diff --git a/javalib/src/android/system/virtualmachine/VirtualMachineConfig.java b/javalib/src/android/system/virtualmachine/VirtualMachineConfig.java
index a6381ac..e577f40 100644
--- a/javalib/src/android/system/virtualmachine/VirtualMachineConfig.java
+++ b/javalib/src/android/system/virtualmachine/VirtualMachineConfig.java
@@ -49,6 +49,7 @@
 import java.io.OutputStream;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
+import java.util.Collections;
 import java.util.Objects;
 import java.util.zip.ZipFile;
 
@@ -519,6 +520,7 @@
             VirtualMachinePayloadConfig payloadConfig = new VirtualMachinePayloadConfig();
             payloadConfig.payloadBinaryName = mPayloadBinaryName;
             payloadConfig.osName = mOs;
+            payloadConfig.extraApks = Collections.emptyList();
             vsConfig.payload =
                     VirtualMachineAppConfig.Payload.payloadConfig(payloadConfig);
         } else {
diff --git a/microdroid/fstab.microdroid b/microdroid/fstab.microdroid
index 2742757..3209442 100644
--- a/microdroid/fstab.microdroid
+++ b/microdroid/fstab.microdroid
@@ -2,4 +2,4 @@
 # This is a temporary solution to unblock other devs that depend on /vendor partition in Microdroid
 # The /vendor partition will only be mounted if the kernel cmdline contains
 # androidboot.microdroid.mount_vendor=1.
-/dev/block/by-name/microdroid-vendor /vendor ext4 noatime,ro,errors=panic wait,first_stage_mount,avb_hashtree_digest=/sys/firmware/devicetree/base/avf/vendor_hashtree_descriptor_root_digest
+/dev/block/by-name/microdroid-vendor /vendor ext4 noatime,ro,errors=panic wait,first_stage_mount,avb_hashtree_digest=/proc/device-tree/avf/vendor_hashtree_descriptor_root_digest
diff --git a/microdroid/init_debug_policy/src/init_debug_policy.rs b/microdroid/init_debug_policy/src/init_debug_policy.rs
index 6c80926..90d04ac 100644
--- a/microdroid/init_debug_policy/src/init_debug_policy.rs
+++ b/microdroid/init_debug_policy/src/init_debug_policy.rs
@@ -29,11 +29,10 @@
 }
 
 fn main() -> Result<(), PropertyWatcherError> {
-    // If VM is debuggable or debug policy says so, send logs to outside ot the VM via the serial console.
-    // Otherwise logs are internally consumed at /dev/null
+    // If VM is debuggable or debug policy says so, send logs to outside ot the VM via the serial
+    // console. Otherwise logs are internally consumed at /dev/null
     let log_path = if system_properties::read_bool("ro.boot.microdroid.debuggable", false)?
-        || get_debug_policy_bool("/sys/firmware/devicetree/base/avf/guest/common/log")
-            .unwrap_or_default()
+        || get_debug_policy_bool("/proc/device-tree/avf/guest/common/log").unwrap_or_default()
     {
         "/dev/hvc2"
     } else {
@@ -42,8 +41,7 @@
     system_properties::write("ro.log.file_logger.path", log_path)?;
 
     let (adbd_enabled, debuggable) = if system_properties::read_bool("ro.boot.adb.enabled", false)?
-        || get_debug_policy_bool("/sys/firmware/devicetree/base/avf/guest/microdroid/adb")
-            .unwrap_or_default()
+        || get_debug_policy_bool("/proc/device-tree/avf/guest/microdroid/adb").unwrap_or_default()
     {
         // debuggable is required for adb root and bypassing adb authorization.
         ("1", "1")
diff --git a/microdroid/payload/metadata.proto b/microdroid/payload/metadata.proto
index b03d466..e47fc83 100644
--- a/microdroid/payload/metadata.proto
+++ b/microdroid/payload/metadata.proto
@@ -74,4 +74,8 @@
   // Required.
   // Name of the payload binary file inside the APK.
   string payload_binary_name = 1;
+
+  // Optional.
+  // The number of extra APKs that are present.
+  uint32 extra_apk_count = 2;
 }
diff --git a/microdroid_manager/src/main.rs b/microdroid_manager/src/main.rs
index 16607c2..86284a5 100644
--- a/microdroid_manager/src/main.rs
+++ b/microdroid_manager/src/main.rs
@@ -43,7 +43,7 @@
 use libc::VMADDR_CID_HOST;
 use log::{error, info};
 use microdroid_metadata::PayloadMetadata;
-use microdroid_payload_config::{OsConfig, Task, TaskType, VmPayloadConfig};
+use microdroid_payload_config::{ApkConfig, OsConfig, Task, TaskType, VmPayloadConfig};
 use nix::sys::signal::Signal;
 use openssl::hkdf::hkdf;
 use openssl::md::Md;
@@ -68,11 +68,11 @@
 use vm_secret::VmSecret;
 
 const WAIT_TIMEOUT: Duration = Duration::from_secs(10);
-const AVF_STRICT_BOOT: &str = "/sys/firmware/devicetree/base/chosen/avf,strict-boot";
-const AVF_NEW_INSTANCE: &str = "/sys/firmware/devicetree/base/chosen/avf,new-instance";
-const AVF_DEBUG_POLICY_RAMDUMP: &str = "/sys/firmware/devicetree/base/avf/guest/common/ramdump";
+const AVF_STRICT_BOOT: &str = "/proc/device-tree/chosen/avf,strict-boot";
+const AVF_NEW_INSTANCE: &str = "/proc/device-tree/chosen/avf,new-instance";
+const AVF_DEBUG_POLICY_RAMDUMP: &str = "/proc/device-tree/avf/guest/common/ramdump";
 const DEBUG_MICRODROID_NO_VERIFIED_BOOT: &str =
-    "/sys/firmware/devicetree/base/virtualization/guest/debug-microdroid,no-verified-boot";
+    "/proc/device-tree/virtualization/guest/debug-microdroid,no-verified-boot";
 
