diff --git a/apex/key.go b/apex/key.go
index 5d7c2fa..07c3105 100644
--- a/apex/key.go
+++ b/apex/key.go
@@ -17,6 +17,7 @@
 import (
 	"fmt"
 	"io"
+	"path/filepath"
 	"strings"
 
 	"android/soong/android"
@@ -38,6 +39,7 @@
 
 	public_key_file  android.Path
 	private_key_file android.Path
+	installDir       android.OutputPath
 
 	keyName string
 }
@@ -56,7 +58,8 @@
 func apexKeyFactory() android.Module {
 	module := &apexKey{}
 	module.AddProperties(&module.properties)
-	android.InitAndroidModule(module)
+	// This module is device-only
+	android.InitAndroidArchModule(module, android.DeviceSupported, android.MultilibCommon)
 	return module
 }
 
@@ -86,8 +89,9 @@
 	}
 	m.keyName = pubKeyName
 
+	m.installDir = android.PathForModuleInstall(ctx, "etc/security/apex")
 	if m.installable() {
-		ctx.InstallFile(android.PathForModuleInstall(ctx, "etc/security/apex"), m.keyName, m.public_key_file)
+		ctx.InstallFile(m.installDir, m.keyName, m.public_key_file)
 	}
 }
 
@@ -97,7 +101,7 @@
 		OutputFile: android.OptionalPathForPath(m.public_key_file),
 		Extra: []android.AndroidMkExtraFunc{
 			func(w io.Writer, outputFile android.Path) {
-				fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", "$(TARGET_OUT)/etc/security/apex")
+				fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", filepath.Join("$(OUT_DIR)", m.installDir.RelPathString()))
 				fmt.Fprintln(w, "LOCAL_INSTALLED_MODULE_STEM :=", m.keyName)
 				fmt.Fprintln(w, "LOCAL_UNINSTALLABLE_MODULE :=", !m.installable())
 			},