diff --git a/core/board_config.mk b/core/board_config.mk
index 93e07a069..ed741c35b 100644
--- a/core/board_config.mk
+++ b/core/board_config.mk
@@ -19,6 +19,80 @@
 # and sanity-checks the variable defined therein.
 # ###############################################################
 
+_board_strip_readonly_list := \
+  BOARD_EGL_CFG \
+  BOARD_HAVE_BLUETOOTH \
+  BOARD_INSTALLER_CMDLINE \
+  BOARD_KERNEL_CMDLINE \
+  BOARD_KERNEL_BASE \
+  BOARD_USES_GENERIC_AUDIO \
+  BOARD_VENDOR_USE_AKMD \
+  BOARD_WPA_SUPPLICANT_DRIVER \
+  BOARD_WLAN_DEVICE \
+  TARGET_ARCH \
+  TARGET_ARCH_VARIANT \
+  TARGET_CPU_ABI \
+  TARGET_CPU_ABI2 \
+  TARGET_CPU_VARIANT \
+  TARGET_CPU_VARIANT_RUNTIME \
+  TARGET_2ND_ARCH \
+  TARGET_2ND_ARCH_VARIANT \
+  TARGET_2ND_CPU_ABI \
+  TARGET_2ND_CPU_ABI2 \
+  TARGET_2ND_CPU_VARIANT \
+  TARGET_2ND_CPU_VARIANT_RUNTIME \
+  TARGET_BOARD_PLATFORM \
+  TARGET_BOARD_PLATFORM_GPU \
+  TARGET_BOOTLOADER_BOARD_NAME \
+  TARGET_NO_BOOTLOADER \
+  TARGET_NO_KERNEL \
+  TARGET_NO_RECOVERY \
+  TARGET_NO_RADIOIMAGE \
+  TARGET_HARDWARE_3D \
+  WITH_DEXPREOPT \
+
+# File system variables
+_board_strip_readonly_list += \
+  BOARD_FLASH_BLOCK_SIZE \
+  BOARD_BOOTIMAGE_PARTITION_SIZE \
+  BOARD_RECOVERYIMAGE_PARTITION_SIZE \
+  BOARD_SYSTEMIMAGE_PARTITION_SIZE \
+  BOARD_SYSTEMIMAGE_FILE_SYSTEM_TYPE \
+  BOARD_USERDATAIMAGE_FILE_SYSTEM_TYPE \
+  BOARD_USERDATAIMAGE_PARTITION_SIZE \
+  BOARD_CACHEIMAGE_FILE_SYSTEM_TYPE \
+  BOARD_CACHEIMAGE_PARTITION_SIZE \
+  BOARD_VENDORIMAGE_PARTITION_SIZE \
+  BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE \
+  BOARD_PRODUCTIMAGE_PARTITION_SIZE \
+  BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE \
+  BOARD_PRODUCT_SERVICESIMAGE_PARTITION_SIZE \
+  BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE \
+  BOARD_ODMIMAGE_PARTITION_SIZE \
+  BOARD_ODMIMAGE_FILE_SYSTEM_TYPE \
+
+# Logical partitions related variables.
+_dynamic_partitions_var_list += \
+  BOARD_SYSTEMIMAGE_PARTITION_RESERVED_SIZE \
+  BOARD_VENDORIMAGE_PARTITION_RESERVED_SIZE \
+  BOARD_ODMIMAGE_PARTITION_RESERVED_SIZE \
+  BOARD_PRODUCTIMAGE_PARTITION_RESERVED_SIZE \
+  BOARD_PRODUCT_SERVICESIMAGE_PARTITION_RESERVED_SIZE \
+  BOARD_SUPER_PARTITION_SIZE \
+  BOARD_SUPER_PARTITION_GROUPS \
+
+_board_strip_readonly_list += $(_dynamic_partitions_var_list)
+
+_build_broken_var_list := \
+  BUILD_BROKEN_ANDROIDMK_EXPORTS \
+  BUILD_BROKEN_DUP_COPY_HEADERS \
+  BUILD_BROKEN_DUP_RULES \
+  BUILD_BROKEN_PHONY_TARGETS \
+  BUILD_BROKEN_ENG_DEBUG_TAGS \
+
+_board_true_false_vars := $(_build_broken_var_list)
+_board_strip_readonly_list += $(_build_broken_var_list)
+
 # Conditional to building on linux, as dex2oat currently does not work on darwin.
 ifeq ($(HOST_OS),linux)
   WITH_DEXPREOPT := true
@@ -68,27 +142,16 @@ ifneq ($(MALLOC_IMPL),)
 endif
 board_config_mk :=
 
