diff --git a/core/java/com/android/internal/pm/pkg/component/AconfigFlags.java b/core/java/com/android/internal/pm/pkg/component/AconfigFlags.java
index f306b0b..b873175 100644
--- a/core/java/com/android/internal/pm/pkg/component/AconfigFlags.java
+++ b/core/java/com/android/internal/pm/pkg/component/AconfigFlags.java
@@ -60,7 +60,13 @@
             "/product/etc/aconfig_flags.pb",
             "/vendor/etc/aconfig_flags.pb");
 
+    public enum Permission {
+        READ_WRITE,
+        READ_ONLY
+    }
+
     private final ArrayMap<String, Boolean> mFlagValues = new ArrayMap<>();
+    private final ArrayMap<String, Permission> mFlagPermissions = new ArrayMap<>();
 
     public AconfigFlags() {
         if (!Flags.manifestFlagging()) {
@@ -184,6 +190,12 @@
             Slog.v(LOG_TAG, "Read Aconfig default flag value "
                     + flagPackageAndName + " = " + flagValue);
             mFlagValues.put(flagPackageAndName, flagValue);
+
+            Permission permission = flag.permission == Aconfig.READ_ONLY
+                    ? Permission.READ_ONLY
+                    : Permission.READ_WRITE;
+
+            mFlagPermissions.put(flagPackageAndName, permission);
         }
     }
 
@@ -200,6 +212,17 @@
     }
 
     /**
+     * Get the flag permission, or null if the flag doesn't exist.
+     * @param flagPackageAndName Full flag name formatted as 'package.flag'
+     * @return the current permission of the given Aconfig flag, or null if there is no such flag
+     */
+    @Nullable
+    public Permission getFlagPermission(@NonNull String flagPackageAndName) {
+        Permission permission = mFlagPermissions.get(flagPackageAndName);
+        return permission;
+    }
+
+    /**
      * Check if the element in {@code parser} should be skipped because of the feature flag.
      * @param parser XML parser object currently parsing an element
      * @return true if the element is disabled because of its feature flag
diff --git a/packages/SettingsProvider/src/com/android/providers/settings/DeviceConfigService.java b/packages/SettingsProvider/src/com/android/providers/settings/DeviceConfigService.java
index e77cf2f..62cc103 100644
--- a/packages/SettingsProvider/src/com/android/providers/settings/DeviceConfigService.java
+++ b/packages/SettingsProvider/src/com/android/providers/settings/DeviceConfigService.java
@@ -42,6 +42,7 @@
 import android.provider.UpdatableDeviceConfigServiceReadiness;
 import android.util.Slog;
 
+import com.android.internal.pm.pkg.component.AconfigFlags;
 import com.android.internal.util.FastPrintWriter;
 
 import java.io.File;
@@ -425,7 +426,13 @@
                     DeviceConfig.setProperty(namespace, key, value, makeDefault);
                     break;
                 case OVERRIDE:
-                    DeviceConfig.setLocalOverride(namespace, key, value);
+                    AconfigFlags.Permission permission =
+                            (new AconfigFlags()).getFlagPermission(key);
+                    if (permission == AconfigFlags.Permission.READ_ONLY) {
+                        pout.println("cannot override read-only flag " + key);
+                    } else {
+                        DeviceConfig.setLocalOverride(namespace, key, value);
+                    }
                     break;
                 case CLEAR_OVERRIDE:
                     DeviceConfig.clearLocalOverride(namespace, key);