diff --git a/core/product.mk b/core/product.mk
index 1541cff94..03098b7f2 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -145,6 +145,7 @@ _product_var_list := \
     PRODUCT_SYSTEM_HEADROOM \
     PRODUCT_MINIMIZE_JAVA_DEBUG_INFO \
     PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS \
+    PRODUCT_ADB_KEYS \
 
 
 
diff --git a/core/product_config.mk b/core/product_config.mk
index ff56c0ebe..387903636 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -462,3 +462,13 @@ PRODUCT_MINIMIZE_JAVA_DEBUG_INFO := \
 # Whether any paths are excluded from sanitization when SANITIZE_TARGET=integer_overflow
 PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS))
+
+# ADB keys for debuggable builds
+PRODUCT_ADB_KEYS :=
+ifneq ($(filter eng userdebug,$(TARGET_BUILD_VARIANT)),)
+  PRODUCT_ADB_KEYS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ADB_KEYS))
+endif
+ifneq ($(filter-out 0 1,$(words $(PRODUCT_ADB_KEYS))),)
+  $(error Only one file may be in PRODUCT_ADB_KEYS: $(PRODUCT_ADB_KEYS))
+endif
+.KATI_READONLY := PRODUCT_ADB_KEYS
diff --git a/target/product/embedded.mk b/target/product/embedded.mk
index 3466d1a86..4e1adc824 100644
--- a/target/product/embedded.mk
+++ b/target/product/embedded.mk
@@ -98,6 +98,11 @@ PRODUCT_PACKAGES += \
     fs_config_files \
     fs_config_dirs
 
+# If there are product-specific adb keys defined, install them on debuggable
+# builds.
+PRODUCT_PACKAGES_DEBUG += \
+    adb_keys
+
 # Ensure that this property is always defined so that bionic_systrace.cpp
 # can rely on it being initially set by init.
 PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
diff --git a/target/product/full_base.mk b/target/product/full_base.mk
index f2652ebf7..7aac435cc 100644
--- a/target/product/full_base.mk
+++ b/target/product/full_base.mk
@@ -53,3 +53,6 @@ $(call inherit-product, $(SRC_TARGET_DIR)/product/locales_full.mk)
 
 # Get everything else from the parent package
 $(call inherit-product, $(SRC_TARGET_DIR)/product/generic_no_telephony.mk)
+
+# Add adb keys to debuggable AOSP builds (if they exist)
+$(call inherit-product-if-exists, vendor/google/security/adb/vendor_key.mk)
diff --git a/target/product/security/Android.mk b/target/product/security/Android.mk
index 5a40397ab..4142ea914 100644
--- a/target/product/security/Android.mk
+++ b/target/product/security/Android.mk
@@ -10,3 +10,16 @@ LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
 
 include $(BUILD_PREBUILT)
+
+#######################################
+# adb key, if configured via PRODUCT_ADB_KEYS
+ifdef PRODUCT_ADB_KEYS
+  ifneq ($(filter eng userdebug,$(TARGET_BUILD_VARIANT)),)
+    include $(CLEAR_VARS)
+    LOCAL_MODULE := adb_keys
+    LOCAL_MODULE_CLASS := ETC
+    LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
+    LOCAL_PREBUILT_MODULE_FILE := $(PRODUCT_ADB_KEYS)
+    include $(BUILD_PREBUILT)
+  endif
+endif