-# Clean up/verify variables defined by the board config file.
-TARGET_BOOTLOADER_BOARD_NAME := $(strip $(TARGET_BOOTLOADER_BOARD_NAME))
-TARGET_CPU_ABI := $(strip $(TARGET_CPU_ABI))
-TARGET_CPU_ABI2 := $(strip $(TARGET_CPU_ABI2))
-TARGET_CPU_VARIANT := $(strip $(TARGET_CPU_VARIANT))
-TARGET_CPU_VARIANT_RUNTIME := $(strip $(TARGET_CPU_VARIANT_RUNTIME))
-
-TARGET_2ND_CPU_ABI := $(strip $(TARGET_2ND_CPU_ABI))
-TARGET_2ND_CPU_ABI2 := $(strip $(TARGET_2ND_CPU_ABI2))
-TARGET_2ND_CPU_VARIANT := $(strip $(TARGET_2ND_CPU_VARIANT))
-TARGET_2ND_CPU_VARIANT_RUNTIME := $(strip $(TARGET_2ND_CPU_VARIANT_RUNTIME))
+# Clean up and verify BoardConfig variables
+$(foreach var,$(_board_strip_readonly_list),$(eval $(var) := $$(strip $$($(var)))))
+$(foreach var,$(_board_true_false_vars), \
+  $(if $(filter-out true false,$($(var))), \
+    $(error Valid values of $(var) are "true", "false", and "". Not "$($(var))")))
 
 # Default *_CPU_VARIANT_RUNTIME to CPU_VARIANT if unspecified.
 TARGET_CPU_VARIANT_RUNTIME := $(or $(TARGET_CPU_VARIANT_RUNTIME),$(TARGET_CPU_VARIANT))
 TARGET_2ND_CPU_VARIANT_RUNTIME := $(or $(TARGET_2ND_CPU_VARIANT_RUNTIME),$(TARGET_2ND_CPU_VARIANT))
 
-BOARD_KERNEL_BASE := $(strip $(BOARD_KERNEL_BASE))
-BOARD_KERNEL_PAGESIZE := $(strip $(BOARD_KERNEL_PAGESIZE))
-
-INTERNAL_KERNEL_CMDLINE := $(strip $(BOARD_KERNEL_CMDLINE))
-
 # The combo makefiles sanity-check and set defaults for various CPU configuration
 combo_target := TARGET_
 combo_2nd_arch_prefix :=
@@ -99,6 +162,9 @@ ifdef TARGET_2ND_ARCH
   include $(BUILD_SYSTEM)/combo/select.mk
 endif
 
+.KATI_READONLY := $(_board_strip_readonly_list)
+
+INTERNAL_KERNEL_CMDLINE := $(BOARD_KERNEL_CMDLINE)
 ifeq ($(TARGET_CPU_ABI),)
   $(error No TARGET_CPU_ABI defined by board config: $(board_config_mk))
 endif
@@ -162,23 +228,6 @@ TARGET_CPU_ABI_LIST := $(subst $(space),$(comma),$(strip $(TARGET_CPU_ABI_LIST))
 TARGET_CPU_ABI_LIST_32_BIT := $(subst $(space),$(comma),$(strip $(TARGET_CPU_ABI_LIST_32_BIT)))
 TARGET_CPU_ABI_LIST_64_BIT := $(subst $(space),$(comma),$(strip $(TARGET_CPU_ABI_LIST_64_BIT)))
 
-###########################################
-# Handle BUILD_BROKEN_* settings
-vars := \
-  BUILD_BROKEN_ANDROIDMK_EXPORTS \
-  BUILD_BROKEN_DUP_COPY_HEADERS \
-  BUILD_BROKEN_DUP_RULES \
-  BUILD_BROKEN_PHONY_TARGETS \
-  BUILD_BROKEN_ENG_DEBUG_TAGS
-
-$(foreach var,$(vars),$(eval $(var) := $$(strip $$($(var)))))
-
-$(foreach var,$(vars), \
-  $(if $(filter-out true false,$($(var))), \
-    $(error Valid values of $(var) are "true", "false", and "". Not "$($(var))")))
-
-.KATI_READONLY := $(vars)
-
 ifneq ($(BUILD_BROKEN_ANDROIDMK_EXPORTS),true)
 $(KATI_obsolete_export It is a global setting. See $(CHANGES_URL)#export_keyword)
 endif
diff --git a/core/config.mk b/core/config.mk
index 0f3c12688..242558e9f 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -287,6 +287,7 @@ $(call validate-kernel-headers,$(TARGET_BOARD_KERNEL_HEADERS))
 TARGET_PRODUCT_KERNEL_HEADERS := $(strip $(wildcard $(PRODUCT_VENDOR_KERNEL_HEADERS)))
 TARGET_PRODUCT_KERNEL_HEADERS := $(patsubst %/,%,$(TARGET_PRODUCT_KERNEL_HEADERS))
 $(call validate-kernel-headers,$(TARGET_PRODUCT_KERNEL_HEADERS))
+.KATI_READONLY := TARGET_DEVICE_KERNEL_HEADERS TARGET_BOARD_KERNEL_HEADERS TARGET_PRODUCT_KERNEL_HEADERS
 
 # Commands to generate .toc file common to ELF .so files.
 define _gen_toc_command_for_elf
@@ -765,6 +766,7 @@ ifdef PRODUCT_DEFAULT_DEV_CERTIFICATE
 else
   DEFAULT_SYSTEM_DEV_CERTIFICATE := build/target/product/security/testkey
 endif
+.KATI_READONLY := DEFAULT_SYSTEM_DEV_CERTIFICATE
 
