diff --git a/android/neverallow.go b/android/neverallow.go
index 0cb2029..f0d16b6 100644
--- a/android/neverallow.go
+++ b/android/neverallow.go
@@ -52,6 +52,7 @@
 	AddNeverAllowRules(createTrebleRules()...)
 	AddNeverAllowRules(createLibcoreRules()...)
 	AddNeverAllowRules(createMediaRules()...)
+	AddNeverAllowRules(createMediaProviderRules()...)
 	AddNeverAllowRules(createJavaDeviceForHostRules()...)
 }
 
@@ -159,6 +160,14 @@
 	}
 }
 
+func createMediaProviderRules() []Rule {
+	return []Rule{
+		NeverAllow().
+			With("libs", "framework-mediaprovider").
+			Because("framework-mediaprovider includes private APIs. Use framework_mediaprovider_stubs instead."),
+	}
+}
+
 func createJavaDeviceForHostRules() []Rule {
 	javaDeviceForHostProjectsWhitelist := []string{
 		"external/guava",
diff --git a/android/neverallow_test.go b/android/neverallow_test.go
index 6f07a4a..b57bb3f 100644
--- a/android/neverallow_test.go
+++ b/android/neverallow_test.go
@@ -203,6 +203,19 @@
 		},
 	},
 	{
+		name: "dependency on framework-mediaprovider",
+		fs: map[string][]byte{
+			"Android.bp": []byte(`
+				java_library {
+					name: "needs_framework_mediaprovider",
+					libs: ["framework-mediaprovider"],
+				}`),
+		},
+		expectedErrors: []string{
+			"framework-mediaprovider includes private APIs. Use framework_mediaprovider_stubs instead.",
+		},
+	},
+	{
 		name: "java_device_for_host",
 		fs: map[string][]byte{
 			"Android.bp": []byte(`
diff --git a/apex/apex.go b/apex/apex.go
index 79fdb71..a235ead 100644
--- a/apex/apex.go
+++ b/apex/apex.go
@@ -538,6 +538,7 @@
 		"android.hardware.configstore@1.1",
 		"android.hardware.graphics.allocator@2.0",
 		"android.hardware.graphics.allocator@3.0",
+		"android.hardware.graphics.allocator@4.0",
 		"android.hardware.graphics.bufferqueue@1.0",
 		"android.hardware.graphics.bufferqueue@2.0",
 		"android.hardware.graphics.common-ndk_platform",
@@ -550,6 +551,7 @@
 		"android.hardware.graphics.mapper@4.0",
 		"android.hardware.media.bufferpool@2.0",
 		"android.hardware.media.c2@1.0",
+		"android.hardware.media.c2@1.1",
 		"android.hardware.media.omx@1.0",
 		"android.hardware.media@1.0",
 		"android.hardware.media@1.0",
@@ -668,6 +670,7 @@
 		"libprocessgroup_headers",
 		"libscudo_wrapper",
 		"libsfplugin_ccodec_utils",
+		"libspeexresampler",
 		"libstagefright_amrnb_common",
 		"libstagefright_amrnbdec",
 		"libstagefright_amrnbenc",
@@ -730,6 +733,8 @@
 		"kotlinx-coroutines-core-nodeps",
 		"libprotobuf-java-lite",
 		"permissioncontroller-statsd",
+		"GooglePermissionController",
+		"PermissionController",
 	}
 	//
 	// Module separator
diff --git a/cc/config/vndk.go b/cc/config/vndk.go
index 54f693e..6f2e807 100644
--- a/cc/config/vndk.go
+++ b/cc/config/vndk.go
@@ -18,10 +18,12 @@
 // For these libraries, the vendor variants must be installed even if the device
 // has VndkUseCoreVariant set.
 var VndkMustUseVendorVariantList = []string{
+	"android.hardware.automotive.occupant_awareness-ndk_platform",
 	"android.hardware.light-ndk_platform",
 	"android.hardware.identity-ndk_platform",
 	"android.hardware.nfc@1.2",
 	"android.hardware.power-ndk_platform",
+	"android.hardware.rebootescrow-ndk_platform",
 	"android.hardware.vibrator-ndk_platform",
 	"libbinder",
 	"libcrypto",
diff --git a/java/config/config.go b/java/config/config.go
index 7f446e5..03588dc 100644
--- a/java/config/config.go
+++ b/java/config/config.go
@@ -37,6 +37,7 @@
 
 	InstrumentFrameworkModules = []string{
 		"framework",
+		"framework-minus-apex",
 		"telephony-common",
 		"services",
 		"android.car",
@@ -47,6 +48,7 @@
 		"core-libart",
 		// TODO: Could this be all updatable bootclasspath jars?
 		"updatable-media",
+		"framework-mediaprovider",
 		"framework-sdkextensions",
 		"ike",
 	}