diff --git a/update_manager/chromeos_policy.cc b/update_manager/chromeos_policy.cc
index aed2aaa..fa32175 100644
--- a/update_manager/chromeos_policy.cc
+++ b/update_manager/chromeos_policy.cc
@@ -211,19 +211,44 @@
   const bool* device_policy_is_loaded_p = ec->GetValue(
       dp_provider->var_device_policy_is_loaded());
   if (device_policy_is_loaded_p && *device_policy_is_loaded_p) {
+    bool kiosk_app_control_chrome_version = false;
+
     // Check whether updates are disabled by policy.
     const bool* update_disabled_p = ec->GetValue(
         dp_provider->var_update_disabled());
     if (update_disabled_p && *update_disabled_p) {
-      LOG(INFO) << "Updates disabled by policy, blocking update checks.";
-      return EvalStatus::kAskMeAgainLater;
+      // Check whether allow kiosk app to control chrome version policy. This
+      // policy is only effective when AU is disabled by admin.
+      const bool* allow_kiosk_app_control_chrome_version_p = ec->GetValue(
+          dp_provider->var_allow_kiosk_app_control_chrome_version());
+      kiosk_app_control_chrome_version =
+          allow_kiosk_app_control_chrome_version_p &&
+          *allow_kiosk_app_control_chrome_version_p;
+      if (!kiosk_app_control_chrome_version) {
+        // No kiosk pin chrome version policy. AU is really disabled.
+        LOG(INFO) << "Updates disabled by policy, blocking update checks.";
+        return EvalStatus::kAskMeAgainLater;
+      }
     }
 
-    // Determine whether a target version prefix is dictated by policy.
-    const string* target_version_prefix_p = ec->GetValue(
-        dp_provider->var_target_version_prefix());
-    if (target_version_prefix_p)
-      result->target_version_prefix = *target_version_prefix_p;
+    if (kiosk_app_control_chrome_version) {
+      // Get the required platform version from Chrome.
+      const string* kiosk_required_platform_version_p =
+          ec->GetValue(system_provider->var_kiosk_required_platform_version());
+      if (kiosk_required_platform_version_p)
+        result->target_version_prefix = *kiosk_required_platform_version_p;
+      LOG(INFO) << "Allow kiosk app to control Chrome version policy is set,"
+                << ", target version is "
+                << (kiosk_required_platform_version_p
+                        ? *kiosk_required_platform_version_p
+                        : std::string("latest"));
+    } else {
+      // Determine whether a target version prefix is dictated by policy.
+      const string* target_version_prefix_p = ec->GetValue(
+          dp_provider->var_target_version_prefix());
+      if (target_version_prefix_p)
+        result->target_version_prefix = *target_version_prefix_p;
+    }
 
     // Determine whether a target channel is dictated by policy.
     const bool* release_channel_delegated_p = ec->GetValue(
diff --git a/update_manager/chromeos_policy_unittest.cc b/update_manager/chromeos_policy_unittest.cc
index a78257d..9177136 100644
--- a/update_manager/chromeos_policy_unittest.cc
+++ b/update_manager/chromeos_policy_unittest.cc
@@ -472,6 +472,65 @@
   EXPECT_FALSE(result.is_interactive);
 }
 