 BUILD_NUMBER_FROM_FILE := $$(cat $(OUT_DIR)/build_number.txt)
 BUILD_DATETIME_FROM_FILE := $$(cat $(BUILD_DATETIME_FILE))
diff --git a/core/product.mk b/core/product.mk
index efe029bc1..fba2ed329 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -366,80 +366,10 @@ define resolve-short-product-name
 $(strip $(call _resolve-short-product-name,$(1)))
 endef
 
-
-_product_stash_var_list := $(_product_var_list) \
-  PRODUCT_BOOTCLASSPATH \
-  PRODUCT_SYSTEM_SERVER_CLASSPATH \
-  TARGET_ARCH \
-  TARGET_ARCH_VARIANT \
-  TARGET_CPU_ABI \
-  TARGET_CPU_ABI2 \
-  TARGET_CPU_VARIANT \
-  TARGET_CPU_VARIANT_RUNTIME \
-  TARGET_2ND_ARCH \
-  TARGET_2ND_ARCH_VARIANT \
-  TARGET_2ND_CPU_ABI \
-  TARGET_2ND_CPU_ABI2 \
-  TARGET_2ND_CPU_VARIANT \
-  TARGET_2ND_CPU_VARIANT_RUNTIME \
-  TARGET_BOARD_PLATFORM \
-  TARGET_BOARD_PLATFORM_GPU \
-  TARGET_BOARD_KERNEL_HEADERS \
-  TARGET_DEVICE_KERNEL_HEADERS \
-  TARGET_PRODUCT_KERNEL_HEADERS \
-  TARGET_BOOTLOADER_BOARD_NAME \
-  TARGET_NO_BOOTLOADER \
-  TARGET_NO_KERNEL \
-  TARGET_NO_RECOVERY \
-  TARGET_NO_RADIOIMAGE \
-  TARGET_HARDWARE_3D \
-
-_product_stash_var_list += \
-  BOARD_WPA_SUPPLICANT_DRIVER \
-  BOARD_WLAN_DEVICE \
-  BOARD_USES_GENERIC_AUDIO \
-  BOARD_KERNEL_CMDLINE \
-  BOARD_KERNEL_BASE \
-  BOARD_HAVE_BLUETOOTH \
-  BOARD_VENDOR_USE_AKMD \
-  BOARD_EGL_CFG \
-  BOARD_BOOTIMAGE_PARTITION_SIZE \
-  BOARD_RECOVERYIMAGE_PARTITION_SIZE \
-  BOARD_SYSTEMIMAGE_PARTITION_SIZE \
-  BOARD_SYSTEMIMAGE_FILE_SYSTEM_TYPE \
-  BOARD_USERDATAIMAGE_FILE_SYSTEM_TYPE \
-  BOARD_USERDATAIMAGE_PARTITION_SIZE \
-  BOARD_CACHEIMAGE_FILE_SYSTEM_TYPE \
-  BOARD_CACHEIMAGE_PARTITION_SIZE \
-  BOARD_FLASH_BLOCK_SIZE \
-  BOARD_VENDORIMAGE_PARTITION_SIZE \
-  BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE \
-  BOARD_PRODUCTIMAGE_PARTITION_SIZE \
-  BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE \
-  BOARD_PRODUCT_SERVICESIMAGE_PARTITION_SIZE \
-  BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE \
-  BOARD_ODMIMAGE_PARTITION_SIZE \
-  BOARD_ODMIMAGE_FILE_SYSTEM_TYPE \
-  BOARD_INSTALLER_CMDLINE \
-
-
-_product_stash_var_list += \
-  DEFAULT_SYSTEM_DEV_CERTIFICATE \
-  WITH_DEXPREOPT \
-  WITH_DEXPREOPT_BOOT_IMG_AND_SYSTEM_SERVER_ONLY
-
-# Logical partitions related variables.
-_dynamic_partitions_var_list += \
-  BOARD_SYSTEMIMAGE_PARTITION_RESERVED_SIZE \
-  BOARD_VENDORIMAGE_PARTITION_RESERVED_SIZE \
-  BOARD_ODMIMAGE_PARTITION_RESERVED_SIZE \
-  BOARD_PRODUCTIMAGE_PARTITION_RESERVED_SIZE \
-  BOARD_PRODUCT_SERVICESIMAGE_PARTITION_RESERVED_SIZE \
-  BOARD_SUPER_PARTITION_SIZE \
-  BOARD_SUPER_PARTITION_GROUPS \
-
-_product_stash_var_list += $(_dynamic_partitions_var_list)
-_product_strip_var_list := $(_dynamic_partitions_var_list)
+_product_stash_var_list := $(_product_var_list)
+# TODO: Move this to board_config.mk when no longer set in product makefiles
+_product_stash_var_list += WITH_DEXPREOPT_BOOT_IMG_AND_SYSTEM_SERVER_ONLY
+_product_strip_var_list :=
 
 #
 # Mark the variables in _product_stash_var_list as readonly