diff --git a/libs/dice/driver/Android.bp b/libs/dice/driver/Android.bp
new file mode 100644
index 0000000..4a17334
--- /dev/null
+++ b/libs/dice/driver/Android.bp
@@ -0,0 +1,34 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+rust_library {
+    name: "libdice_driver",
+    crate_name: "dice_driver",
+    defaults: [
+        "avf_build_flags_rust",
+    ],
+    srcs: ["src/lib.rs"],
+    edition: "2021",
+    prefer_rlib: true,
+    rustlibs: [
+        "libanyhow",
+        "libbyteorder",
+        "libcoset",
+        "libdice_policy_builder",
+        "libdiced_open_dice",
+        "libdiced_sample_inputs",
+        "libkeystore2_crypto_rust",
+        "liblibc",
+        "liblog_rust",
+        "libnix",
+        "libonce_cell",
+        "libopenssl",
+        "libthiserror",
+    ],
+    multilib: {
+        lib32: {
+            enabled: false,
+        },
+    },
+}
diff --git a/microdroid_manager/src/dice_driver.rs b/libs/dice/driver/src/lib.rs
similarity index 91%
rename from microdroid_manager/src/dice_driver.rs
rename to libs/dice/driver/src/lib.rs
index 229f3e0..ec87ae2 100644
--- a/microdroid_manager/src/dice_driver.rs
+++ b/libs/dice/driver/src/lib.rs
@@ -32,12 +32,18 @@
 
 /// Artifacts that are mapped into the process address space from the driver.
 pub enum DiceDriver<'a> {
+    /// Real implementation
     Real {
+        /// Path to the driver character device (e.g. /dev/open-dice0).
         driver_path: PathBuf,
+        /// Address of the memory to mmap driver to.
         mmap_addr: *mut c_void,
+        /// Size of the mmap.
         mmap_size: usize,
+        /// BCC handover.
         bcc_handover: BccHandover<'a>,
     },
+    /// Fake implementation used in tests and non-protected VMs.
     Fake(OwnedDiceArtifacts),
 }
 
@@ -49,10 +55,11 @@
         }
     }
 
-    pub fn new(driver_path: &Path) -> Result<Self> {
+    /// Creates a new dice driver from the given driver_path.
+    pub fn new(driver_path: &Path, is_strict_boot: bool) -> Result<Self> {
         if driver_path.exists() {
             log::info!("Using DICE values from driver");
-        } else if super::is_strict_boot() {
+        } else if is_strict_boot {
             bail!("Strict boot requires DICE value from driver but none were found");
         } else {
             log::warn!("Using sample DICE values");
@@ -101,6 +108,7 @@
         Ok(key)
     }
 
+    /// Derives a new dice chain.
     pub fn derive(
         self,
         code_hash: Hash,
diff --git a/microdroid_manager/Android.bp b/microdroid_manager/Android.bp
index 81bb409..9c9a3d0 100644
--- a/microdroid_manager/Android.bp
+++ b/microdroid_manager/Android.bp
@@ -29,6 +29,7 @@
         "libclient_vm_csr",
         "libciborium",
         "libcoset",
+        "libdice_driver",
         "libdice_policy_builder",
         "libdiced_open_dice",
         "libdiced_sample_inputs",
diff --git a/microdroid_manager/src/dice.rs b/microdroid_manager/src/dice.rs
index a8b88aa..7f65159 100644
--- a/microdroid_manager/src/dice.rs
+++ b/microdroid_manager/src/dice.rs
@@ -12,12 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use crate::dice_driver::DiceDriver;
 use crate::instance::{ApexData, ApkData};
 use crate::{is_debuggable, MicrodroidData};
 use anyhow::{bail, Context, Result};
 use ciborium::{cbor, Value};
 use coset::CborSerializable;
+use dice_driver::DiceDriver;
 use diced_open_dice::OwnedDiceArtifacts;
 use microdroid_metadata::PayloadMetadata;
 use openssl::sha::{sha512, Sha512};
diff --git a/microdroid_manager/src/instance.rs b/microdroid_manager/src/instance.rs
index 7a9f0e0..888c451 100644
--- a/microdroid_manager/src/instance.rs
+++ b/microdroid_manager/src/instance.rs
@@ -33,11 +33,11 @@
 //! The payload of a partition is encrypted/signed by a key that is unique to the loader and to the
 //! VM as well. Failing to decrypt/authenticate a partition by a loader stops the boot process.
 
-use crate::dice_driver::DiceDriver;
 use crate::ioutil;
 
 use anyhow::{anyhow, bail, Context, Result};
 use byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt};
+use dice_driver::DiceDriver;
 use openssl::symm::{decrypt_aead, encrypt_aead, Cipher};
 use serde::{Deserialize, Serialize};
 use std::fs::{File, OpenOptions};
diff --git a/microdroid_manager/src/main.rs b/microdroid_manager/src/main.rs
index 0d67632..8d2c629 100644
--- a/microdroid_manager/src/main.rs
+++ b/microdroid_manager/src/main.rs
@@ -15,7 +15,6 @@
 //! Microdroid Manager
 
 mod dice;
-mod dice_driver;
 mod instance;
 mod ioutil;
 mod payload;
@@ -33,12 +32,12 @@
 };
 
 use crate::dice::dice_derivation;
-use crate::dice_driver::DiceDriver;
 use crate::instance::{InstanceDisk, MicrodroidData};
 use crate::verify::verify_payload;
 use crate::vm_payload_service::register_vm_payload_service;
 use anyhow::{anyhow, bail, ensure, Context, Error, Result};
 use binder::Strong;
+use dice_driver::DiceDriver;
 use keystore2_crypto::ZVec;
 use libc::VMADDR_CID_HOST;
 use log::{error, info};
@@ -241,7 +240,8 @@
     vm_payload_service_fd: OwnedFd,
 ) -> Result<i32> {
     let metadata = load_metadata().context("Failed to load payload metadata")?;
-    let dice = DiceDriver::new(Path::new("/dev/open-dice0")).context("Failed to load DICE")?;
+    let dice = DiceDriver::new(Path::new("/dev/open-dice0"), is_strict_boot())
+        .context("Failed to load DICE")?;
 
     let mut instance = InstanceDisk::new().context("Failed to load instance.img")?;
     let saved_data =