 const ENCRYPTEDSTORE_BIN: &str = "/system/bin/encryptedstore";
 const ZIPFUSE_BIN: &str = "/system/bin/zipfuse";
@@ -580,11 +580,15 @@
                 type_: TaskType::MicrodroidLauncher,
                 command: payload_config.payload_binary_name,
             };
+            // We don't care about the paths, only the number of extra APKs really matters.
+            let extra_apks = (0..payload_config.extra_apk_count)
+                .map(|i| ApkConfig { path: format!("extra-apk-{i}") })
+                .collect();
             Ok(VmPayloadConfig {
                 os: OsConfig { name: "microdroid".to_owned() },
                 task: Some(task),
                 apexes: vec![],
-                extra_apks: vec![],
+                extra_apks,
                 prefer_staged: false,
                 export_tombstones: None,
                 enable_authfs: false,
diff --git a/microdroid_manager/src/vm_secret.rs b/microdroid_manager/src/vm_secret.rs
index 35acdd3..0e1ec71 100644
--- a/microdroid_manager/src/vm_secret.rs
+++ b/microdroid_manager/src/vm_secret.rs
@@ -20,7 +20,7 @@
 use secretkeeper_comm::data_types::request::Request;
 use binder::{Strong};
 use coset::CborSerializable;
-use dice_policy_builder::{ConstraintSpec, ConstraintType, policy_for_dice_chain, MissingAction};
+use dice_policy_builder::{CertIndex, ConstraintSpec, ConstraintType, policy_for_dice_chain, MissingAction, WILDCARD_FULL_ARRAY};
 use diced_open_dice::{DiceArtifacts, OwnedDiceArtifacts};
 use keystore2_crypto::ZVec;
 use openssl::hkdf::hkdf;
@@ -41,6 +41,12 @@
 const MODE: i64 = -4670551;
 const CONFIG_DESC: i64 = -4670548;
 const SECURITY_VERSION: i64 = -70005;
+const SUBCOMPONENT_DESCRIPTORS: i64 = -71002;
+const SUBCOMPONENT_SECURITY_VERSION: i64 = 2;
+const SUBCOMPONENT_AUTHORITY_HASH: i64 = 4;
+// Index of DiceChainEntry corresponding to Payload (relative to the end considering DICE Chain
+// as an array)
+const PAYLOAD_INDEX_FROM_END: usize = 0;
 
 // Generated using hexdump -vn32 -e'14/1 "0x%02X, " 1 "\n"' /dev/urandom
 const SALT_ENCRYPTED_STORE: &[u8] = &[
@@ -161,15 +167,51 @@
 //    components may chose to prevent booting of rollback images for ex, ABL is expected to provide
 //    rollback protection of pvmfw. Such components may chose to not put SECURITY_VERSION in the
 //    corresponding DiceChainEntry.
-// TODO(b/291219197) : Add constraints on Extra apks as well!
+//  4. For each Subcomponent on the last DiceChainEntry (which corresponds to VM payload, See
+//     microdroid_manager/src/vm_config.cddl):
+//       - GreaterOrEqual on SECURITY_VERSION (Required)
+//       - ExactMatch on AUTHORITY_HASH (Required).
 fn sealing_policy(dice: &[u8]) -> Result<Vec<u8>, String> {
     let constraint_spec = [
-        ConstraintSpec::new(ConstraintType::ExactMatch, vec![AUTHORITY_HASH], MissingAction::Fail),
-        ConstraintSpec::new(ConstraintType::ExactMatch, vec![MODE], MissingAction::Fail),
+        ConstraintSpec::new(
+            ConstraintType::ExactMatch,
+            vec![AUTHORITY_HASH],
+            MissingAction::Fail,
+            CertIndex::All,
+        ),
+        ConstraintSpec::new(
+            ConstraintType::ExactMatch,
+            vec![MODE],
+            MissingAction::Fail,
+            CertIndex::All,
+        ),
         ConstraintSpec::new(
             ConstraintType::GreaterOrEqual,
             vec![CONFIG_DESC, SECURITY_VERSION],
             MissingAction::Ignore,
+            CertIndex::All,
+        ),
+        ConstraintSpec::new(
+            ConstraintType::GreaterOrEqual,
+            vec![
+                CONFIG_DESC,
+                SUBCOMPONENT_DESCRIPTORS,
+                WILDCARD_FULL_ARRAY,
+                SUBCOMPONENT_SECURITY_VERSION,
+            ],
+            MissingAction::Fail,
+            CertIndex::FromEnd(PAYLOAD_INDEX_FROM_END),
+        ),
+        ConstraintSpec::new(
+            ConstraintType::ExactMatch,
+            vec![
+                CONFIG_DESC,
+                SUBCOMPONENT_DESCRIPTORS,
+                WILDCARD_FULL_ARRAY,
+                SUBCOMPONENT_AUTHORITY_HASH,
+            ],
+            MissingAction::Fail,
+            CertIndex::FromEnd(PAYLOAD_INDEX_FROM_END),
         ),
     ];
 
diff --git a/tests/benchmark/src/java/com/android/microdroid/benchmark/MicrodroidBenchmarks.java b/tests/benchmark/src/java/com/android/microdroid/benchmark/MicrodroidBenchmarks.java
index e0de9b3..b9faa85 100644
--- a/tests/benchmark/src/java/com/android/microdroid/benchmark/MicrodroidBenchmarks.java
+++ b/tests/benchmark/src/java/com/android/microdroid/benchmark/MicrodroidBenchmarks.java
@@ -278,9 +278,7 @@
 
     @Test
     public void testMicrodroidDebugBootTime_withVendorPartition() throws Exception {
-        assume().withMessage(
-                        "Cuttlefish doesn't support device tree under"
-                                + " /sys/firmware/devicetree/base")
+        assume().withMessage("Cuttlefish doesn't support device tree under" + " /proc/device-tree")
                 .that(isCuttlefish())
                 .isFalse();
         // TODO(b/317567210): Boots fails with vendor partition in HWASAN enabled microdroid
diff --git a/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java b/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
index 1739eab..7a5d69b 100644
--- a/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
+++ b/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
@@ -938,7 +938,7 @@
         assumeFalse("Unlocked devices may have AVF debug policy", lockProp.equals("orange"));
 
