diff --git a/java/aar.go b/java/aar.go
index 07392f6..1d05e48 100644
--- a/java/aar.go
+++ b/java/aar.go
@@ -107,6 +107,10 @@
 
 	// Names of aconfig_declarations modules that specify aconfig flags that the module depends on.
 	Flags_packages []string
+
+	// If set, `--non-updatable-system` flag is not passed to aapt2 even when
+	// `--version-code` is not specified in the `aaptFlags` property list or in the manifest.
+	DisableNonUpdatableSystem bool `blueprint:"mutated"`
 }
 
 type aapt struct {
@@ -308,9 +312,9 @@
 	// This behavior has been copied from Make.
 	linkFlags = append(linkFlags, "--target-sdk-version "+minSdkVersion)
 
-	// Version code
-	if !hasVersionCode {
-		linkFlags = append(linkFlags, "--version-code", ctx.Config().PlatformSdkVersion().String())
+	// Mark non updatable when the module does not specify a version code
+	if !a.aaptProperties.DisableNonUpdatableSystem && !hasVersionCode {
+		linkFlags = append(linkFlags, "--non-updatable-system")
 	}
 
 	if !hasVersionName {
diff --git a/java/app.go b/java/app.go
index a24099c..cd30dc1 100644
--- a/java/app.go
+++ b/java/app.go
@@ -1452,6 +1452,7 @@
 	module.appProperties.AlwaysPackageNativeLibs = true
 	module.Module.dexpreopter.isTest = true
 	module.Module.linter.properties.Lint.Test = proptools.BoolPtr(true)
+	module.aaptProperties.DisableNonUpdatableSystem = true
 
 	module.addHostAndDeviceProperties()
 	module.AddProperties(
@@ -1508,6 +1509,7 @@
 	module.appProperties.AlwaysPackageNativeLibs = true
 	module.Module.dexpreopter.isTest = true
 	module.Module.linter.properties.Lint.Test = proptools.BoolPtr(true)
+	module.aaptProperties.DisableNonUpdatableSystem = true
 
 	module.addHostAndDeviceProperties()
 	module.AddProperties(
diff --git a/java/app_test.go b/java/app_test.go
index 8049494..988a5b1 100644
--- a/java/app_test.go
+++ b/java/app_test.go
@@ -4477,5 +4477,54 @@
 		fooOverride.BuildParams.Args["args"],
 		"--minSdkVersion  33",
 	)
+}
 
+func TestNonUpdatableSystem(t *testing.T) {
+	ctx := testApp(t, `
+		android_app {
+			name: "foo",
+			srcs: ["a.java"],
+			sdk_version: "current",
+			aaptflags: [
+				"--version-code 1",
+			],
+		}
+		android_app {
+			name: "bar",
+			srcs: ["a.java"],
+			sdk_version: "current",
+		}
+		android_test {
+			name: "baz",
+			srcs: ["a.java"],
+			sdk_version: "current",
+		}
+		android_test_helper_app {
+			name: "baz_helper",
+			srcs: ["a.java"],
+			sdk_version: "current",
+		}
+	`)
+
+	hasNonUpdatableSystemFlag := func(module android.TestingModule) bool {
+		moduleAapt2LinkRule := module.Rule("android/soong/java.aapt2Link")
+		linkFlags := moduleAapt2LinkRule.Args["flags"]
+		return strings.Contains(linkFlags, "--non-updatable-system")
+	}
+
+	foo := ctx.ModuleForTests("foo", "android_common")
+	android.AssertBoolEquals(t, "app should not pass `--non-updatable-flags` when --version-code is specified",
+		false, hasNonUpdatableSystemFlag(foo))
+
+	bar := ctx.ModuleForTests("bar", "android_common")
+	android.AssertBoolEquals(t, "app should pass `--non-updatable-flags` when --version-code is not specified",
+		true, hasNonUpdatableSystemFlag(bar))
+
+	baz := ctx.ModuleForTests("baz", "android_common")
+	android.AssertBoolEquals(t, "test should not pass `--non-updatable-flags` even if --version-code is not specified",
+		false, hasNonUpdatableSystemFlag(baz))
+
+	baz_helper := ctx.ModuleForTests("baz_helper", "android_common")
+	android.AssertBoolEquals(t, "test should not pass `--non-updatable-flags` even if --version-code is not specified",
+		false, hasNonUpdatableSystemFlag(baz_helper))
 }