+TEST_F(UmChromeOSPolicyTest, UpdateCheckAllowedKioskPin) {
+  // Update check is allowed.
+  SetUpdateCheckAllowed(true);
+
+  // A typical setup for kiosk pin policy: AU disabled, allow kiosk to pin
+  // and there is a kiosk required platform version.
+  fake_state_.device_policy_provider()->var_update_disabled()->reset(
+      new bool(true));
+  fake_state_.device_policy_provider()
+      ->var_allow_kiosk_app_control_chrome_version()
+      ->reset(new bool(true));
+  fake_state_.system_provider()->var_kiosk_required_platform_version()->reset(
+      new string("1234.0.0"));
+
+  UpdateCheckParams result;
+  ExpectPolicyStatus(EvalStatus::kSucceeded,
+                     &Policy::UpdateCheckAllowed, &result);
+  EXPECT_TRUE(result.updates_enabled);
+  EXPECT_EQ("1234.0.0", result.target_version_prefix);
+  EXPECT_FALSE(result.is_interactive);
+}
+
+TEST_F(UmChromeOSPolicyTest, UpdateCheckAllowedDisabledWhenNoKioskPin) {
+  // Update check is allowed.
+  SetUpdateCheckAllowed(true);
+
+  // Disable AU policy is set but kiosk pin policy is set to false. Update is
+  // disabled in such case.
+  fake_state_.device_policy_provider()->var_update_disabled()->reset(
+      new bool(true));
+  fake_state_.device_policy_provider()
+      ->var_allow_kiosk_app_control_chrome_version()
+      ->reset(new bool(false));
+
+  UpdateCheckParams result;
+  ExpectPolicyStatus(EvalStatus::kAskMeAgainLater,
+                     &Policy::UpdateCheckAllowed, &result);
+}
+
+TEST_F(UmChromeOSPolicyTest, UpdateCheckAllowedKioskPinWithNoRequiredVersion) {
+  // Update check is allowed.
+  SetUpdateCheckAllowed(true);
+
+  // AU disabled, allow kiosk to pin but there is no kiosk required platform
+  // version (due to Chrome crash or app does not provide the info). Update to
+  // latest in such case.
+  fake_state_.device_policy_provider()->var_update_disabled()->reset(
+      new bool(true));
+  fake_state_.device_policy_provider()
+      ->var_allow_kiosk_app_control_chrome_version()
+      ->reset(new bool(true));
+
+  UpdateCheckParams result;
+  ExpectPolicyStatus(EvalStatus::kSucceeded,
+                     &Policy::UpdateCheckAllowed, &result);
+  EXPECT_TRUE(result.updates_enabled);
+  EXPECT_FALSE(result.is_interactive);
+}
+
 TEST_F(UmChromeOSPolicyTest, UpdateCanStartFailsCheckAllowedError) {
   // The UpdateCanStart policy fails, not being able to query
   // UpdateCheckAllowed.
diff --git a/update_manager/device_policy_provider.h b/update_manager/device_policy_provider.h
index f75d470..0eb04c1 100644
--- a/update_manager/device_policy_provider.h
+++ b/update_manager/device_policy_provider.h
@@ -63,6 +63,8 @@
 
   virtual Variable<bool>* var_au_p2p_enabled() = 0;
 
+  virtual Variable<bool>* var_allow_kiosk_app_control_chrome_version() = 0;
+
  protected:
   DevicePolicyProvider() {}
 
diff --git a/update_manager/fake_device_policy_provider.h b/update_manager/fake_device_policy_provider.h
index ad15c99..0ab2d3c 100644
--- a/update_manager/fake_device_policy_provider.h
+++ b/update_manager/fake_device_policy_provider.h
@@ -71,6 +71,10 @@
     return &var_au_p2p_enabled_;
   }
 
+  FakeVariable<bool>* var_allow_kiosk_app_control_chrome_version() override {
+    return &var_allow_kiosk_app_control_chrome_version_;
+  }
+
  private:
   FakeVariable<bool> var_device_policy_is_loaded_{
       "policy_is_loaded", kVariableModePoll};
@@ -91,6 +95,8 @@
   FakeVariable<bool> var_http_downloads_enabled_{
       "http_downloads_enabled", kVariableModePoll};
   FakeVariable<bool> var_au_p2p_enabled_{"au_p2p_enabled", kVariableModePoll};
+  FakeVariable<bool> var_allow_kiosk_app_control_chrome_version_{
+      "allow_kiosk_app_control_chrome_version", kVariableModePoll};
 
   DISALLOW_COPY_AND_ASSIGN(FakeDevicePolicyProvider);
 };
diff --git a/update_manager/fake_system_provider.h b/update_manager/fake_system_provider.h
index 6036198..0f4dff4 100644
--- a/update_manager/fake_system_provider.h
+++ b/update_manager/fake_system_provider.h
@@ -43,6 +43,10 @@
     return &var_num_slots_;
   }
 