         // Test that AVF debug policy doesn't exist.
-        boolean hasDebugPolicy = device.doesFileExist("/sys/firmware/devicetree/base/avf");
+        boolean hasDebugPolicy = device.doesFileExist("/proc/device-tree/avf");
         assertThat(hasDebugPolicy).isFalse();
     }
 
diff --git a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
index 33d41ab..3d83f40 100644
--- a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
+++ b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
@@ -2105,8 +2105,7 @@
     public void configuringVendorDiskImageRequiresCustomPermission() throws Exception {
         assumeSupportedDevice();
         assumeFalse(
-                "Cuttlefish doesn't support device tree under /sys/firmware/devicetree/base",
-                isCuttlefish());
+                "Cuttlefish doesn't support device tree under /proc/device-tree", isCuttlefish());
         // TODO(b/317567210): Boots fails with vendor partition in HWASAN enabled microdroid
         // after introducing verification based on DT and fstab in microdroid vendor partition.
         assumeFalse(
@@ -2136,8 +2135,7 @@
     public void bootsWithVendorPartition() throws Exception {
         assumeSupportedDevice();
         assumeFalse(
-                "Cuttlefish doesn't support device tree under /sys/firmware/devicetree/base",
-                isCuttlefish());
+                "Cuttlefish doesn't support device tree under /proc/device-tree", isCuttlefish());
         // TODO(b/317567210): Boots fails with vendor partition in HWASAN enabled microdroid
         // after introducing verification based on DT and fstab in microdroid vendor partition.
         assumeFalse(
@@ -2177,8 +2175,7 @@
     public void creationFailsWithUnsignedVendorPartition() throws Exception {
         assumeSupportedDevice();
         assumeFalse(
-                "Cuttlefish doesn't support device tree under /sys/firmware/devicetree/base",
-                isCuttlefish());
+                "Cuttlefish doesn't support device tree under /proc/device-tree", isCuttlefish());
         // TODO(b/317567210): Boots fails with vendor partition in HWASAN enabled microdroid
         // after introducing verification based on DT and fstab in microdroid vendor partition.
         assumeFalse(
diff --git a/virtualizationmanager/Android.bp b/virtualizationmanager/Android.bp
index f58e999..48b5cd1 100644
--- a/virtualizationmanager/Android.bp
+++ b/virtualizationmanager/Android.bp
@@ -36,10 +36,10 @@
         "libbase_rust",
         "libbinder_rs",
         "libclap",
+        "libcstr",
         "libcommand_fds",
         "libdisk",
         "libglob",
-        "libhex",
         "libhypervisor_props",
         "liblazy_static",
         "liblibc",
@@ -60,12 +60,12 @@
         "libshared_child",
         "libstatslog_virtualization_rust",
         "libtombstoned_client_rust",
-        "libvbmeta_rust",
         "libvm_control",
         "libvmconfig",
         "libzip",
         "libvsock",
         "liblibfdt",
+        "libfsfdt",
         // TODO(b/202115393) stabilize the interface
         "packagemanager_aidl-rust",
     ],
diff --git a/virtualizationmanager/fsfdt/src/lib.rs b/virtualizationmanager/fsfdt/src/lib.rs
index cda2fe1..a2ca519 100644
--- a/virtualizationmanager/fsfdt/src/lib.rs
+++ b/virtualizationmanager/fsfdt/src/lib.rs
@@ -16,7 +16,7 @@
 
 use anyhow::{anyhow, Context, Result};
 use libfdt::Fdt;
-use std::ffi::CString;
+use std::ffi::{CStr, CString};
 use std::fs;
 use std::os::unix::ffi::OsStrExt;
 use std::path::Path;
@@ -25,6 +25,9 @@
 pub trait FsFdt<'a> {
     /// Creates a Fdt from /proc/device-tree style directory by wrapping a mutable slice
     fn from_fs(fs_path: &Path, fdt_buffer: &'a mut [u8]) -> Result<&'a mut Self>;
+
+    /// Appends a FDT from /proc/device-tree style directory at the given node path
+    fn append(&mut self, fdt_node_path: &CStr, fs_path: &Path) -> Result<()>;
 }
 
 impl<'a> FsFdt<'a> for Fdt {
@@ -32,6 +35,12 @@
         let fdt = Fdt::create_empty_tree(fdt_buffer)
             .map_err(|e| anyhow!("Failed to create FDT, {e:?}"))?;
 
+        fdt.append(&CString::new("").unwrap(), fs_path)?;
+
+        Ok(fdt)
+    }
+
+    fn append(&mut self, fdt_node_path: &CStr, fs_path: &Path) -> Result<()> {
         // Recursively traverse fs_path with DFS algorithm.
         let mut stack = vec![fs_path.to_path_buf()];
         while let Some(dir_path) = stack.pop() {
@@ -39,14 +48,15 @@
                 .strip_prefix(fs_path)
                 .context("Internal error. Path does not have expected prefix")?
                 .as_os_str();
-            let fdt_path =
-                CString::from_vec_with_nul([b"/", relative_path.as_bytes(), b"\0"].concat())
-                    .context("Internal error. Path is not a valid Fdt path")?;
+            let fdt_path = CString::from_vec_with_nul(
+                [fdt_node_path.to_bytes(), b"/", relative_path.as_bytes(), b"\0"].concat(),
+            )
+            .context("Internal error. Path is not a valid Fdt path")?;
 
-            let mut node = fdt
+            let mut node = self
                 .node_mut(&fdt_path)
                 .map_err(|e| anyhow!("Failed to write FDT, {e:?}"))?
-                .ok_or_else(|| anyhow!("Internal error when writing VM reference DT"))?;
+                .ok_or_else(|| anyhow!("Failed to find {fdt_node_path:?} in FDT"))?;
 
             let mut subnode_names = vec![];
             let entries =
@@ -85,6 +95,6 @@
                 .map_err(|e| anyhow!("Failed to add node, {e:?}"))?;
         }
 
-        Ok(fdt)
+        Ok(())
     }
 }
diff --git a/virtualizationmanager/src/aidl.rs b/virtualizationmanager/src/aidl.rs
index 34994f8..602c670 100644
--- a/virtualizationmanager/src/aidl.rs
+++ b/virtualizationmanager/src/aidl.rs
@@ -15,13 +15,13 @@
 //! Implementation of the AIDL interface of the VirtualizationService.
 
