diff --git a/keystore/Android.bp b/keystore/Android.bp
new file mode 100644
index 0000000..7e91c72
--- /dev/null
+++ b/keystore/Android.bp
@@ -0,0 +1,197 @@
+cc_defaults {
+    name: "keystore_defaults",
+
+    cflags: [
+        "-Wall",
+        "-Werror",
+        "-Wextra",
+        "-Wunused",
+    ],
+
+    sanitize: {
+        misc_undefined: ["integer"],
+    },
+
+    clang: true,
+}
+
+cc_binary {
+    name: "keystore",
+    defaults: ["keystore_defaults"],
+
+    srcs: [
+        ":IKeyAttestationApplicationIdProvider.aidl",
+        "auth_token_table.cpp",
+        "blob.cpp",
+        "entropy.cpp",
+        "grant_store.cpp",
+        "key_store_service.cpp",
+        "keyblob_utils.cpp",
+        "keymaster_enforcement.cpp",
+        "keystore.cpp",
+        "keystore_attestation_id.cpp",
+        "keystore_main.cpp",
+        "keystore_utils.cpp",
+        "legacy_keymaster_device_wrapper.cpp",
+        "operation.cpp",
+        "permissions.cpp",
+        "user_state.cpp",
+    ],
+    shared_libs: [
+        "android.hardware.keymaster@3.0",
+        "android.system.wifi.keystore@1.0",
+        "libbinder",
+        "libcrypto",
+        "libcutils",
+        "libhardware",
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libkeymaster_messages",
+        "libkeymaster_portable",
+        "libkeymaster_staging",
+        "libkeystore_binder",
+        "liblog",
+        "libselinux",
+        "libsoftkeymaster",
+        "libsoftkeymasterdevice",
+        "libutils",
+        "libwifikeystorehal",
+    ],
+    init_rc: ["keystore.rc"],
+    aidl: {
+        include_dirs: ["frameworks/base/core/java/"],
+    },
+
+    product_variables: {
+        pdk: {
+            enabled: false,
+        },
+    },
+}
+
+cc_binary {
+    name: "keystore_cli",
+    defaults: ["keystore_defaults"],
+    tags: ["debug"],
+
+    srcs: ["keystore_cli.cpp"],
+    shared_libs: [
+        "android.hardware.keymaster@3.0",
+        "libbinder",
+        "libcrypto",
+        "libcutils",
+        "libhidlbase",
+        "libhwbinder",
+        "libkeystore_binder",
+        "liblog",
+        "libutils",
+    ],
+}
+
+cc_binary {
+    name: "keystore_cli_v2",
+    defaults: ["keystore_defaults"],
+    tags: ["debug"],
+
+    cflags: [
+        "-DKEYMASTER_NAME_TAGS",
+        "-Wno-unused-parameter",
+    ],
+    srcs: ["keystore_cli_v2.cpp"],
+    shared_libs: [
+        "android.hardware.keymaster@3.0",
+        "libchrome",
+        "libhidlbase",
+        "libhwbinder",
+        "libkeystore_binder",
+    ],
+
+    local_include_dirs: ["include"],
+}
+
+// Library for keystore clients
+cc_library_shared {
+    name: "libkeystore_binder",
+    defaults: ["keystore_defaults"],
+
+    srcs: [
+        "IKeystoreService.cpp",
+        "KeyAttestationApplicationId.cpp",
+        "KeyAttestationPackageInfo.cpp",
+        "Signature.cpp",
+        "authorization_set.cpp",
+        "keyblob_utils.cpp",
+        "keystore_aidl_hidl_marshalling_utils.cpp",
+        "keystore_client.proto",
+        "keystore_client_impl.cpp",
+        "keystore_get.cpp",
+        "keystore_tags_utils.cpp",
+    ],
+    shared_libs: [
+        "android.hardware.keymaster@3.0",
+        "libbinder",
+        "libhidlbase",
+        "libhwbinder",
+        "liblog",
+        "libprotobuf-cpp-lite",
+        "libutils",
+    ],
+
+    proto: {
+        type: "lite",
+        export_proto_headers: true,
+    },
+    export_include_dirs: ["include"],
+    export_shared_lib_headers: [
+        "android.hardware.keymaster@3.0",
+        "libbinder",
+        "libhidlbase",
+        "libhwbinder",
+    ],
+}
+
+// Library for keystore clients using the WiFi HIDL interface
+cc_library_shared {
+    name: "libkeystore-wifi-hidl",
+    defaults: ["keystore_defaults"],
+
+    srcs: ["keystore_get_wifi_hidl.cpp"],
+    shared_libs: [
+        "android.system.wifi.keystore@1.0",
+        "libbase",
+        "libhidlbase",
+        "libhidltransport",
+        "liblog",
+        "libutils",
+    ],
+
+    export_include_dirs: ["include"],
+
+    vendor: true,
+}
+
+// Library for unit tests
+cc_library_static {
+    name: "libkeystore_test",
+    defaults: ["keystore_defaults"],
+
+    srcs: ["auth_token_table.cpp"],
+    static_libs: ["libgtest_main"],
+    shared_libs: [
+        "android.hardware.keymaster@3.0",
+        "libhidlbase",
+        "libhwbinder",
+        "libkeymaster_messages",
+        "libutils",
+    ],
+    export_shared_lib_headers: [
+        "android.hardware.keymaster@3.0",
+        "libhidlbase",
+        "libhwbinder",
+    ],
+
+    export_include_dirs: ["include"],
+}
+
+subdirs = ["tests"]
diff --git a/keystore/Android.mk b/keystore/Android.mk
deleted file mode 100644
index 7dd5aef..0000000
--- a/keystore/Android.mk
+++ /dev/null
@@ -1,195 +0,0 @@
-#
-# Copyright (C) 2009 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-LOCAL_PATH := $(call my-dir)
-
-# This has to be lazy-resolved because it depends on the LOCAL_MODULE_CLASS
-# which varies depending on what is being built.
