diff --git a/netbpfload/Android.bp b/netbpfload/Android.bp
index 2b603fc..c39b46c 100644
--- a/netbpfload/Android.bp
+++ b/netbpfload/Android.bp
@@ -19,27 +19,15 @@
 }
 
 install_symlink {
-    name: "platform_ethtool_symlink",
+    name: "mainline_tethering_platform_components",
+
     symlink_target: "/apex/com.android.tethering/bin/ethtool",
     // installed_location is relative to /system because that's the default partition for soong
     // modules, unless we add something like `system_ext_specific: true` like in hwservicemanager.
     installed_location: "bin/ethtool",
-}
 
-install_symlink {
-    name: "platform_netbpfload_symlink",
-    symlink_target: "/apex/com.android.tethering/bin/netbpfload",
-    installed_location: "bin/netbpfload",
     init_rc: ["netbpfload.rc"],
-}
-
-phony {
-    name: "mainline_tethering_platform_components",
-    required: [
-        "bpfloader",
-        "platform_ethtool_symlink",
-        "platform_netbpfload_symlink",
-    ],
+    required: ["bpfloader"],
 }
 
 cc_binary {
diff --git a/netbpfload/netbpfload.rc b/netbpfload/netbpfload.rc
index 14181dc..e1af47f 100644
--- a/netbpfload/netbpfload.rc
+++ b/netbpfload/netbpfload.rc
@@ -17,15 +17,18 @@
 on load_bpf_programs
     exec_start bpfloader
 
-service bpfloader /system/bin/netbpfload
+# Note: This will actually execute /apex/com.android.tethering/bin/netbpfload
+# by virtue of 'service bpfloader' being overridden by the apex shipped .rc
+# Warning: most of the below settings are irrelevant unless the apex is missing.
+service bpfloader /system/bin/false
     # netbpfload will do network bpf loading, then execute /system/bin/bpfloader
-    capabilities CHOWN SYS_ADMIN NET_ADMIN
+    #! capabilities CHOWN SYS_ADMIN NET_ADMIN
     # The following group memberships are a workaround for lack of DAC_OVERRIDE
     # and allow us to open (among other things) files that we created and are
     # no longer root owned (due to CHOWN) but still have group read access to
     # one of the following groups.  This is not perfect, but a more correct
     # solution requires significantly more effort to implement.
-    group root graphics network_stack net_admin net_bw_acct net_bw_stats net_raw system
+    #! group root graphics network_stack net_admin net_bw_acct net_bw_stats net_raw system
     user root
     #
     # Set RLIMIT_MEMLOCK to 1GiB for bpfloader
@@ -55,7 +58,7 @@
     #
     # As such we simply use 1GiB as a reasonable approximation of infinity.
     #
-    rlimit memlock 1073741824 1073741824
+    #! rlimit memlock 1073741824 1073741824
     oneshot
     #
     # How to debug bootloops caused by 'bpfloader-failed'.
@@ -81,6 +84,5 @@
     #    'cannot prove return value is 0 or 1' or 'unsupported / unknown operation / helper',
     #    'invalid bpf_context access', etc.
     #
-    reboot_on_failure reboot,bpfloader-failed
-    # we're not really updatable, but want to be able to load bpf programs shipped in apexes
+    reboot_on_failure reboot,netbpfload-missing
     updatable