 use crate::{get_calling_pid, get_calling_uid};
-use crate::atom::{
-    write_vm_booted_stats, write_vm_creation_stats};
+use crate::atom::{write_vm_booted_stats, write_vm_creation_stats};
 use crate::composite::make_composite_image;
 use crate::crosvm::{CrosvmConfig, DiskFile, PayloadState, VmContext, VmInstance, VmState};
 use crate::debug_config::DebugConfig;
 use crate::payload::{add_microdroid_payload_images, add_microdroid_system_images, add_microdroid_vendor_image};
 use crate::selinux::{getfilecon, SeContext};
+use crate::reference_dt;
 use android_os_permissions_aidl::aidl::android::os::IPermissionController;
 use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::{
     Certificate::Certificate,
@@ -71,16 +71,15 @@
 use disk::QcowFile;
 use glob::glob;
 use lazy_static::lazy_static;
-use libfdt::Fdt;
 use log::{debug, error, info, warn};
-use microdroid_payload_config::{OsConfig, Task, TaskType, VmPayloadConfig};
+use microdroid_payload_config::{ApkConfig, OsConfig, Task, TaskType, VmPayloadConfig};
 use nix::unistd::pipe;
 use rpcbinder::RpcServer;
 use rustutils::system_properties;
 use semver::VersionReq;
 use std::collections::HashSet;
 use std::convert::TryInto;
-use std::ffi::{CStr, CString};
+use std::ffi::CStr;
 use std::fs::{canonicalize, read_dir, remove_file, File, OpenOptions};
 use std::io::{BufRead, BufReader, Error, ErrorKind, Seek, SeekFrom, Write};
 use std::iter;
@@ -89,7 +88,6 @@
 use std::os::unix::raw::pid_t;
 use std::path::{Path, PathBuf};
 use std::sync::{Arc, Mutex, Weak};
-use vbmeta::VbMetaImage;
 use vmconfig::VmConfig;
 use vsock::VsockStream;
 use zip::ZipArchive;
@@ -117,9 +115,6 @@
 
 const UNFORMATTED_STORAGE_MAGIC: &str = "UNFORMATTED-STORAGE";
 
-/// Rough size for storing root digest of vendor hash descriptor into DTBO.
-const EMPTY_VENDOR_DT_OVERLAY_BUF_SIZE: usize = 10000;
-
 /// crosvm requires all partitions to be a multiple of 4KiB.
 const PARTITION_GRANULARITY_BYTES: u64 = 4096;
 
@@ -370,21 +365,7 @@
         // Allocating VM context checks the MANAGE_VIRTUAL_MACHINE permission.
         let (vm_context, cid, temporary_directory) = self.create_vm_context(requester_debug_pid)?;
 
-        let is_custom = match config {
-            VirtualMachineConfig::RawConfig(_) => true,
-            VirtualMachineConfig::AppConfig(config) => {
-                // Some features are reserved for platform apps only, even when using
-                // VirtualMachineAppConfig. Almost all of these features are grouped in the
-                // CustomConfig struct:
-                // - controlling CPUs;
-                // - specifying a config file in the APK; (this one is not part of CustomConfig)
-                // - gdbPort is set, meaning that crosvm will start a gdb server;
-                // - using anything other than the default kernel;
-                // - specifying devices to be assigned.
-                config.customConfig.is_some() || matches!(config.payload, Payload::ConfigPath(_))
-            }
-        };
-        if is_custom {
+        if is_custom_config(config) {
             check_use_custom_virtual_machine()?;
         }
 
@@ -395,25 +376,12 @@
             check_gdb_allowed(config)?;
         }
 
-        let vendor_hashtree_descriptor_root_digest =
-            extract_vendor_hashtree_descriptor_root_digest(config)
-                .context("Failed to extract root digest of vendor")
-                .or_service_specific_exception(-1)?;
-        let dtbo_vendor = if let Some(vendor_hashtree_descriptor_root_digest) =
-            vendor_hashtree_descriptor_root_digest
-        {
-            let root_digest_hex = hex::encode(vendor_hashtree_descriptor_root_digest);
-            let dtbo_for_vendor_image = temporary_directory.join("dtbo_vendor");
-            create_dtbo_for_vendor_image(root_digest_hex.as_bytes(), &dtbo_for_vendor_image)
-                .context("Failed to write root digest of vendor")
-                .or_service_specific_exception(-1)?;
-            let file = File::open(dtbo_for_vendor_image)
-                .context("Failed to open dtbo_vendor")
-                .or_service_specific_exception(-1)?;
-            Some(file)
-        } else {
-            None
-        };
+        let reference_dt = reference_dt::parse_reference_dt(&temporary_directory)
+            .context("Failed to create VM reference DT")
+            .or_service_specific_exception(-1)?;
+        if reference_dt.is_none() {
+            warn!("VM reference DT doesn't exist");
+        }
 
         let debug_level = match config {
             VirtualMachineConfig::AppConfig(config) => config.debugLevel,
@@ -530,7 +498,7 @@
                     .getDtboFile()?
                     .as_ref()
                     .try_clone()
-                    .context("Failed to create File from ParcelFileDescriptor")
+                    .context("Failed to create VM DTBO from ParcelFileDescriptor")
                     .or_binder_exception(ExceptionCode::BAD_PARCELABLE)?,
             );
             (devices, Some(dtbo_file))
@@ -563,7 +531,7 @@
             gdb_port,
             vfio_devices,
             dtbo,
-            dtbo_vendor,
+            reference_dt,
         };
         let instance = Arc::new(
             VmInstance::new(
@@ -582,78 +550,33 @@
     }
 }
 
