diff --git a/vm_payload/wrapper/lib.rs b/vm_payload/wrapper/lib.rs
index bc26802..d3f03d7 100644
--- a/vm_payload/wrapper/lib.rs
+++ b/vm_payload/wrapper/lib.rs
@@ -22,9 +22,7 @@
 
 mod attestation;
 
-pub use attestation::{
-    request_attestation, request_attestation_for_testing, AttestationError, AttestationResult,
-};
+pub use attestation::{request_attestation, AttestationError, AttestationResult};
 use binder::unstable_api::AsNative;
 use binder::{FromIBinder, Strong};
 use std::ffi::{c_void, CStr, OsStr};
@@ -36,6 +34,16 @@
     AVmPayload_getVmInstanceSecret, AVmPayload_notifyPayloadReady, AVmPayload_runVsockRpcServer,
 };
 
+/// The functions declared here are restricted to VMs created with a config file;
+/// they will fail, or panic, if called in other VMs. The ability to create such VMs
+/// requires the android.permission.USE_CUSTOM_VIRTUAL_MACHINE permission, and is
+/// therefore not available to privileged or third party apps.
+///
+/// These functions can be used by tests, if the permission is granted via shell.
+pub mod restricted {
+    pub use crate::attestation::request_attestation_for_testing;
+}
+
 /// Marks the main function of the VM payload.
 ///
 /// When the VM is run, this function is called. If it returns, the VM ends normally with a 0 exit
@@ -171,7 +179,7 @@
 ///
 /// The secret is returned in [`secret`], truncated to its size, which must be between
 /// 1 and 32 bytes (inclusive) or the function will panic.
-pub fn get_vm_instance_secret<const N: usize>(identifier: &[u8], secret: &mut [u8]) {
+pub fn get_vm_instance_secret(identifier: &[u8], secret: &mut [u8]) {
     let secret_size = secret.len();
     assert!((1..=32).contains(&secret_size), "VM instance secrets can be up to 32 bytes long");