diff --git a/service/Android.bp b/service/Android.bp
index 98bbbac..224fa19 100644
--- a/service/Android.bp
+++ b/service/Android.bp
@@ -157,7 +157,9 @@
         // against the implementation because the two libraries are in the same
         // APEX.
         "framework-connectivity-t.stubs.module_lib",
-        "framework-tethering",
+        // TODO: figure out why just using "framework-tethering" uses the stubs, even though both
+        // service-connectivity and framework-tethering are in the same APEX.
+        "framework-tethering.impl",
         "framework-wifi",
         "unsupportedappusage",
         "ServiceConnectivityResources",
@@ -166,6 +168,7 @@
     static_libs: [
         // Do not add libs here if they are already included
         // in framework-connectivity
+        "androidx.annotation_annotation",
         "connectivity-net-module-utils-bpf",
         "connectivity_native_aidl_interface-lateststable-java",
         "dnsresolver_aidl_interface-V9-java",
@@ -258,7 +261,7 @@
         "framework-annotations-lib",
         "framework-connectivity.impl",
         "framework-connectivity-t.impl",
-        "framework-tethering",
+        "framework-tethering.impl",
         "framework-wifi",
         "libprotobuf-java-nano",
     ],
diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index d547d83..e3e12fd 100755
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -286,6 +286,7 @@
 import com.android.server.connectivity.ProxyTracker;
 import com.android.server.connectivity.QosCallbackTracker;
 import com.android.server.connectivity.UidRangeUtils;
+import com.android.server.connectivity.wear.CompanionDeviceManagerProxyService;
 
 import libcore.io.IoUtils;
 
@@ -435,6 +436,7 @@
      */
     @GuardedBy("mTNSLock")
     private TestNetworkService mTNS;
+    private final CompanionDeviceManagerProxyService mCdmps;
 
     private final Object mTNSLock = new Object();
 
@@ -1586,6 +1588,12 @@
 
         mIngressRateLimit = ConnectivitySettingsManager.getIngressRateLimitInBytesPerSecond(
                 mContext);
+
+        if (SdkLevel.isAtLeastT()) {
+            mCdmps = new CompanionDeviceManagerProxyService(context);
+        } else {
+            mCdmps = null;
+        }
     }
 
     /**
@@ -11491,4 +11499,10 @@
 
         mBpfNetMaps.replaceUidChain(chain, uids);
     }
+
+    @Override
+    public IBinder getCompanionDeviceManagerProxyService() {
+        enforceNetworkStackPermission(mContext);
+        return mCdmps;
+    }
 }
diff --git a/service/src/com/android/server/connectivity/wear/CompanionDeviceManagerProxyService.java b/service/src/com/android/server/connectivity/wear/CompanionDeviceManagerProxyService.java
new file mode 100644
index 0000000..7e1cf5c
--- /dev/null
+++ b/service/src/com/android/server/connectivity/wear/CompanionDeviceManagerProxyService.java
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.connectivity.wear;
+
+import android.companion.AssociationInfo;
+import android.companion.CompanionDeviceManager;
+import android.content.Context;
+import android.net.wear.ICompanionDeviceManagerProxy;
+import android.os.Binder;
+import android.os.Build;
+
+import androidx.annotation.RequiresApi;
+
+import com.android.net.module.util.PermissionUtils;
+
+import java.util.List;
+
+/**
+ * A proxy for {@link CompanionDeviceManager}, for use by Tethering with NetworkStack permissions.
+ */
+public class CompanionDeviceManagerProxyService extends ICompanionDeviceManagerProxy.Stub {
+    private final Context mContext;
+
+    @RequiresApi(Build.VERSION_CODES.TIRAMISU)
+    public CompanionDeviceManagerProxyService(Context context) {
+        mContext = context;
+    }
+
+    @Override
+    public List<AssociationInfo> getAllAssociations() {
+        PermissionUtils.enforceNetworkStackPermission(mContext);
+        final long token = Binder.clearCallingIdentity();
+        try {
+            final CompanionDeviceManager cdm = mContext.getSystemService(
+                    CompanionDeviceManager.class);
+            return cdm.getAllAssociations();
+        } finally {
+            Binder.restoreCallingIdentity(token);
+        }
+    }
+}