-fn extract_vendor_hashtree_descriptor_root_digest(
-    config: &VirtualMachineConfig,
-) -> Result<Option<Vec<u8>>> {
-    let VirtualMachineConfig::AppConfig(config) = config else {
-        return Ok(None);
-    };
-    let Some(custom_config) = &config.customConfig else {
-        return Ok(None);
-    };
-    let Some(file) = custom_config.vendorImage.as_ref() else {
-        return Ok(None);
-    };
-
-    let file = clone_file(file)?;
-    let size = file.metadata().context("Failed to get metadata from microdroid-vendor.img")?.len();
-    let vbmeta = VbMetaImage::verify_reader_region(&file, 0, size)
-        .context("Failed to get vbmeta from microdroid-vendor.img")?;
-
-    for descriptor in vbmeta.descriptors()?.iter() {
-        if let vbmeta::Descriptor::Hashtree(_) = descriptor {
-            return Ok(Some(descriptor.to_hashtree()?.root_digest().to_vec()));
+/// Returns whether a VM config represents a "custom" virtual machine, which requires the
+/// USE_CUSTOM_VIRTUAL_MACHINE.
+fn is_custom_config(config: &VirtualMachineConfig) -> bool {
+    match config {
+        // Any raw (non-Microdroid) VM is considered custom.
+        VirtualMachineConfig::RawConfig(_) => true,
+        VirtualMachineConfig::AppConfig(config) => {
+            // Some features are reserved for platform apps only, even when using
+            // VirtualMachineAppConfig. Almost all of these features are grouped in the
+            // CustomConfig struct:
+            // - controlling CPUs;
+            // - gdbPort is set, meaning that crosvm will start a gdb server;
+            // - using anything other than the default kernel;
+            // - specifying devices to be assigned.
+            if config.customConfig.is_some() {
+                true
+            } else {
+                // Additional custom features not included in CustomConfig:
+                // - specifying a config file;
+                // - specifying extra APKs.
+                match &config.payload {
+                    Payload::ConfigPath(_) => true,
+                    Payload::PayloadConfig(payload_config) => !payload_config.extraApks.is_empty(),
+                }
+            }
         }
     }
-    Err(anyhow!("No root digest is extracted from microdroid-vendor.img"))
-}
-
-fn create_dtbo_for_vendor_image(
-    vendor_hashtree_descriptor_root_digest: &[u8],
-    dtbo: &PathBuf,
-) -> Result<()> {
-    if dtbo.exists() {
-        return Err(anyhow!("DTBO file already exists"));
-    }
-
-    let mut buf = vec![0; EMPTY_VENDOR_DT_OVERLAY_BUF_SIZE];
-    let fdt = Fdt::create_empty_tree(buf.as_mut_slice())
-        .map_err(|e| anyhow!("Failed to create FDT: {:?}", e))?;
-    let mut root = fdt.root_mut().map_err(|e| anyhow!("Failed to get root node: {:?}", e))?;
-
-    let fragment_node_name = CString::new("fragment@0")?;
-    let mut fragment_node = root
-        .add_subnode(fragment_node_name.as_c_str())
-        .map_err(|e| anyhow!("Failed to create fragment node: {:?}", e))?;
-    let target_path_prop_name = CString::new("target-path")?;
-    let target_path = CString::new("/")?;
-    fragment_node
-        .setprop(target_path_prop_name.as_c_str(), target_path.to_bytes_with_nul())
-        .map_err(|e| anyhow!("Failed to set target-path: {:?}", e))?;
-    let overlay_node_name = CString::new("__overlay__")?;
-    let mut overlay_node = fragment_node
-        .add_subnode(overlay_node_name.as_c_str())
-        .map_err(|e| anyhow!("Failed to create overlay node: {:?}", e))?;
-
-    let avf_node_name = CString::new("avf")?;
-    let mut avf_node = overlay_node
-        .add_subnode(avf_node_name.as_c_str())
-        .map_err(|e| anyhow!("Failed to create avf node: {:?}", e))?;
-    let vendor_hashtree_descriptor_root_digest_name =
-        CString::new("vendor_hashtree_descriptor_root_digest")?;
-    avf_node
-        .setprop(
-            vendor_hashtree_descriptor_root_digest_name.as_c_str(),
-            vendor_hashtree_descriptor_root_digest,
-        )
-        .map_err(|e| {
-            anyhow!("Failed to set avf/vendor_hashtree_descriptor_root_digest: {:?}", e)
-        })?;
-
-    fdt.pack().map_err(|e| anyhow!("Failed to pack fdt: {:?}", e))?;
-    let mut file = File::create(dtbo)?;
-    file.write_all(fdt.as_slice())?;
-    Ok(file.flush()?)
 }
 
 fn write_zero_filler(zero_filler_path: &Path) -> Result<()> {
@@ -785,12 +708,28 @@
         None
     };
 
-    let vm_payload_config = match &config.payload {
+    let vm_payload_config;
+    let extra_apk_files: Vec<_>;
+    match &config.payload {
         Payload::ConfigPath(config_path) => {
-            load_vm_payload_config_from_file(&apk_file, config_path.as_str())
-                .with_context(|| format!("Couldn't read config from {}", config_path))?
+            vm_payload_config =
+                load_vm_payload_config_from_file(&apk_file, config_path.as_str())
+                    .with_context(|| format!("Couldn't read config from {}", config_path))?;
+            extra_apk_files = vm_payload_config
+                .extra_apks
+                .iter()
+                .enumerate()
+                .map(|(i, apk)| {
+                    File::open(PathBuf::from(&apk.path))
+                        .with_context(|| format!("Failed to open extra apk #{i} {}", apk.path))
+                })
+                .collect::<Result<_>>()?;
         }
-        Payload::PayloadConfig(payload_config) => create_vm_payload_config(payload_config)?,
+        Payload::PayloadConfig(payload_config) => {
+            vm_payload_config = create_vm_payload_config(payload_config)?;
+            extra_apk_files =
+                payload_config.extraApks.iter().map(clone_file).collect::<binder::Result<_>>()?;
+        }
     };
 
     // For now, the only supported OS is Microdroid and Microdroid GKI
@@ -838,6 +777,7 @@
         temporary_directory,
         apk_file,
         idsig_file,
+        extra_apk_files,
         &vm_payload_config,
         &mut vm_config,
     )?;
@@ -865,11 +805,17 @@
 
     let task = Task { type_: TaskType::MicrodroidLauncher, command: payload_binary_name.clone() };
     let name = payload_config.osName.clone();
+
+    // The VM only cares about how many there are, these names are actually ignored.
+    let extra_apk_count = payload_config.extraApks.len();
+    let extra_apks =
+        (0..extra_apk_count).map(|i| ApkConfig { path: format!("extra-apk-{i}") }).collect();
+
     Ok(VmPayloadConfig {
         os: OsConfig { name },
         task: Some(task),
         apexes: vec![],
-        extra_apks: vec![],
+        extra_apks,
         prefer_staged: false,
         export_tombstones: None,
         enable_authfs: false,
@@ -1284,6 +1230,16 @@
     Ok(())
 }
 
+fn check_no_extra_apks(config: &VirtualMachineConfig) -> binder::Result<()> {
+    let VirtualMachineConfig::AppConfig(config) = config else { return Ok(()) };
+    let Payload::PayloadConfig(payload_config) = &config.payload else { return Ok(()) };
+    if !payload_config.extraApks.is_empty() {
+        return Err(anyhow!("multi-tenant feature is disabled"))
+            .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
+    }
+    Ok(())
+}
+
 fn check_config_features(config: &VirtualMachineConfig) -> binder::Result<()> {
     if !cfg!(vendor_modules) {
         check_no_vendor_modules(config)?;
@@ -1291,6 +1247,9 @@
     if !cfg!(device_assignment) {
         check_no_devices(config)?;
     }
+    if !cfg!(multi_tenant) {
+        check_no_extra_apks(config)?;
+    }
     Ok(())
 }
 
