diff --git a/launcher/Android.bp b/launcher/Android.bp
index 2c3f093..93cae96 100644
--- a/launcher/Android.bp
+++ b/launcher/Android.bp
@@ -5,5 +5,8 @@
 cc_binary {
     name: "microdroid_launcher",
     srcs: ["main.cpp"],
-    shared_libs: ["libdl"],
+    shared_libs: [
+        "libdl",
+        "libdl_android",
+    ],
 }
diff --git a/launcher/main.cpp b/launcher/main.cpp
index fc9477d..4ecef3f 100644
--- a/launcher/main.cpp
+++ b/launcher/main.cpp
@@ -18,6 +18,24 @@
 
 #include <cstdlib>
 #include <iostream>
+#include <string>
+
+#include <android/dlext.h>
+
+extern "C" {
+enum {
+    ANDROID_NAMESPACE_TYPE_REGULAR = 0,
+    ANDROID_NAMESPACE_TYPE_ISOLATED = 1,
+    ANDROID_NAMESPACE_TYPE_SHARED = 2,
+};
+
+extern struct android_namespace_t* android_create_namespace(
+        const char* name, const char* ld_library_path, const char* default_library_path,
+        uint64_t type, const char* permitted_when_isolated_path,
+        struct android_namespace_t* parent);
+} // extern "C"
+
+static void* load(const std::string& libname);
 
 int main(int argc, char* argv[]) {
     if (argc < 2) {
@@ -27,7 +45,7 @@
     }
 
     const char* libname = argv[1];
-    void* handle = dlopen(libname, RTLD_NOW);
+    void* handle = load(libname);
     if (handle == nullptr) {
         std::cerr << "Failed to load " << libname << ": " << dlerror() << "\n";
         return EXIT_FAILURE;
@@ -42,3 +60,31 @@
 
     return entry(argc - 1, argv + 1);
 }
+
+// Create a new linker namespace whose search path is set to the directory of the library. Then
+// load it from there. Returns the handle to the loaded library if successful. Returns nullptr
+// if failed.
+void* load(const std::string& libname) {
+    // Parent as nullptr means the default namespace
+    android_namespace_t* parent = nullptr;
+    // The search paths of the new namespace are inherited from the parent namespace.
+    const uint64_t type = ANDROID_NAMESPACE_TYPE_SHARED;
+    // The directory of the library is appended to the search paths
+    const std::string libdir = libname.substr(0, libname.find_last_of("/"));
+    const char* ld_library_path = libdir.c_str();
+    const char* default_library_path = libdir.c_str();
+
+    android_namespace_t* new_ns = nullptr;
+    new_ns = android_create_namespace("microdroid_app", ld_library_path, default_library_path, type,
+                                      /* permitted_when_isolated_path */ nullptr, parent);
+    if (new_ns == nullptr) {
+        std::cerr << "Failed to create linker namespace: " << dlerror() << "\n";
+        return nullptr;
+    }
+
+    const android_dlextinfo info = {
+            .flags = ANDROID_DLEXT_USE_NAMESPACE,
+            .library_namespace = new_ns,
+    };
+    return android_dlopen_ext(libname.c_str(), RTLD_NOW, &info);
+}
diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index 55d1eae..6424988 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -77,8 +77,6 @@
         "cgroups.json",
         "public.libraries.android.txt",
 
-        "android.system.keystore2-V1-ndk_platform",
-
         // TODO(b/185767624): remove hidl after full keymint support
         "hwservicemanager",
 
diff --git a/tests/hostside/java/android/virt/test/MicrodroidTestCase.java b/tests/hostside/java/android/virt/test/MicrodroidTestCase.java
index f9794f7..5a11e9c 100644
--- a/tests/hostside/java/android/virt/test/MicrodroidTestCase.java
+++ b/tests/hostside/java/android/virt/test/MicrodroidTestCase.java
@@ -97,6 +97,7 @@
         // Check if the command in vm_config.json was executed by examining the side effect of the
         // command
         assertThat(runOnMicrodroid("getprop", "debug.microdroid.app.run"), is("true"));
+        assertThat(runOnMicrodroid("getprop", "debug.microdroid.app.sublib.run"), is("true"));
 
         // Manually execute the library and check the output
         final String microdroidLauncher = "system/bin/microdroid_launcher";
diff --git a/tests/testapk/Android.bp b/tests/testapk/Android.bp
index 1122b25..fdc95de 100644
--- a/tests/testapk/Android.bp
+++ b/tests/testapk/Android.bp
@@ -13,13 +13,19 @@
 // TODO(jiyong): make this a binary, not a shared library
 cc_library_shared {
     name: "MicrodroidTestNativeLib",
-    srcs: ["src/native/*.cpp"],
+    srcs: ["src/native/testbinary.cpp"],
     shared_libs: [
         "android.system.keystore2-V1-ndk_platform",
         "libbinder_ndk",
+        "MicrodroidTestNativeLibSub",
     ],
 }
 
+cc_library_shared {
+    name: "MicrodroidTestNativeLibSub",
+    srcs: ["src/native/testlib.cpp"],
+}
+
 genrule {
     name: "MicrodroidTestApp.signed",
     out: [
@@ -27,12 +33,12 @@
         "MicrodroidTestApp.apk.idsig",
     ],
     srcs: [":MicrodroidTestApp"],
-    tools:["apksigner"],
+    tools: ["apksigner"],
     tool_files: ["test.keystore"],
     cmd: "$(location apksigner) sign " +
-         "--ks $(location test.keystore) " +
-         "--ks-pass=pass:testkey --key-pass=pass:testkey " +
-         "--in $(in) " +
-         "--out $(genDir)/MicrodroidTestApp.apk",
-         // $(genDir)/MicrodroidTestApp.apk.idsig is generated implicitly
+        "--ks $(location test.keystore) " +
+        "--ks-pass=pass:testkey --key-pass=pass:testkey " +
+        "--in $(in) " +
+        "--out $(genDir)/MicrodroidTestApp.apk",
+    // $(genDir)/MicrodroidTestApp.apk.idsig is generated implicitly
 }
diff --git a/tests/testapk/src/native/testbinary.cpp b/tests/testapk/src/native/testbinary.cpp
index 682ab2a..9bd594b 100644
--- a/tests/testapk/src/native/testbinary.cpp
+++ b/tests/testapk/src/native/testbinary.cpp
@@ -24,6 +24,8 @@
 using aidl::android::system::keystore2::IKeystoreSecurityLevel;
 using aidl::android::system::keystore2::IKeystoreService;
 
+extern void testlib_sub();
+
 namespace {
 
 bool test_keystore() {
@@ -52,6 +54,7 @@
             printf(" ");
         }
     }
+    testlib_sub();
     printf("\n");
 
     __system_property_set("debug.microdroid.app.run", "true");
diff --git a/tests/testapk/src/native/testlib.cpp b/tests/testapk/src/native/testlib.cpp
new file mode 100644
index 0000000..792c6c8
--- /dev/null
+++ b/tests/testapk/src/native/testlib.cpp
@@ -0,0 +1,5 @@
+#include <sys/system_properties.h>
+
+void testlib_sub() {
+    __system_property_set("debug.microdroid.app.sublib.run", "true");
+}