diff --git a/core/java/android/credentials/CredentialManager.java b/core/java/android/credentials/CredentialManager.java
index 00ce17adfda60..9140d02e223d6 100644
--- a/core/java/android/credentials/CredentialManager.java
+++ b/core/java/android/credentials/CredentialManager.java
@@ -460,9 +460,17 @@ public final class CredentialManager {
         return false;
     }
 
+    /**
+     * Returns whether the service is enabled.
+     *
+     * @hide
+     */
     private boolean isServiceEnabled() {
-        return DeviceConfig.getBoolean(
-                DeviceConfig.NAMESPACE_CREDENTIAL, DEVICE_CONFIG_ENABLE_CREDENTIAL_MANAGER, true);
+        try {
+            return mService.isServiceEnabled();
+        } catch (RemoteException e) {
+            return false;
+        }
     }
 
     /**
diff --git a/core/java/android/credentials/ICredentialManager.aidl b/core/java/android/credentials/ICredentialManager.aidl
index 5fde96b0b9ff0..b779c56035d31 100644
--- a/core/java/android/credentials/ICredentialManager.aidl
+++ b/core/java/android/credentials/ICredentialManager.aidl
@@ -58,5 +58,7 @@ interface ICredentialManager {
     List<CredentialProviderInfo> getCredentialProviderServices(in int userId, in int providerFilter);
 
     List<CredentialProviderInfo> getCredentialProviderServicesForTesting(in int providerFilter);
+
+    boolean isServiceEnabled();
 }
 
diff --git a/services/credentials/java/com/android/server/credentials/CredentialManagerService.java b/services/credentials/java/com/android/server/credentials/CredentialManagerService.java
index 531a6bdc0130f..92379d6deb8e8 100644
--- a/services/credentials/java/com/android/server/credentials/CredentialManagerService.java
+++ b/services/credentials/java/com/android/server/credentials/CredentialManagerService.java
@@ -825,6 +825,19 @@ public final class CredentialManagerService
                     mContext, userId, providerFilter, getEnabledProviders());
         }
 
+        @Override
+        public boolean isServiceEnabled() {
+            final long origId = Binder.clearCallingIdentity();
+            try {
+                return DeviceConfig.getBoolean(
+                        DeviceConfig.NAMESPACE_CREDENTIAL,
+                        CredentialManager.DEVICE_CONFIG_ENABLE_CREDENTIAL_MANAGER,
+                        false);
+            } finally {
+                Binder.restoreCallingIdentity(origId);
+            }
+        }
+
         @SuppressWarnings("GuardedBy") // ErrorProne requires service.mLock which is the same
         // this.mLock
         private Set<ComponentName> getEnabledProviders() {