@@ -1601,65 +1560,6 @@
         assert_eq!(vm_config.params, Some("foo=5 bar=42".to_owned()))
     }
 
-    #[test]
-    fn test_create_dtbo_for_vendor_image() -> Result<()> {
-        let vendor_hashtree_descriptor_root_digest = String::from("foo");
-        let vendor_hashtree_descriptor_root_digest =
-            vendor_hashtree_descriptor_root_digest.as_bytes();
-
-        let tmp_dir = tempfile::TempDir::new()?;
-        let dtbo_path = tmp_dir.path().to_path_buf().join("bar");
-
-        create_dtbo_for_vendor_image(vendor_hashtree_descriptor_root_digest, &dtbo_path)?;
-
-        let data = std::fs::read(dtbo_path)?;
-        let fdt = Fdt::from_slice(&data).unwrap();
-
-        let fragment_node_path = CString::new("/fragment@0")?;
-        let fragment_node = fdt.node(fragment_node_path.as_c_str()).unwrap();
-        let Some(fragment_node) = fragment_node else {
-            bail!("fragment_node shouldn't be None.");
-        };
-        let target_path_prop_name = CString::new("target-path")?;
-        let target_path_from_dtbo =
-            fragment_node.getprop(target_path_prop_name.as_c_str()).unwrap();
-        let target_path_expected = CString::new("/")?;
-        assert_eq!(target_path_from_dtbo, Some(target_path_expected.to_bytes_with_nul()));
-
-        let avf_node_path = CString::new("/fragment@0/__overlay__/avf")?;
-        let avf_node = fdt.node(avf_node_path.as_c_str()).unwrap();
-        let Some(avf_node) = avf_node else {
-            bail!("avf_node shouldn't be None.");
-        };
-        let vendor_hashtree_descriptor_root_digest_name =
-            CString::new("vendor_hashtree_descriptor_root_digest")?;
-        let digest_from_dtbo =
-            avf_node.getprop(vendor_hashtree_descriptor_root_digest_name.as_c_str()).unwrap();
-        assert_eq!(digest_from_dtbo, Some(vendor_hashtree_descriptor_root_digest));
-
-        tmp_dir.close()?;
-        Ok(())
-    }
-
-    #[test]
-    fn test_create_dtbo_for_vendor_image_throws_error_if_already_exists() -> Result<()> {
-        let vendor_hashtree_descriptor_root_digest = String::from("foo");
-        let vendor_hashtree_descriptor_root_digest =
-            vendor_hashtree_descriptor_root_digest.as_bytes();
-
-        let tmp_dir = tempfile::TempDir::new()?;
-        let dtbo_path = tmp_dir.path().to_path_buf().join("bar");
-
-        create_dtbo_for_vendor_image(vendor_hashtree_descriptor_root_digest, &dtbo_path)?;
-
-        let ret_second_trial =
-            create_dtbo_for_vendor_image(vendor_hashtree_descriptor_root_digest, &dtbo_path);
-        assert!(ret_second_trial.is_err(), "should fail");
-
-        tmp_dir.close()?;
-        Ok(())
-    }
-
     fn test_extract_os_name_from_config_path(
         path: &Path,
         expected_result: Option<&str>,
diff --git a/virtualizationmanager/src/crosvm.rs b/virtualizationmanager/src/crosvm.rs
index fe8a587..84c60bd 100644
--- a/virtualizationmanager/src/crosvm.rs
+++ b/virtualizationmanager/src/crosvm.rs
@@ -118,7 +118,7 @@
     pub gdb_port: Option<NonZeroU16>,
     pub vfio_devices: Vec<VfioDevice>,
     pub dtbo: Option<File>,
-    pub dtbo_vendor: Option<File>,
+    pub reference_dt: Option<File>,
 }
 
 /// A disk image to pass to crosvm for a VM.
@@ -896,8 +896,10 @@
         .arg("--socket")
         .arg(add_preserved_fd(&mut preserved_fds, &control_server_socket.as_raw_descriptor()));
 
-    if let Some(dtbo_vendor) = &config.dtbo_vendor {
-        command.arg("--device-tree-overlay").arg(add_preserved_fd(&mut preserved_fds, dtbo_vendor));
+    if let Some(reference_dt) = &config.reference_dt {
+        command
+            .arg("--device-tree-overlay")
+            .arg(add_preserved_fd(&mut preserved_fds, reference_dt));
     }
 
     append_platform_devices(&mut command, &mut preserved_fds, &config)?;
diff --git a/virtualizationmanager/src/debug_config.rs b/virtualizationmanager/src/debug_config.rs
index 003a7d4..e2b657a 100644
--- a/virtualizationmanager/src/debug_config.rs
+++ b/virtualizationmanager/src/debug_config.rs
@@ -45,7 +45,7 @@
         // unwrap() is safe for to_str() because node_path and prop_name were &str.
         PathBuf::from(
             [
-                "/sys/firmware/devicetree/base",
+                "/proc/device-tree",
                 self.node_path.to_str().unwrap(),
                 "/",
                 self.prop_name.to_str().unwrap(),
diff --git a/virtualizationmanager/src/main.rs b/virtualizationmanager/src/main.rs
index 01c74f5..2e542c3 100644
--- a/virtualizationmanager/src/main.rs
+++ b/virtualizationmanager/src/main.rs
@@ -20,6 +20,7 @@
 mod crosvm;
 mod debug_config;
 mod payload;
+mod reference_dt;
 mod selinux;
 
