diff --git a/core/Makefile b/core/Makefile
index bf4478888..589f6ac53 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -677,6 +677,16 @@ $(hide) echo '' >> $5
 
 endef
 
+# -----------------------------------------------------------------
+# Merge an individual apkcerts output into the final apkcerts.txt output.
+# Use a macro to make it compatible with _apkcerts_write_line
+# $1 apkcerts file to be merged
+# $2 output file
+define _apkcerts_merge
+$(hide) cat $1 >> $2
+
+endef
+
 name := $(TARGET_PRODUCT)
 ifeq ($(TARGET_BUILD_TYPE),debug)
   name := $(name)_debug
@@ -685,6 +695,8 @@ name := $(name)-apkcerts-$(FILE_NAME_TAG)
 intermediates := \
 	$(call intermediates-dir-for,PACKAGING,apkcerts)
 APKCERTS_FILE := $(intermediates)/$(name).txt
+all_apkcerts_files := $(sort $(foreach p,$(PACKAGES),$(PACKAGES.$(p).APKCERTS_FILE)))
+$(APKCERTS_FILE): $(all_apkcerts_files)
 # We don't need to really build all the modules.
 # TODO: rebuild APKCERTS_FILE if any app change its cert.
 $(APKCERTS_FILE):
@@ -692,9 +704,11 @@ $(APKCERTS_FILE):
 	@mkdir -p $(dir $@)
 	@rm -f $@
 	$(foreach p,$(PACKAGES),\
-	  $(if $(PACKAGES.$(p).EXTERNAL_KEY),\
-	    $(call _apkcerts_write_line,$(p),"EXTERNAL","",$(PACKAGES.$(p).COMPRESSED),$@),\
-	    $(call _apkcerts_write_line,$(p),$(PACKAGES.$(p).CERTIFICATE),$(PACKAGES.$(p).PRIVATE_KEY),$(PACKAGES.$(p).COMPRESSED),$@)))
+	  $(if $(PACKAGES.$(p).APKCERTS_FILE),\
+	    $(call _apkcerts_merge,$(PACKAGES.$(p).APKCERTS_FILE), $@),\
+	    $(if $(PACKAGES.$(p).EXTERNAL_KEY),\
+	      $(call _apkcerts_write_line,$(p),"EXTERNAL","",$(PACKAGES.$(p).COMPRESSED),$@),\
+	      $(call _apkcerts_write_line,$(p),$(PACKAGES.$(p).CERTIFICATE),$(PACKAGES.$(p).PRIVATE_KEY),$(PACKAGES.$(p).COMPRESSED),$@))))
 	# In case value of PACKAGES is empty.
 	$(hide) touch $@
 
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index a60ca380c..d3afc65b9 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -22,6 +22,7 @@ LOCAL_APIDIFF_NEWAPI:=
 LOCAL_APIDIFF_OLDAPI:=
 LOCAL_APK_LIBRARIES:=
 LOCAL_APK_SET_MASTER_FILE:=
+LOCAL_APKCERTS_FILE:=
 LOCAL_ARM_MODE:=
 LOCAL_ASFLAGS:=
 LOCAL_ASSET_DIR:=
diff --git a/core/soong_android_app_set.mk b/core/soong_android_app_set.mk
index e0a863256..c783b42d7 100644
--- a/core/soong_android_app_set.mk
+++ b/core/soong_android_app_set.mk
@@ -29,17 +29,9 @@ LOCAL_POST_INSTALL_CMD := unzip -qo -j -d $(dir $(LOCAL_INSTALLED_MODULE)) \
 $(LOCAL_INSTALLED_MODULE): PRIVATE_POST_INSTALL_CMD := $(LOCAL_POST_INSTALL_CMD)
 PACKAGES.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_PACKAGES))
 
-# android_app_set modules are always presigned
-PACKAGES.$(LOCAL_MODULE).CERTIFICATE := PRESIGNED
 PACKAGES := $(PACKAGES) $(LOCAL_MODULE)
-
-ifneq ($(LOCAL_MODULE_STEM),)
-  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE_STEM)
-else
-  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE)
-endif
-
-# Set a actual_partition_tag (calculated in base_rules.mk) for the package.
-PACKAGES.$(LOCAL_MODULE).PARTITION := $(actual_partition_tag)
+# We can't know exactly what apk files would be outputted yet.
+# Let extract_apks generate apkcerts.txt and merge it later.
+PACKAGES.$(LOCAL_MODULE).APKCERTS_FILE := $(LOCAL_APKCERTS_FILE)
 
 SOONG_ALREADY_CONV += $(LOCAL_MODULE)