+  FakeVariable<std::string>* var_kiosk_required_platform_version() override {
+    return &var_kiosk_required_platform_version_;
+  }
+
  private:
   FakeVariable<bool> var_is_normal_boot_mode_{  // NOLINT(whitespace/braces)
     "is_normal_boot_mode", kVariableModeConst};
@@ -51,6 +55,8 @@
   FakeVariable<bool> var_is_oobe_complete_{  // NOLINT(whitespace/braces)
     "is_oobe_complete", kVariableModePoll};
   FakeVariable<unsigned int> var_num_slots_{"num_slots", kVariableModePoll};
+  FakeVariable<std::string> var_kiosk_required_platform_version_{
+      "kiosk_required_platform_version", kVariableModePoll};
 
   DISALLOW_COPY_AND_ASSIGN(FakeSystemProvider);
 };
diff --git a/update_manager/real_device_policy_provider.cc b/update_manager/real_device_policy_provider.cc
index 0abd9f7..0e76518 100644
--- a/update_manager/real_device_policy_provider.cc
+++ b/update_manager/real_device_policy_provider.cc
@@ -182,6 +182,8 @@
   UpdateVariable(&var_http_downloads_enabled_,
                  &DevicePolicy::GetHttpDownloadsEnabled);
   UpdateVariable(&var_au_p2p_enabled_, &DevicePolicy::GetAuP2PEnabled);
+  UpdateVariable(&var_allow_kiosk_app_control_chrome_version_,
+                 &DevicePolicy::GetAllowKioskAppControlChromeVersion);
 }
 
 }  // namespace chromeos_update_manager
diff --git a/update_manager/real_device_policy_provider.h b/update_manager/real_device_policy_provider.h
index 6094e93..6e798ca 100644
--- a/update_manager/real_device_policy_provider.h
+++ b/update_manager/real_device_policy_provider.h
@@ -84,6 +84,10 @@
     return &var_au_p2p_enabled_;
   }
 
+  Variable<bool>* var_allow_kiosk_app_control_chrome_version() override {
+    return &var_allow_kiosk_app_control_chrome_version_;
+  }
+
  private:
   FRIEND_TEST(UmRealDevicePolicyProviderTest, RefreshScheduledTest);
   FRIEND_TEST(UmRealDevicePolicyProviderTest, NonExistentDevicePolicyReloaded);
@@ -157,6 +161,8 @@
   AsyncCopyVariable<std::string> var_owner_{"owner"};
   AsyncCopyVariable<bool> var_http_downloads_enabled_{"http_downloads_enabled"};
   AsyncCopyVariable<bool> var_au_p2p_enabled_{"au_p2p_enabled"};
+  AsyncCopyVariable<bool> var_allow_kiosk_app_control_chrome_version_{
+      "allow_kiosk_app_control_chrome_version"};
 
   DISALLOW_COPY_AND_ASSIGN(RealDevicePolicyProvider);
 };
diff --git a/update_manager/real_device_policy_provider_unittest.cc b/update_manager/real_device_policy_provider_unittest.cc
index c480b60..09c9095 100644
--- a/update_manager/real_device_policy_provider_unittest.cc
+++ b/update_manager/real_device_policy_provider_unittest.cc
@@ -158,6 +158,8 @@
   UmTestUtils::ExpectVariableNotSet(provider_->var_owner());
   UmTestUtils::ExpectVariableNotSet(provider_->var_http_downloads_enabled());
   UmTestUtils::ExpectVariableNotSet(provider_->var_au_p2p_enabled());
+  UmTestUtils::ExpectVariableNotSet(
+      provider_->var_allow_kiosk_app_control_chrome_version());
 }
 