 use crate::aidl::{GLOBAL_SERVICE, VirtualizationService};
diff --git a/virtualizationmanager/src/payload.rs b/virtualizationmanager/src/payload.rs
index c19c103..05626d3 100644
--- a/virtualizationmanager/src/payload.rs
+++ b/virtualizationmanager/src/payload.rs
@@ -194,7 +194,8 @@
     let payload_metadata = match &app_config.payload {
         Payload::PayloadConfig(payload_config) => PayloadMetadata::Config(PayloadConfig {
             payload_binary_name: payload_config.payloadBinaryName.clone(),
-            ..Default::default()
+            extra_apk_count: payload_config.extraApks.len().try_into()?,
+            special_fields: Default::default(),
         }),
         Payload::ConfigPath(config_path) => {
             PayloadMetadata::ConfigPath(format!("/mnt/apk/{}", config_path))
@@ -258,10 +259,11 @@
     debug_config: &DebugConfig,
     apk_file: File,
     idsig_file: File,
+    extra_apk_files: Vec<File>,
     vm_payload_config: &VmPayloadConfig,
     temporary_directory: &Path,
 ) -> Result<DiskImage> {
-    if vm_payload_config.extra_apks.len() != app_config.extraIdsigs.len() {
+    if extra_apk_files.len() != app_config.extraIdsigs.len() {
         bail!(
             "payload config has {} apks, but app config has {} idsigs",
             vm_payload_config.extra_apks.len(),
@@ -309,26 +311,23 @@
     });
 
     // we've already checked that extra_apks and extraIdsigs are in the same size.
-    let extra_apks = &vm_payload_config.extra_apks;
     let extra_idsigs = &app_config.extraIdsigs;
-    for (i, (extra_apk, extra_idsig)) in extra_apks.iter().zip(extra_idsigs.iter()).enumerate() {
+    for (i, (extra_apk_file, extra_idsig)) in
+        extra_apk_files.into_iter().zip(extra_idsigs.iter()).enumerate()
+    {
         partitions.push(Partition {
-            label: format!("extra-apk-{}", i),
-            image: Some(ParcelFileDescriptor::new(
-                File::open(PathBuf::from(&extra_apk.path)).with_context(|| {
-                    format!("Failed to open the extra apk #{} {}", i, extra_apk.path)
-                })?,
-            )),
+            label: format!("extra-apk-{i}"),
+            image: Some(ParcelFileDescriptor::new(extra_apk_file)),
             writable: false,
         });
 
         partitions.push(Partition {
-            label: format!("extra-idsig-{}", i),
+            label: format!("extra-idsig-{i}"),
             image: Some(ParcelFileDescriptor::new(
                 extra_idsig
                     .as_ref()
                     .try_clone()
-                    .with_context(|| format!("Failed to clone the extra idsig #{}", i))?,
+                    .with_context(|| format!("Failed to clone the extra idsig #{i}"))?,
             )),
             writable: false,
         });
@@ -459,12 +458,14 @@
     Ok(())
 }
 
+#[allow(clippy::too_many_arguments)] // TODO: Fewer arguments
 pub fn add_microdroid_payload_images(
     config: &VirtualMachineAppConfig,
     debug_config: &DebugConfig,
     temporary_directory: &Path,
     apk_file: File,
     idsig_file: File,
+    extra_apk_files: Vec<File>,
     vm_payload_config: &VmPayloadConfig,
     vm_config: &mut VirtualMachineRawConfig,
 ) -> Result<()> {
@@ -473,6 +474,7 @@
         debug_config,
         apk_file,
         idsig_file,
+        extra_apk_files,
         vm_payload_config,
         temporary_directory,
     )?);
diff --git a/virtualizationmanager/src/reference_dt.rs b/virtualizationmanager/src/reference_dt.rs
new file mode 100644
index 0000000..797ee3c
--- /dev/null
+++ b/virtualizationmanager/src/reference_dt.rs
@@ -0,0 +1,93 @@
+// Copyright 2024, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Functions for VM reference DT
+
+use anyhow::{anyhow, Result};
+use cstr::cstr;
+use fsfdt::FsFdt;
+use libfdt::Fdt;
+use std::fs;
+use std::fs::File;
+use std::path::Path;
+
+const VM_REFERENCE_DT_ON_HOST_PATH: &str = "/proc/device-tree/avf/reference";
+const VM_REFERENCE_DT_NAME: &str = "vm_reference_dt.dtbo";
+const VM_REFERENCE_DT_MAX_SIZE: usize = 2000;
+
+// Parses to VM reference if exists.
+// TODO(b/318431695): Allow to parse from custom VM reference DT
+pub(crate) fn parse_reference_dt(out_dir: &Path) -> Result<Option<File>> {
+    parse_reference_dt_internal(
+        Path::new(VM_REFERENCE_DT_ON_HOST_PATH),
+        &out_dir.join(VM_REFERENCE_DT_NAME),
+    )
+}
+
+fn parse_reference_dt_internal(dir_path: &Path, fdt_path: &Path) -> Result<Option<File>> {
+    if !dir_path.exists() || fs::read_dir(dir_path)?.next().is_none() {
+        return Ok(None);
+    }
+
+    let mut data = vec![0_u8; VM_REFERENCE_DT_MAX_SIZE];
+
+    let fdt = Fdt::create_empty_tree(&mut data)
+        .map_err(|e| anyhow!("Failed to create an empty DT, {e:?}"))?;
+    let mut root = fdt.root_mut().map_err(|e| anyhow!("Failed to find the DT root, {e:?}"))?;
+    let mut fragment = root
+        .add_subnode(cstr!("fragment@0"))
+        .map_err(|e| anyhow!("Failed to create the fragment@0, {e:?}"))?;
+    fragment
+        .setprop(cstr!("target-path"), b"/\0")
+        .map_err(|e| anyhow!("Failed to set target-path, {e:?}"))?;
+    fragment
+        .add_subnode(cstr!("__overlay__"))
+        .map_err(|e| anyhow!("Failed to create the __overlay__, {e:?}"))?;
+
+    fdt.append(cstr!("/fragment@0/__overlay__"), dir_path)?;
+
+    fdt.pack().map_err(|e| anyhow!("Failed to pack VM reference DT, {e:?}"))?;
+    fs::write(fdt_path, fdt.as_slice())?;
+
+    Ok(Some(File::open(fdt_path)?))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_parse_reference_dt_from_empty_dir() {
+        let empty_dir = tempfile::TempDir::new().unwrap();
+        let test_dir = tempfile::TempDir::new().unwrap();
+
+        let empty_dir_path = empty_dir.path();
+        let fdt_path = test_dir.path().join("test.dtb");
+
+        let fdt_file = parse_reference_dt_internal(empty_dir_path, &fdt_path).unwrap();
+
+        assert!(fdt_file.is_none());
+    }
+
+    #[test]
+    fn test_parse_reference_dt_from_empty_reference() {
+        let fdt_file = parse_reference_dt_internal(
+            Path::new("/this/path/would/not/exists"),
+            Path::new("test.dtb"),
+        )
+        .unwrap();
+
+        assert!(fdt_file.is_none());
+    }
+}
diff --git a/virtualizationservice/aidl/android/system/virtualizationservice/VirtualMachinePayloadConfig.aidl b/virtualizationservice/aidl/android/system/virtualizationservice/VirtualMachinePayloadConfig.aidl
index f3f54f3..7ca5b62 100644
--- a/virtualizationservice/aidl/android/system/virtualizationservice/VirtualMachinePayloadConfig.aidl
+++ b/virtualizationservice/aidl/android/system/virtualizationservice/VirtualMachinePayloadConfig.aidl
@@ -28,4 +28,7 @@
      * Name of the OS to run the payload. Currently "microdroid" and "microdroid_gki" is supported.
      */
     @utf8InCpp String osName = "microdroid";
+
+    /** Any extra APKs. */
+    List<ParcelFileDescriptor> extraApks;
 }
diff --git a/vm/src/main.rs b/vm/src/main.rs
index 5c07eed..de9291c 100644
--- a/vm/src/main.rs
+++ b/vm/src/main.rs
@@ -34,7 +34,7 @@
 #[derive(Debug)]
 struct Idsigs(Vec<PathBuf>);
 