-define keystore_proto_include
-$(call local-generated-sources-dir)/proto/$(LOCAL_PATH)
-endef
-
-ifneq ($(TARGET_BUILD_PDK),true)
-include $(CLEAR_VARS)
-ifeq ($(USE_32_BIT_KEYSTORE), true)
-LOCAL_MULTILIB := 32
-endif
-LOCAL_CFLAGS := -Wall -Wextra -Werror -Wunused
-LOCAL_SRC_FILES := \
-	auth_token_table.cpp \
-	blob.cpp \
-	entropy.cpp \
-	key_store_service.cpp \
-	keystore_attestation_id.cpp \
-	keyblob_utils.cpp \
-	keystore.cpp \
-	keystore_main.cpp \
-	keystore_utils.cpp \
-	legacy_keymaster_device_wrapper.cpp \
-	keymaster_enforcement.cpp \
-	operation.cpp \
-	permissions.cpp \
-	user_state.cpp \
-	grant_store.cpp \
-	../../../frameworks/base/core/java/android/security/keymaster/IKeyAttestationApplicationIdProvider.aidl
-LOCAL_SHARED_LIBRARIES := \
-	libbinder \
-	libcutils \
-	libcrypto \
-	libhardware \
-	libwifikeystorehal \
-	libkeystore_binder \
-	liblog \
-	libsoftkeymaster \
-	libutils \
-	libselinux \
-	libsoftkeymasterdevice \
-	libkeymaster_messages \
-	libkeymaster_portable \
-	libkeymaster_staging \
-	libhwbinder \
-	libhidlbase \
-	libhidltransport \
-	android.hardware.keymaster@3.0 \
-	android.system.wifi.keystore@1.0
-LOCAL_HEADER_LIBRARIES := libbase_headers
-LOCAL_MODULE := keystore
-LOCAL_MODULE_TAGS := optional
-LOCAL_INIT_RC := keystore.rc
-LOCAL_C_INCLUES := system/keymaster/
-LOCAL_CLANG := true
-LOCAL_SANITIZE := integer
-LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
-LOCAL_AIDL_INCLUDES := frameworks/base/core/java/
-include $(BUILD_EXECUTABLE)
-endif
-
-include $(CLEAR_VARS)
-ifeq ($(USE_32_BIT_KEYSTORE), true)
-LOCAL_MULTILIB := 32
-endif
-LOCAL_CFLAGS := -Wall -Wextra -Werror
-LOCAL_SRC_FILES := keystore_cli.cpp
-LOCAL_SHARED_LIBRARIES := libcutils libcrypto libkeystore_binder libutils liblog libbinder \
-	libhwbinder \
-	libhidlbase \
-	android.hardware.keymaster@3.0
-LOCAL_MODULE := keystore_cli
-LOCAL_MODULE_TAGS := debug
-LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
-include $(BUILD_EXECUTABLE)
-
-include $(CLEAR_VARS)
-ifeq ($(USE_32_BIT_KEYSTORE), true)
-LOCAL_MULTILIB := 32
-endif
-LOCAL_CFLAGS := -Wall -Wextra -Werror -Wno-unused-parameter -DKEYMASTER_NAME_TAGS
-LOCAL_SRC_FILES := keystore_cli_v2.cpp
-LOCAL_SHARED_LIBRARIES := \
-	libchrome \
-	libkeystore_binder \
-	libhwbinder \
-	libhidlbase \
-	android.hardware.keymaster@3.0
-
-LOCAL_MODULE := keystore_cli_v2
-LOCAL_MODULE_TAGS := debug
-LOCAL_C_INCLUDES := $(LOCAL_PATH)/include external/gtest/include
-LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
-include $(BUILD_EXECUTABLE)
-
-# Library for keystore clients
-include $(CLEAR_VARS)
-ifeq ($(USE_32_BIT_KEYSTORE), true)
-LOCAL_MULTILIB := 32
-endif
-LOCAL_CFLAGS := -Wall -Wextra -Werror
-LOCAL_SRC_FILES := \
-	IKeystoreService.cpp \
-	KeyAttestationApplicationId.cpp \
-	KeyAttestationPackageInfo.cpp \
-	Signature.cpp \
-	keyblob_utils.cpp \
-	keystore_client.proto \
-	keystore_client_impl.cpp \
-	keystore_get.cpp \
-	authorization_set.cpp \
-	keystore_tags_utils.cpp \
-	keystore_aidl_hidl_marshalling_utils.cpp
-LOCAL_SHARED_LIBRARIES := \
-	libbinder \
-	liblog \
-	libprotobuf-cpp-lite \
-	libutils \
-	libhwbinder \
-	libhidlbase \
-	android.hardware.keymaster@3.0
