diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index 8159d3d..488765f 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -153,9 +153,17 @@
         },
     },
     // TODO(jiyong): change the name to init, cause it's confusing
-    cmdline: "rdinit=/bin/init_vendor",
+    cmdline: "rdinit=/bin/init_vendor " +
+        "panic=-1 " +
+        // TODO(b/181936135) make the ratelimiting conditional; ratelimiting on prod build
+        "printk.devkmsg=on " +
+        "androidboot.first_stage_console=1 " +
+        "androidboot.hardware=microdroid " +
+        "androidboot.boot_devices=10000.pci " +
+        // TODO(b/181747352) remove this to enforce selinux
+        "androidboot.selinux=permissive",
     dtb_prebuilt: "dummy_dtb.img",
-    header_version: "3",
+    header_version: "4",
     partition_name: "boot",
 }
 
@@ -181,7 +189,7 @@
     name: "microdroid_vendor_boot-5.10",
     ramdisk_module: "microdroid_vendor_ramdisk-5.10",
     dtb_prebuilt: "dummy_dtb.img",
-    header_version: "3",
+    header_version: "4",
     vendor_boot: true,
     partition_name: "vendor_boot",
     enabled: false,
diff --git a/microdroid/uboot-env.txt b/microdroid/uboot-env.txt
index d991a04..b7940e5 100644
--- a/microdroid/uboot-env.txt
+++ b/microdroid/uboot-env.txt
@@ -3,8 +3,5 @@
 # Boot the device following the Android boot procedure
 bootcmd=boot_android virtio 0#misc
 
-# Kernel commandlines
-bootargs=rdinit=/bin/init_vendor panic=-1 printk.devkmsg=on androidboot.first_stage_console=1 androidboot.hardware=microdroid androidboot.boot_devices=10000.pci androidboot.selinux=permissive
-
 bootdelay=0
 fdtaddr=0x80000000