutator).Parallel()
 	ctx.BottomUp("perform_override", performOverrideMutator).Parallel()
+	// overridableModuleDepsMutator calls OverridablePropertiesDepsMutator so that overridable modules can
+	// add deps from overridable properties.
 	ctx.BottomUp("overridable_deps", overridableModuleDepsMutator).Parallel()
+	// Because overridableModuleDepsMutator is run after PrebuiltPostDepsMutator,
+	// prebuilt's ReplaceDependencies doesn't affect to those deps added by overridable properties.
+	// By running PrebuiltPostDepsMutator again after overridableModuleDepsMutator, deps via overridable properties
+	// can be replaced with prebuilts.
+	ctx.BottomUp("replace_deps_on_prebuilts_for_overridable_deps_again", PrebuiltPostDepsMutator).Parallel()
 	ctx.BottomUp("replace_deps_on_override", replaceDepsOnOverridingModuleMutator).Parallel()
 }
 
diff --git a/android/testing.go b/android/testing.go
index 2992678..595e09b 100644
--- a/android/testing.go
+++ b/android/testing.go
@@ -788,10 +788,6 @@
 		return "<nil path>"
 	}
 	p := path.String()
-	// Allow absolute paths to /dev/
-	if strings.HasPrefix(p, "/dev/") {
-		return p
-	}
 	if w, ok := path.(WritablePath); ok {
 		rel, err := filepath.Rel(w.buildDir(), p)
 		if err != nil {
diff --git a/apex/apex_test.go b/apex/apex_test.go
index 991f5c9..3e5ba7f 100644
--- a/apex/apex_test.go
+++ b/apex/apex_test.go
@@ -5207,8 +5207,7 @@
 	}))
 
 	ensureExactContents(t, ctx, "myapex", "android_common_myapex_image", []string{
-		// TODO(b/181974714) - this is wrong it should be "app/AppFoo/AppFooPrebuilt.apk"
-		"app/AppFoo/AppFoo.apk",
+		"app/AppFoo/AppFooPrebuilt.apk",
 	})
 }
 
diff --git a/java/app_import.go b/java/app_import.go
index d69dd10..d38f63e 100644
--- a/java/app_import.go
+++ b/java/app_import.go
@@ -67,6 +67,9 @@
 	// module name in the form ":module". Should be empty if presigned or default_dev_cert is set.
 	Certificate *string
 
+	// Names of extra android_app_certificate modules to sign the apk with in the form ":module".
+	Additional_certificates []string
+
 	// Set this flag to true if the prebuilt apk is already signed. The certificate property must not
 	// be set for presigned modules.
 	Presigned *bool
@@ -156,6 +159,16 @@
 		ctx.AddDependency(ctx.Module(), certificateTag, cert)
 	}
 
+	for _, cert := range a.properties.Additional_certificates {
+		cert = android.SrcIsModule(cert)
+		if cert != "" {
+			ctx.AddDependency(ctx.Module(), certificateTag, cert)
+		} else {
+			ctx.PropertyErrorf("additional_certificates",
+				`must be names of android_app_certificate modules in the form ":module"`)
+		}
+	}
+
 	a.usesLibrary.deps(ctx, !a.isPrebuiltFrameworkRes())
 }
 
@@ -303,9 +316,6 @@
 		// If the certificate property is empty at this point, default_dev_cert must be set to true.
 		// Which makes processMainCert's behavior for the empty cert string WAI.
 		certificates = processMainCert(a.ModuleBase, String(a.properties.Certificate), certificates, ctx)
-		if len(certificates) != 1 {
-			ctx.ModuleErrorf("Unexpected number of certificates were extracted: %q", certificates)
-		}
 		a.certificate = certificates[0]
 		signed := android.PathForModuleOut(ctx, "signed", apkFilename)
 		var lineageFile android.Path
diff --git a/java/app_import_test.go b/java/app_import_test.go
index dc31d07..00406aa 100644
--- a/java/app_import_test.go
+++ b/java/app_import_test.go
@@ -109,16 +109,30 @@
 			name: "foo",
 			apk: "prebuilts/apk/app.apk",
 			certificate: "platform",
+			additional_certificates: [":additional_certificate"],
 			lineage: "lineage.bin",
 		}
+
+		android_app_certificate {
+			name: "additional_certificate",
+			certificate: "cert/additional_cert",
+		}
 	`)
 
 	variant := ctx.ModuleForTests("foo", "android_common")
 
-	// Check cert signing lineage flag.
 	signedApk := variant.Output("signed/foo.apk")
+	// Check certificates
+	certificatesFlag := signedApk.Args["certificates"]
+	expected := "build/make/target/product/security/platform.x509.pem " +
+		"build/make/target/product/security/platform.pk8 " +
+		"cert/additional_cert.x509.pem cert/additional_cert.pk8"
+	if expected != certificatesFlag {
+		t.Errorf("Incorrect certificates flags, expected: %q, got: %q", expected, certificatesFlag)
+	}
+	// Check cert signing lineage flag.
 	signingFlag := signedApk.Args["flags"]
-	expected := "--lineage lineage.bin"
+	expected = "--lineage lineage.bin"
 	if expected != signingFlag {
 		t.Errorf("Incorrect signing flags, expected: %q, got: %q", expected, signingFlag)
 	}
diff --git a/rust/config/allowed_list.go b/rust/config/allowed_list.go
index fc11d29..408d433 100644
--- a/rust/config/allowed_list.go
+++ b/rust/config/allowed_list.go
@@ -14,6 +14,7 @@
 		"external/rust",
 		"external/vm_tools/p9",
 		"frameworks/native/libs/binder/rust",
+		"frameworks/proto_logging/stats",
 		"packages/modules/DnsResolver",
 		"packages/modules/Virtualization",
 		"prebuilts/rust",