diff --git a/apex/apex_test.go b/apex/apex_test.go
index 66f0725..5b767ef 100644
--- a/apex/apex_test.go
+++ b/apex/apex_test.go
@@ -827,7 +827,7 @@
 	`)
 
 	// check the APEX keys
-	keys := ctx.ModuleForTests("myapex.key", "").Module().(*apexKey)
+	keys := ctx.ModuleForTests("myapex.key", "android_common").Module().(*apexKey)
 
 	if keys.public_key_file.String() != "vendor/foo/devkeys/testkey.avbpubkey" {
 		t.Errorf("public key %q is not %q", keys.public_key_file.String(),
@@ -1144,3 +1144,43 @@
 
 	ensureContains(t, copyCmds, "image.apex/bin/script/myscript.sh")
 }
+
+func TestApexInProductPartition(t *testing.T) {
+	ctx := testApex(t, `
+		apex {
+			name: "myapex",
+			key: "myapex.key",
+			native_shared_libs: ["mylib"],
+			product_specific: true,
+		}
+
+		apex_key {
+			name: "myapex.key",
+			public_key: "testkey.avbpubkey",
+			private_key: "testkey.pem",
+			product_specific: true,
+		}
+
+		cc_library {
+			name: "mylib",
+			srcs: ["mylib.cpp"],
+			system_shared_libs: [],
+			stl: "none",
+		}
+	`)
+
+	apex := ctx.ModuleForTests("myapex", "android_common_myapex").Module().(*apexBundle)
+	expected := "target/product/test_device/product/apex"
+	actual := apex.installDir.RelPathString()
+	if actual != expected {
+		t.Errorf("wrong install path. expected %q. actual %q", expected, actual)
+	}
+
+	apex_key := ctx.ModuleForTests("myapex.key", "android_common").Module().(*apexKey)
+	expected = "target/product/test_device/product/etc/security/apex"
+	actual = apex_key.installDir.RelPathString()
+	if actual != expected {
+		t.Errorf("wrong install path. expected %q. actual %q", expected, actual)
+	}
+
+}
diff --git a/apex/key.go b/apex/key.go
index 5d7c2fa..07c3105 100644
--- a/apex/key.go
+++ b/apex/key.go
@@ -17,6 +17,7 @@
 import (
 	"fmt"
 	"io"
+	"path/filepath"
 	"strings"
 
 	"android/soong/android"
@@ -38,6 +39,7 @@
 
 	public_key_file  android.Path
 	private_key_file android.Path
+	installDir       android.OutputPath
 
 	keyName string
 }
@@ -56,7 +58,8 @@
 func apexKeyFactory() android.Module {
 	module := &apexKey{}
 	module.AddProperties(&module.properties)
-	android.InitAndroidModule(module)
+	// This module is device-only
+	android.InitAndroidArchModule(module, android.DeviceSupported, android.MultilibCommon)
 	return module
 }
 
@@ -86,8 +89,9 @@
 	}
 	m.keyName = pubKeyName
 
+	m.installDir = android.PathForModuleInstall(ctx, "etc/security/apex")
 	if m.installable() {
-		ctx.InstallFile(android.PathForModuleInstall(ctx, "etc/security/apex"), m.keyName, m.public_key_file)
+		ctx.InstallFile(m.installDir, m.keyName, m.public_key_file)
 	}
 }
 
@@ -97,7 +101,7 @@
 		OutputFile: android.OptionalPathForPath(m.public_key_file),
 		Extra: []android.AndroidMkExtraFunc{
 			func(w io.Writer, outputFile android.Path) {
-				fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", "$(TARGET_OUT)/etc/security/apex")
+				fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", filepath.Join("$(OUT_DIR)", m.installDir.RelPathString()))
 				fmt.Fprintln(w, "LOCAL_INSTALLED_MODULE_STEM :=", m.keyName)
 				fmt.Fprintln(w, "LOCAL_UNINSTALLABLE_MODULE :=", !m.installable())
 			},