 TEST_F(UmRealDevicePolicyProviderTest, ValuesUpdated) {
@@ -173,6 +175,8 @@
       .WillOnce(DoAll(SetArgPointee<0>(string("mychannel")), Return(true)));
   EXPECT_CALL(mock_device_policy_, GetAllowedConnectionTypesForUpdate(_))
       .WillOnce(Return(false));
+  EXPECT_CALL(mock_device_policy_, GetAllowKioskAppControlChromeVersion(_))
+      .WillOnce(DoAll(SetArgPointee<0>(true), Return(true)));
 
   provider_->RefreshDevicePolicy();
 
@@ -184,6 +188,8 @@
                                       provider_->var_release_channel());
   UmTestUtils::ExpectVariableNotSet(
       provider_->var_allowed_connection_types_for_update());
+  UmTestUtils::ExpectVariableHasValue(
+      true, provider_->var_allow_kiosk_app_control_chrome_version());
 }
 
 TEST_F(UmRealDevicePolicyProviderTest, ScatterFactorConverted) {
diff --git a/update_manager/real_system_provider.cc b/update_manager/real_system_provider.cc
index 040f37c..f90e1ed 100644
--- a/update_manager/real_system_provider.cc
+++ b/update_manager/real_system_provider.cc
@@ -29,6 +29,7 @@
 #include <base/time/time.h>
 
 #include "update_engine/common/utils.h"
+#include "update_engine/libcros_proxy.h"
 #include "update_engine/update_manager/generic_variables.h"
 
 using std::string;
@@ -54,7 +55,28 @@
       new ConstCopyVariable<unsigned int>(
           "num_slots", boot_control_->GetNumSlots()));
 
+  var_kiosk_required_platform_version_.reset(new CallCopyVariable<std::string>(
+      "kiosk_required_platform_version",
+      base::TimeDelta::FromHours(5),  // Same as Chrome's CWS poll.
+      base::Bind(&RealSystemProvider::GetKioskAppRequiredPlatformVersion,
+                 base::Unretained(this))));
+
   return true;
 }
 
+std::string RealSystemProvider::GetKioskAppRequiredPlatformVersion() {
+  std::string required_platform_version;
+
+#if USE_LIBCROS
+  brillo::ErrorPtr error;
+  if (!libcros_proxy_->service_interface_proxy()
+           ->GetKioskAppRequiredPlatformVersion(&required_platform_version,
+                                                &error)) {
+    LOG(WARNING) << "Failed to get kiosk required platform version";
+  }
+#endif
+
+  return required_platform_version;
+}
+
 }  // namespace chromeos_update_manager
diff --git a/update_manager/real_system_provider.h b/update_manager/real_system_provider.h
index 0329d74..f089a29 100644
--- a/update_manager/real_system_provider.h
+++ b/update_manager/real_system_provider.h
@@ -24,15 +24,21 @@
 #include "update_engine/common/hardware_interface.h"
 #include "update_engine/update_manager/system_provider.h"
 
+namespace chromeos_update_engine {
+class LibCrosProxy;
+}
+
 namespace chromeos_update_manager {
 
 // SystemProvider concrete implementation.
 class RealSystemProvider : public SystemProvider {
  public:
-  explicit RealSystemProvider(
-      chromeos_update_engine::HardwareInterface* hardware,
-      chromeos_update_engine::BootControlInterface* boot_control)
-      : hardware_(hardware), boot_control_(boot_control) {}
+  RealSystemProvider(chromeos_update_engine::HardwareInterface* hardware,
+                     chromeos_update_engine::BootControlInterface* boot_control,
+                     chromeos_update_engine::LibCrosProxy* libcros_proxy)
+      : hardware_(hardware),
+        boot_control_(boot_control),
+        libcros_proxy_(libcros_proxy) {}
 
   // Initializes the provider and returns whether it succeeded.
   bool Init();
@@ -53,14 +59,22 @@
     return var_num_slots_.get();
   }
 