-LOCAL_MODULE_CLASS := SHARED_LIBRARIES
-LOCAL_MODULE := libkeystore_binder
-LOCAL_MODULE_TAGS := optional
-LOCAL_C_INCLUDES := $(LOCAL_PATH)/include $(call keystore_proto_include)
-LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/include
-LOCAL_EXPORT_SHARED_LIBRARY_HEADERS := libbinder \
-	libhwbinder \
-	libhidlbase \
-	android.hardware.keymaster@3.0
-LOCAL_CLANG := true
-LOCAL_SANITIZE := integer
-LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
-include $(BUILD_SHARED_LIBRARY)
-
-# Library for keystore clients using the WiFi HIDL interface
-include $(CLEAR_VARS)
-LOCAL_CFLAGS := -Wall -Wextra -Werror
-LOCAL_SRC_FILES := \
-	keystore_get_wifi_hidl.cpp
-LOCAL_SHARED_LIBRARIES := \
-	android.system.wifi.keystore@1.0 \
-	libbase \
-	libhidlbase \
-	libhidltransport \
-	liblog \
-	libutils
-LOCAL_MODULE_CLASS := SHARED_LIBRARIES
-LOCAL_MODULE := libkeystore-wifi-hidl
-LOCAL_MODULE_TAGS := optional
-LOCAL_C_INCLUDES := $(LOCAL_PATH)/include
-LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/include
-LOCAL_CLANG := true
-LOCAL_SANITIZE := integer
-LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
-LOCAL_VENDOR_MODULE := true
-include $(BUILD_SHARED_LIBRARY)
-
-# Library for unit tests
-include $(CLEAR_VARS)
-ifeq ($(USE_32_BIT_KEYSTORE), true)
-LOCAL_MULTILIB := 32
-endif
-LOCAL_CFLAGS := -Wall -Wextra -Werror
-LOCAL_SRC_FILES := auth_token_table.cpp
-LOCAL_MODULE := libkeystore_test
-LOCAL_C_INCLUDES := $(LOCAL_PATH)/include
-LOCAL_STATIC_LIBRARIES := libgtest_main
-LOCAL_SHARED_LIBRARIES := libkeymaster_messages \
-	libutils \
-	libhwbinder \
-	libhidlbase \
-	android.hardware.keymaster@3.0
-
-LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/include
-LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
-include $(BUILD_STATIC_LIBRARY)
diff --git a/keystore/tests/Android.bp b/keystore/tests/Android.bp
new file mode 100644
index 0000000..cc89681
--- /dev/null
+++ b/keystore/tests/Android.bp
@@ -0,0 +1,20 @@
+// Unit test for AuthTokenTable
+// TODO: enable after fixing b/68149839
+/*
+cc_test {
+    cflags: [
+        "-Wall",
+        "-Werror",
+        "-Wextra",
+    ],
+    srcs: ["auth_token_table_test.cpp"],
+    name: "keystore_unit_tests",
+    tags: ["test"],
+    static_libs: [
+        "libgtest_main",
+        "libkeystore_test",
+        "liblog",
+    ],
+    shared_libs: ["libkeymaster_messages"],
+}
+*/
diff --git a/keystore/tests/Android.mk b/keystore/tests/Android.mk
deleted file mode 100644
index 8126c94..0000000
--- a/keystore/tests/Android.mk
+++ /dev/null
@@ -1,33 +0,0 @@
-#
-# Copyright (C) 2015 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-LOCAL_PATH := $(call my-dir)
-
-# Unit test for AuthTokenTable
-include $(CLEAR_VARS)
-ifeq ($(USE_32_BIT_KEYSTORE), true)
-LOCAL_MULTILIB := 32
-endif
-LOCAL_CFLAGS := -Wall -Wextra -Werror
-LOCAL_SRC_FILES := \
-	auth_token_table_test.cpp
-LOCAL_MODULE := keystore_unit_tests
-LOCAL_MODULE_TAGS := test
-LOCAL_C_INCLUDES := $(LOCAL_PATH)/include
-LOCAL_STATIC_LIBRARIES := libgtest_main libkeystore_test liblog
-LOCAL_SHARED_LIBRARIES := libkeymaster_messages
-LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
-include $(BUILD_NATIVE_TEST)