diff --git a/keystore2/aconfig/flags.aconfig b/keystore2/aconfig/flags.aconfig
index 5d2a422..02716da 100644
--- a/keystore2/aconfig/flags.aconfig
+++ b/keystore2/aconfig/flags.aconfig
@@ -15,3 +15,11 @@
   bug: "307460850"
   is_fixed_read_only: true
 }
+
+flag {
+  name: "import_previously_emulated_keys"
+  namespace: "hardware_backed_security"
+  description: "Include support for importing keys that were previously software-emulated into KeyMint"
+  bug: "283077822"
+  is_fixed_read_only: true
+}
\ No newline at end of file
diff --git a/keystore2/src/utils.rs b/keystore2/src/utils.rs
index 74a5ae6..174a22b 100644
--- a/keystore2/src/utils.rs
+++ b/keystore2/src/utils.rs
@@ -367,7 +367,9 @@
                     km_op,
                     new_blob_handler,
                 )
-            } else if key_blob.starts_with(km_compat::KEYMASTER_BLOB_SW_PREFIX) {
+            } else if keystore2_flags::import_previously_emulated_keys()
+                && key_blob.starts_with(km_compat::KEYMASTER_BLOB_SW_PREFIX)
+            {
                 // 2) The keyblob was created in software by the km_compat C++ code because a prior
                 //    Keymaster implementation did not support ECDH (which was only added in KeyMint).
                 //
@@ -386,9 +388,10 @@
                     km_op,
                     new_blob_handler,
                 )
-            } else if let km_compat::KeyBlob::Wrapped(inner_keyblob) =
-                km_compat::unwrap_keyblob(key_blob)
-            {
+            } else if let (true, km_compat::KeyBlob::Wrapped(inner_keyblob)) = (
+                keystore2_flags::import_previously_emulated_keys(),
+                km_compat::unwrap_keyblob(key_blob),
+            ) {
                 // 3) The keyblob was created in software by km_compat.rs because a prior KeyMint
                 //    implementation did not support a feature present in the current KeyMint spec.
                 //    (For example, a curve 25519 key created when the device only supported KeyMint