diff --git a/ondevice-signing/KeystoreKey.cpp b/ondevice-signing/KeystoreKey.cpp
index ea84183..cd5c398 100644
--- a/ondevice-signing/KeystoreKey.cpp
+++ b/ondevice-signing/KeystoreKey.cpp
@@ -53,6 +53,9 @@
 
 using android::base::unique_fd;
 
+// Keystore boot level that the odsign key uses
+static const int kOdsignBootLevel = 30;
+
 static KeyDescriptor getKeyDescriptor() {
     // AIDL parcelable objects don't have constructor
     static KeyDescriptor descriptor;
@@ -107,6 +110,11 @@
     auth.value = KeyParameterValue::make<KeyParameterValue::boolValue>(true);
     params.push_back(auth);
 
+    KeyParameter boot_level;
+    boot_level.tag = Tag::MAX_BOOT_LEVEL;
+    boot_level.value = KeyParameterValue::make<KeyParameterValue::integer>(kOdsignBootLevel);
+    params.push_back(boot_level);
+
     KeyMetadata metadata;
     auto status = mSecurityLevel->generateKey(descriptor, {}, params, 0, {}, &metadata);
     if (!status.isOk()) {