diff --git a/TEST_MAPPING b/TEST_MAPPING
index 1db4baa..ef96d88 100644
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -1,9 +1,11 @@
 {
-  // Run in addition to mainline-presubmit as mainline-presubmit is not
-  // supported in every branch.
   "presubmit": [
+    // Run in addition to mainline-presubmit as mainline-presubmit is not
+    // supported in every branch.
+    // CtsNetTestCasesLatestSdk uses stable API shims, so does not exercise
+    // some latest APIs. Run CtsNetTestCases to get coverage of newer APIs.
     {
-      "name": "CtsNetTestCasesLatestSdk",
+      "name": "CtsNetTestCases",
       "options": [
         {
           "exclude-annotation": "com.android.testutils.SkipPresubmit"
diff --git a/tests/cts/net/Android.bp b/tests/cts/net/Android.bp
index 2a710c1..7df8228 100644
--- a/tests/cts/net/Android.bp
+++ b/tests/cts/net/Android.bp
@@ -47,7 +47,6 @@
     static_libs: [
         "bouncycastle-unbundled",
         "FrameworksNetCommonTests",
-        "TestNetworkStackLib",
         "core-tests-support",
         "cts-net-utils",
         "ctstestrunner-axt",
@@ -71,6 +70,10 @@
     name: "CtsNetTestCases",
     enabled: false, // Disabled in mainline-prod
     defaults: ["CtsNetTestCasesDefaults"],
+    // TODO: CTS should not depend on the entirety of the networkstack code.
+    static_libs: [
+        "NetworkStackApiCurrentLib",
+    ],
     test_suites: [
         "cts",
         "general-tests",
@@ -84,6 +87,10 @@
 android_test {
     name: "CtsNetTestCasesLatestSdk",
     defaults: ["CtsNetTestCasesDefaults"],
+    // TODO: CTS should not depend on the entirety of the networkstack code.
+    static_libs: [
+        "NetworkStackApiStableLib",
+    ],
     jni_uses_sdk_apis: true,
     min_sdk_version: "29",
     target_sdk_version: "30",
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index fad688b..2e273ee 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -110,6 +110,9 @@
 
 import com.android.internal.util.ArrayUtils;
 import com.android.modules.utils.build.SdkLevel;
+import com.android.networkstack.apishim.ConnectivityManagerShimImpl;
+import com.android.networkstack.apishim.ConstantsShim;
+import com.android.networkstack.apishim.common.ConnectivityManagerShim;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
 import com.android.testutils.RecorderCallback.CallbackEntry;
@@ -195,6 +198,7 @@
     private Context mContext;
     private Instrumentation mInstrumentation;
     private ConnectivityManager mCm;
+    private ConnectivityManagerShim mCmShim;
     private WifiManager mWifiManager;
     private PackageManager mPackageManager;
     private final HashMap<Integer, NetworkConfig> mNetworks =
@@ -207,6 +211,7 @@
         mInstrumentation = InstrumentationRegistry.getInstrumentation();
         mContext = mInstrumentation.getContext();
         mCm = (ConnectivityManager) mContext.getSystemService(Context.CONNECTIVITY_SERVICE);
+        mCmShim = ConnectivityManagerShimImpl.newInstance(mContext);
         mWifiManager = (WifiManager) mContext.getSystemService(Context.WIFI_SERVICE);
         mPackageManager = mContext.getPackageManager();
         mCtsNetUtils = new CtsNetUtils(mContext);
@@ -522,9 +527,9 @@
         mCm.registerDefaultNetworkCallback(defaultTrackingCallback);
 
         final TestNetworkCallback systemDefaultTrackingCallback = new TestNetworkCallback();
-        if (SdkLevel.isAtLeastS()) {
+        if (shouldTestSApis()) {
             runWithShellPermissionIdentity(() ->
-                    mCm.registerSystemDefaultNetworkCallback(systemDefaultTrackingCallback,
+                    mCmShim.registerSystemDefaultNetworkCallback(systemDefaultTrackingCallback,
                             new Handler(Looper.getMainLooper())),
                     NETWORK_SETTINGS);
         }
@@ -544,7 +549,7 @@
             assertNotNull("Did not receive onAvailable on default network callback",
                     defaultTrackingCallback.waitForAvailable());
 
-            if (SdkLevel.isAtLeastS()) {
+            if (shouldTestSApis()) {
                 assertNotNull("Did not receive onAvailable on system default network callback",
                         systemDefaultTrackingCallback.waitForAvailable());
             }
@@ -553,7 +558,7 @@
         } finally {
             mCm.unregisterNetworkCallback(callback);
             mCm.unregisterNetworkCallback(defaultTrackingCallback);
-            if (SdkLevel.isAtLeastS()) {
+            if (shouldTestSApis()) {
                 runWithShellPermissionIdentity(
                         () -> mCm.unregisterNetworkCallback(systemDefaultTrackingCallback),
                         NETWORK_SETTINGS);
@@ -1599,14 +1604,14 @@
         // Verify background network cannot be requested without NETWORK_SETTINGS permission.
         final TestableNetworkCallback callback = new TestableNetworkCallback();
         assertThrows(SecurityException.class,
-                () -> mCm.requestBackgroundNetwork(testRequest, null, callback));
+                () -> mCmShim.requestBackgroundNetwork(testRequest, null, callback));
 
         Network testNetwork = null;
         try {
             // Request background test network via Shell identity which has NETWORK_SETTINGS
             // permission granted.
             runWithShellPermissionIdentity(
-                    () -> mCm.requestBackgroundNetwork(testRequest, null, callback),
+                    () -> mCmShim.requestBackgroundNetwork(testRequest, null, callback),
                     new String[] { android.Manifest.permission.NETWORK_SETTINGS });
 
             // Register the test network agent which has no foreground request associated to it.
@@ -1646,4 +1651,12 @@
             mCm.unregisterNetworkCallback(callback);
         }
     }
+
+    /**
+     * Whether to test S+ APIs. This requires a) that the test be running on an S+ device, and
+     * b) that the code be compiled against shims new enough to access these APIs.
+     */
+    private boolean shouldTestSApis() {
+        return SdkLevel.isAtLeastS() && ConstantsShim.VERSION > Build.VERSION_CODES.R;
+    }
 }