diff --git a/microdroid_manager/src/main.rs b/microdroid_manager/src/main.rs
index 15d6663..350fbc5 100644
--- a/microdroid_manager/src/main.rs
+++ b/microdroid_manager/src/main.rs
@@ -299,7 +299,9 @@
     dice_derivation(&verified_data, &metadata.payload_config_path)?;
 
     // Before reading a file from the APK, start zipfuse
+    let noexec = false;
     run_zipfuse(
+        noexec,
         "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:system_file:s0",
         Path::new("/dev/block/mapper/microdroid-apk"),
         Path::new("/mnt/apk"),
@@ -364,9 +366,12 @@
     cmd.spawn().context("Spawn apkdmverity")
 }
 
-fn run_zipfuse(option: &str, zip_path: &Path, mount_dir: &Path) -> Result<Child> {
-    Command::new(ZIPFUSE_BIN)
-        .arg("-o")
+fn run_zipfuse(noexec: bool, option: &str, zip_path: &Path, mount_dir: &Path) -> Result<Child> {
+    let mut cmd = Command::new(ZIPFUSE_BIN);
+    if noexec {
+        cmd.arg("--noexec");
+    }
+    cmd.arg("-o")
         .arg(option)
         .arg(zip_path)
         .arg(mount_dir)
@@ -537,7 +542,9 @@
         create_dir(Path::new(&mount_dir)).context("Failed to create mount dir for extra apks")?;
 
         // don't wait, just detach
+        let noexec = true;
         run_zipfuse(
+            noexec,
             "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:extra_apk_file:s0",
             Path::new(&format!("/dev/block/mapper/extra-apk-{}", i)),
             Path::new(&mount_dir),
diff --git a/tests/benchmark/src/java/com/android/microdroid/benchmark/MicrodroidBenchmarks.java b/tests/benchmark/src/java/com/android/microdroid/benchmark/MicrodroidBenchmarks.java
index 8adc8d7..5999af7 100644
--- a/tests/benchmark/src/java/com/android/microdroid/benchmark/MicrodroidBenchmarks.java
+++ b/tests/benchmark/src/java/com/android/microdroid/benchmark/MicrodroidBenchmarks.java
@@ -282,7 +282,7 @@
         assertThat(found).isTrue();
 
         Bundle bundle = new Bundle();
-        bundle.putInt("microdroid_minimum_required_memory", minimum);
+        bundle.putInt("avf_perf/microdroid/minimum_required_memory", minimum);
         mInstrumentation.sendStatus(0, bundle);
     }
 }
diff --git a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
index 59f9d17..1f0e107 100644
--- a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
+++ b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
@@ -516,7 +516,7 @@
     private RandomAccessFile prepareInstanceImage(String vmName)
             throws VirtualMachineException, InterruptedException, IOException {
         VirtualMachineConfig config = mInner.newVmConfigBuilder("assets/vm_config.json")
-                .debugLevel(DebugLevel.NONE)
+                .debugLevel(DebugLevel.FULL)
                 .build();
 
         // Remove any existing VM so we can start from scratch
diff --git a/zipfuse/src/main.rs b/zipfuse/src/main.rs
index c3fae69..874056a 100644
--- a/zipfuse/src/main.rs
+++ b/zipfuse/src/main.rs
@@ -46,6 +46,12 @@
                 .required(false)
                 .help("Comma separated list of mount options"),
         )
+        .arg(
+            Arg::with_name("noexec")
+                .long("noexec")
+                .takes_value(false)
+                .help("Disallow the execution of binary files"),
+        )
         .arg(Arg::with_name("ZIPFILE").required(true))
         .arg(Arg::with_name("MOUNTPOINT").required(true))
         .get_matches();
@@ -53,12 +59,18 @@
     let zip_file = matches.value_of("ZIPFILE").unwrap().as_ref();
     let mount_point = matches.value_of("MOUNTPOINT").unwrap().as_ref();
     let options = matches.value_of("options");
-    run_fuse(zip_file, mount_point, options)?;
+    let noexec = matches.is_present("noexec");
+    run_fuse(zip_file, mount_point, options, noexec)?;
     Ok(())
 }
 
 /// Runs a fuse filesystem by mounting `zip_file` on `mount_point`.
-pub fn run_fuse(zip_file: &Path, mount_point: &Path, extra_options: Option<&str>) -> Result<()> {
+pub fn run_fuse(
+    zip_file: &Path,
+    mount_point: &Path,
+    extra_options: Option<&str>,
+    noexec: bool,
+) -> Result<()> {
     const MAX_READ: u32 = 1 << 20; // TODO(jiyong): tune this
     const MAX_WRITE: u32 = 1 << 13; // This is a read-only filesystem
 