-#[derive(Args)]
+#[derive(Args, Default)]
 /// Collection of flags that are at VM level and therefore applicable to all subcommands
 pub struct CommonConfig {
     /// Name of VM
@@ -59,7 +59,7 @@
     protected: bool,
 }
 
-#[derive(Args)]
+#[derive(Args, Default)]
 /// Collection of flags for debugging
 pub struct DebugConfig {
     /// Debug level of the VM. Supported values: "full" (default), and "none".
@@ -84,7 +84,7 @@
     gdb: Option<NonZeroU16>,
 }
 
-#[derive(Args)]
+#[derive(Args, Default)]
 /// Collection of flags that are Microdroid specific
 pub struct MicrodroidConfig {
     /// Path to the file backing the storage.
@@ -145,7 +145,7 @@
     }
 }
 
-#[derive(Args)]
+#[derive(Args, Default)]
 /// Flags for the run_app subcommand
 pub struct RunAppConfig {
     #[command(flatten)]
@@ -175,12 +175,30 @@
     #[arg(alias = "payload_path")]
     payload_binary_name: Option<String>,
 
+    /// Paths to extra apk files.
+    #[cfg(multi_tenant)]
+    #[arg(long = "extra-apk")]
+    #[clap(conflicts_with = "config_path")]
+    extra_apks: Vec<PathBuf>,
+
     /// Paths to extra idsig files.
     #[arg(long = "extra-idsig")]
     extra_idsigs: Vec<PathBuf>,
 }
 
-#[derive(Args)]
+impl RunAppConfig {
+    #[cfg(multi_tenant)]
+    fn extra_apks(&self) -> &[PathBuf] {
+        &self.extra_apks
+    }
+
+    #[cfg(not(multi_tenant))]
+    fn extra_apks(&self) -> &[PathBuf] {
+        &[]
+    }
+}
+
+#[derive(Args, Default)]
 /// Flags for the run_microdroid subcommand
 pub struct RunMicrodroidConfig {
     #[command(flatten)]
@@ -199,7 +217,7 @@
     work_dir: Option<PathBuf>,
 }
 
-#[derive(Args)]
+#[derive(Args, Default)]
 /// Flags for the run subcommand
 pub struct RunCustomVmConfig {
     #[command(flatten)]
diff --git a/vm/src/run.rs b/vm/src/run.rs
index cfc5454..1d2f48b 100644
--- a/vm/src/run.rs
+++ b/vm/src/run.rs
@@ -48,7 +48,7 @@
 
     let extra_apks = match config.config_path.as_deref() {
         Some(path) => parse_extra_apk_list(&config.apk, path)?,
-        None => vec![],
+        None => config.extra_apks().to_vec(),
     };
 
     if extra_apks.len() != config.extra_idsigs.len() {
@@ -101,8 +101,7 @@
     let vendor =
         config.microdroid.vendor().as_ref().map(|p| open_parcel_file(p, false)).transpose()?;
 
-    let extra_idsig_files: Result<Vec<File>, _> =
-        config.extra_idsigs.iter().map(File::open).collect();
+    let extra_idsig_files: Result<Vec<_>, _> = config.extra_idsigs.iter().map(File::open).collect();
     let extra_idsig_fds = extra_idsig_files?.into_iter().map(ParcelFileDescriptor::new).collect();
 
     let payload = if let Some(config_path) = config.config_path {
@@ -119,9 +118,14 @@
         } else {
             "microdroid".to_owned()
         };
+
+        let extra_apk_files: Result<Vec<_>, _> = extra_apks.iter().map(File::open).collect();
+        let extra_apk_fds = extra_apk_files?.into_iter().map(ParcelFileDescriptor::new).collect();
+
         Payload::PayloadConfig(VirtualMachinePayloadConfig {
             payloadBinaryName: payload_binary_name,
             osName: os_name,
+            extraApks: extra_apk_fds,
         })
     } else {
         bail!("Either --config-path or --payload-binary-name must be defined")
@@ -208,9 +212,8 @@
         apk,
         idsig,
         instance: instance_img,
-        config_path: None,
         payload_binary_name: Some("MicrodroidEmptyPayloadJniLib.so".to_owned()),
-        extra_idsigs: [].to_vec(),
+        ..Default::default()
     };
     command_run_app(app_config)
 }
@@ -310,11 +313,11 @@
     Ok(())
 }
 
-fn parse_extra_apk_list(apk: &Path, config_path: &str) -> Result<Vec<String>, Error> {
+fn parse_extra_apk_list(apk: &Path, config_path: &str) -> Result<Vec<PathBuf>, Error> {
     let mut archive = ZipArchive::new(File::open(apk)?)?;
     let config_file = archive.by_name(config_path)?;
     let config: VmPayloadConfig = serde_json::from_reader(config_file)?;
-    Ok(config.extra_apks.into_iter().map(|x| x.path).collect())
+    Ok(config.extra_apks.into_iter().map(|x| x.path.into()).collect())
 }
 
 struct Callback {}