+  Variable<std::string>* var_kiosk_required_platform_version() override {
+    return var_kiosk_required_platform_version_.get();
+  }
+
  private:
+  std::string GetKioskAppRequiredPlatformVersion();
+
   std::unique_ptr<Variable<bool>> var_is_normal_boot_mode_;
   std::unique_ptr<Variable<bool>> var_is_official_build_;
   std::unique_ptr<Variable<bool>> var_is_oobe_complete_;
   std::unique_ptr<Variable<unsigned int>> var_num_slots_;
+  std::unique_ptr<Variable<std::string>> var_kiosk_required_platform_version_;
 
-  chromeos_update_engine::HardwareInterface* hardware_;
-  chromeos_update_engine::BootControlInterface* boot_control_;
+  chromeos_update_engine::HardwareInterface* const hardware_;
+  chromeos_update_engine::BootControlInterface* const boot_control_;
+  chromeos_update_engine::LibCrosProxy* const libcros_proxy_;
 
   DISALLOW_COPY_AND_ASSIGN(RealSystemProvider);
 };
diff --git a/update_manager/real_system_provider_unittest.cc b/update_manager/real_system_provider_unittest.cc
index 5ee4137..a6ff2d9 100644
--- a/update_manager/real_system_provider_unittest.cc
+++ b/update_manager/real_system_provider_unittest.cc
@@ -19,33 +19,56 @@
 #include <memory>
 
 #include <base/time/time.h>
+#include <brillo/make_unique_ptr.h>
 #include <gtest/gtest.h>
 
+#include "libcros/dbus-proxies.h"
+#include "libcros/dbus-proxy-mocks.h"
 #include "update_engine/common/fake_boot_control.h"
 #include "update_engine/common/fake_hardware.h"
+#include "update_engine/libcros_proxy.h"
 #include "update_engine/update_manager/umtest_utils.h"
 
+using org::chromium::LibCrosServiceInterfaceProxyMock;
 using std::unique_ptr;
+using testing::_;
+using testing::DoAll;
+using testing::Return;
+using testing::SetArgPointee;
 
 namespace chromeos_update_manager {
 
 class UmRealSystemProviderTest : public ::testing::Test {
  protected:
   void SetUp() override {
-    provider_.reset(
-        new RealSystemProvider(&fake_hardware_, &fake_boot_control_));
+    service_interface_mock_ = new LibCrosServiceInterfaceProxyMock();
+    libcros_proxy_.reset(new chromeos_update_engine::LibCrosProxy(
+        brillo::make_unique_ptr(service_interface_mock_),
+        unique_ptr<
+            org::chromium::
+                UpdateEngineLibcrosProxyResolvedInterfaceProxyInterface>()));
+
+    provider_.reset(new RealSystemProvider(&fake_hardware_, &fake_boot_control_,
+                                           libcros_proxy_.get()));
     EXPECT_TRUE(provider_->Init());
   }
 
   chromeos_update_engine::FakeHardware fake_hardware_;
   chromeos_update_engine::FakeBootControl fake_boot_control_;
   unique_ptr<RealSystemProvider> provider_;
+
+  // Local pointers to the mocks. The instances are owned by the
+  // |libcros_proxy_|.
+  LibCrosServiceInterfaceProxyMock* service_interface_mock_;
+
+  unique_ptr<chromeos_update_engine::LibCrosProxy> libcros_proxy_;
 };
 
 TEST_F(UmRealSystemProviderTest, InitTest) {
   EXPECT_NE(nullptr, provider_->var_is_normal_boot_mode());
   EXPECT_NE(nullptr, provider_->var_is_official_build());
   EXPECT_NE(nullptr, provider_->var_is_oobe_complete());
+  EXPECT_NE(nullptr, provider_->var_kiosk_required_platform_version());
 }
 
 TEST_F(UmRealSystemProviderTest, IsOOBECompleteTrue) {
@@ -58,4 +81,25 @@
   UmTestUtils::ExpectVariableHasValue(false, provider_->var_is_oobe_complete());
 }
 
