diff --git a/apex/sign_virt_apex.py b/apex/sign_virt_apex.py
index a42f5ec..3f3600d 100644
--- a/apex/sign_virt_apex.py
+++ b/apex/sign_virt_apex.py
@@ -427,21 +427,23 @@
 
     # unpacked files (will be unpacked from super.img below)
     system_a_img = os.path.join(unpack_dir.name, 'system_a.img')
+    vendor_a_img = os.path.join(unpack_dir.name, 'vendor_a.img')
 
     # re-sign super.img
     # 1. unpack super.img
-    # 2. resign system
-    # 3. repack super.img out of resigned system
+    # 2. resign system and vendor
+    # 3. repack super.img out of resigned system and vendor
     UnpackSuperImg(args, files['super.img'], unpack_dir.name)
     system_a_f = Async(AddHashTreeFooter, args, key, system_a_img)
-    partitions = {"system_a": system_a_img}
+    vendor_a_f = Async(AddHashTreeFooter, args, key, vendor_a_img)
+    partitions = {"system_a": system_a_img, "vendor_a": vendor_a_img}
     Async(MakeSuperImage, args, partitions,
-          files['super.img'], wait=[system_a_f])
+          files['super.img'], wait=[system_a_f, vendor_a_f])
 
-    # re-generate vbmeta from re-signed system_a.img
+    # re-generate vbmeta from re-signed {system_a, vendor_a}.img
     vbmeta_f = Async(MakeVbmetaImage, args, key, files['vbmeta.img'],
-                     images=[system_a_img],
-                     wait=[system_a_f])
+                     images=[system_a_img, vendor_a_img],
+                     wait=[system_a_f, vendor_a_f])
 
     vbmeta_bc_f = None
     if not args.do_not_update_bootconfigs:
@@ -473,6 +475,7 @@
     # unpacked files
     UnpackSuperImg(args, files['super.img'], unpack_dir.name)
     system_a_img = os.path.join(unpack_dir.name, 'system_a.img')
+    vendor_a_img = os.path.join(unpack_dir.name, 'vendor_a.img')
 
     # Read pubkey digest from the input key
     with tempfile.NamedTemporaryFile() as pubkey_file:
@@ -492,6 +495,7 @@
             continue
         if f == files['super.img']:
             Async(check_avb_pubkey, system_a_img)
+            Async(check_avb_pubkey, vendor_a_img)
         else:
             # Check pubkey for other files using avbtool
             Async(check_avb_pubkey, f)
diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index 1395d30..2d05c45 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -16,6 +16,7 @@
     "sys",
 
     "system",
+    "vendor",
     "debug_ramdisk",
     "mnt",
     "data",
@@ -205,6 +206,21 @@
         "echo ro.product.cpu.abi=arm64-v8a) > $(out)",
 }
 
+// TODO(b/285855150): remove.
+android_filesystem {
+    name: "microdroid_vendor",
+    partition_name: "vendor",
+    use_avb: true,
+    avb_private_key: ":microdroid_sign_key",
+    avb_algorithm: "SHA256_RSA4096",
+    avb_hash_algorithm: "sha256",
+    file_contexts: ":microdroid_vendor_file_contexts.gen",
+    // For deterministic output, use fake_timestamp, hard-coded uuid
+    fake_timestamp: "1611569676",
+    // python -c "import uuid; print(uuid.uuid5(uuid.NAMESPACE_URL, 'www.android.com/avf/microdroid/vendor'))"
+    uuid: "156d40d7-8d8e-5c99-8913-ec82de549a70",
+}
+
 logical_partition {
     name: "microdroid_super",
     sparse: true,
@@ -214,6 +230,10 @@
             name: "system_a",
             filesystem: ":microdroid",
         },
+        {
+            name: "vendor_a",
+            filesystem: ":microdroid_vendor",
+        },
     ],
 }
 
@@ -297,6 +317,7 @@
     partition_name: "vbmeta",
     private_key: ":microdroid_sign_key",
     partitions: [
+        "microdroid_vendor",
         "microdroid",
     ],
 }
diff --git a/microdroid/fstab.microdroid b/microdroid/fstab.microdroid
index 9478c7c..25d82cc 100644
--- a/microdroid/fstab.microdroid
+++ b/microdroid/fstab.microdroid
@@ -1 +1,2 @@
 system /system ext4 noatime,ro,errors=panic wait,slotselect,avb=vbmeta,first_stage_mount,logical
+vendor /vendor ext4 noatime,ro,errors=panic wait,slotselect,avb=vbmeta,first_stage_mount,logical