@@ -76,12 +88,12 @@
         mount_options.push(MountOption::Extra(value));
     }
 
-    fuse::mount(
-        mount_point,
-        "zipfuse",
-        libc::MS_NOSUID | libc::MS_NODEV | libc::MS_RDONLY,
-        &mount_options,
-    )?;
+    let mut mount_flags = libc::MS_NOSUID | libc::MS_NODEV | libc::MS_RDONLY;
+    if noexec {
+        mount_flags |= libc::MS_NOEXEC;
+    }
+
+    fuse::mount(mount_point, "zipfuse", mount_flags, &mount_options)?;
     let mut config = fuse::FuseConfig::new();
     config.dev_fuse(dev_fuse).max_write(MAX_WRITE).max_read(MAX_READ);
     Ok(config.enter_message_loop(ZipFuse::new(zip_file)?)?)
@@ -435,22 +447,28 @@
     use zip::write::FileOptions;
 
     #[cfg(not(target_os = "android"))]
-    fn start_fuse(zip_path: &Path, mnt_path: &Path) {
+    fn start_fuse(zip_path: &Path, mnt_path: &Path, noexec: bool) {
         let zip_path = PathBuf::from(zip_path);
         let mnt_path = PathBuf::from(mnt_path);
         std::thread::spawn(move || {
-            crate::run_fuse(&zip_path, &mnt_path, None).unwrap();
+            crate::run_fuse(&zip_path, &mnt_path, None, noexec).unwrap();
         });
     }
 
     #[cfg(target_os = "android")]
-    fn start_fuse(zip_path: &Path, mnt_path: &Path) {
+    fn start_fuse(zip_path: &Path, mnt_path: &Path, noexec: bool) {
         // Note: for some unknown reason, running a thread to serve fuse doesn't work on Android.
         // Explicitly spawn a zipfuse process instead.
         // TODO(jiyong): fix this
+        let noexec = if noexec { "--noexec" } else { "" };
         assert!(std::process::Command::new("sh")
             .arg("-c")
-            .arg(format!("/data/local/tmp/zipfuse {} {}", zip_path.display(), mnt_path.display()))
+            .arg(format!(
+                "/data/local/tmp/zipfuse {} {} {}",
+                noexec,
+                zip_path.display(),
+                mnt_path.display()
+            ))
             .spawn()
             .is_ok());
     }
@@ -476,6 +494,14 @@
     // Creates a zip file, adds some files to the zip file, mounts it using zipfuse, runs the check
     // routine, and finally unmounts.
     fn run_test(add: fn(&mut zip::ZipWriter<File>), check: fn(&std::path::Path)) {
+        run_test_noexec(false, add, check);
+    }
+
+    fn run_test_noexec(
+        noexec: bool,
+        add: fn(&mut zip::ZipWriter<File>),
+        check: fn(&std::path::Path),
+    ) {
         // Create an empty zip file
         let test_dir = tempfile::TempDir::new().unwrap();
         let zip_path = test_dir.path().join("test.zip");
@@ -492,7 +518,7 @@
         let mnt_path = test_dir.path().join("mnt");
         assert!(fs::create_dir(&mnt_path).is_ok());
 
-        start_fuse(&zip_path, &mnt_path);
+        start_fuse(&zip_path, &mnt_path, noexec);
 
         let mnt_path = test_dir.path().join("mnt");
         // Give some time for the fuse to boot up
@@ -577,6 +603,26 @@
     }
 
     #[test]
+    fn noexec() {
+        fn add_executable(zip: &mut zip::ZipWriter<File>) {
+            zip.start_file("executable", FileOptions::default().unix_permissions(0o755)).unwrap();
+        }
+
+        // Executables can be run when not mounting with noexec.
+        run_test(add_executable, |root| {
+            let res = std::process::Command::new(root.join("executable")).status();
+            res.unwrap();
+        });
+
+        // Mounting with noexec results in permissions denial when running an executable.
+        let noexec = true;
+        run_test_noexec(noexec, add_executable, |root| {
+            let res = std::process::Command::new(root.join("executable")).status();
+            assert!(matches!(res.unwrap_err().kind(), std::io::ErrorKind::PermissionDenied));
+        });
+    }
+
+    #[test]
     fn single_dir() {
         run_test(
             |zip| {
@@ -688,7 +734,8 @@
         let mnt_path = test_dir.join("mnt");
         assert!(fs::create_dir(&mnt_path).is_ok());
 
-        start_fuse(zip_path, &mnt_path);
+        let noexec = false;
+        start_fuse(zip_path, &mnt_path, noexec);
 
         // Give some time for the fuse to boot up
         assert!(wait_for_mount(&mnt_path).is_ok());