+TEST_F(UmRealSystemProviderTest, KioskRequiredPlatformVersion) {
+  const std::string kRequiredPlatformVersion("1234.0.0");
+  EXPECT_CALL(*service_interface_mock_,
+              GetKioskAppRequiredPlatformVersion(_, _, _))
+      .WillOnce(
+          DoAll(SetArgPointee<0>(kRequiredPlatformVersion), Return(true)));
+
+  UmTestUtils::ExpectVariableHasValue(
+      kRequiredPlatformVersion,
+      provider_->var_kiosk_required_platform_version());
+}
+
+TEST_F(UmRealSystemProviderTest, KioskRequiredPlatformVersionFailure) {
+  EXPECT_CALL(*service_interface_mock_,
+              GetKioskAppRequiredPlatformVersion(_, _, _))
+      .WillOnce(Return(false));
+
+  UmTestUtils::ExpectVariableHasValue(
+      std::string(), provider_->var_kiosk_required_platform_version());
+}
+
 }  // namespace chromeos_update_manager
diff --git a/update_manager/state_factory.cc b/update_manager/state_factory.cc
index d4f4aa4..e01f769 100644
--- a/update_manager/state_factory.cc
+++ b/update_manager/state_factory.cc
@@ -21,6 +21,7 @@
 #include <base/logging.h>
 
 #include "update_engine/common/clock_interface.h"
+#include "update_engine/libcros_proxy.h"
 #include "update_engine/update_manager/real_config_provider.h"
 #include "update_engine/update_manager/real_device_policy_provider.h"
 #include "update_engine/update_manager/real_random_provider.h"
@@ -38,6 +39,7 @@
     policy::PolicyProvider* policy_provider,
     chromeos_update_engine::ShillProxy* shill_proxy,
     org::chromium::SessionManagerInterfaceProxyInterface* session_manager_proxy,
+    chromeos_update_engine::LibCrosProxy* libcros_proxy,
     chromeos_update_engine::SystemState* system_state) {
   chromeos_update_engine::ClockInterface* const clock = system_state->clock();
   unique_ptr<RealConfigProvider> config_provider(
@@ -49,7 +51,8 @@
       new RealShillProvider(shill_proxy, clock));
   unique_ptr<RealSystemProvider> system_provider(
       new RealSystemProvider(system_state->hardware(),
-                             system_state->boot_control()));
+                             system_state->boot_control(),
+                             libcros_proxy));
   unique_ptr<RealTimeProvider> time_provider(new RealTimeProvider(clock));
   unique_ptr<RealUpdaterProvider> updater_provider(
       new RealUpdaterProvider(system_state));
diff --git a/update_manager/state_factory.h b/update_manager/state_factory.h
index f15fd83..726deeb 100644
--- a/update_manager/state_factory.h
+++ b/update_manager/state_factory.h
@@ -23,6 +23,10 @@
 #include "update_engine/system_state.h"
 #include "update_engine/update_manager/state.h"
 
+namespace chromeos_update_engine {
+class LibCrosProxy;
+}
+
 namespace chromeos_update_manager {
 
 // Creates and initializes a new UpdateManager State instance containing real
@@ -34,6 +38,7 @@
     policy::PolicyProvider* policy_provider,
     chromeos_update_engine::ShillProxy* shill_proxy,
     org::chromium::SessionManagerInterfaceProxyInterface* session_manager_proxy,
+    chromeos_update_engine::LibCrosProxy* libcros_proxy,
     chromeos_update_engine::SystemState* system_state);
 
 }  // namespace chromeos_update_manager
diff --git a/update_manager/system_provider.h b/update_manager/system_provider.h
index 00fb9af..13e188b 100644
--- a/update_manager/system_provider.h
+++ b/update_manager/system_provider.h
@@ -42,6 +42,10 @@
   // Returns a variable that tells the number of slots in the system.
   virtual Variable<unsigned int>* var_num_slots() = 0;
 
+  // Returns the required platform version of the configured auto launch
+  // with zero delay kiosk app if any.
+  virtual Variable<std::string>* var_kiosk_required_platform_version() = 0;
+
  protected:
   SystemProvider() {}