diff --git a/core/java/android/content/pm/SigningDetails.java b/core/java/android/content/pm/SigningDetails.java
index 1e659b74db77b..af2649f3e4dfc 100644
--- a/core/java/android/content/pm/SigningDetails.java
+++ b/core/java/android/content/pm/SigningDetails.java
@@ -867,10 +867,12 @@ public final class SigningDetails implements Parcelable {
             return false;
         }
         // The capabilities for the past signing certs must match as well.
-        for (int i = 0; i < mPastSigningCertificates.length; i++) {
-            if (mPastSigningCertificates[i].getFlags()
-                    != that.mPastSigningCertificates[i].getFlags()) {
-                return false;
+        if (mPastSigningCertificates != null) {
+            for (int i = 0; i < mPastSigningCertificates.length; i++) {
+                if (mPastSigningCertificates[i].getFlags()
+                        != that.mPastSigningCertificates[i].getFlags()) {
+                    return false;
+                }
             }
         }
         return true;
diff --git a/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt b/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
index d39c8a0a11020..aa86cd6323b90 100644
--- a/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
+++ b/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
@@ -390,7 +390,14 @@ class AppIdPermissionPolicy : SchemePolicy() {
         packageState: PackageState,
         changedPermissionNames: MutableIndexedSet<String>
     ) {
-        packageState.androidPackage!!.permissions.forEachIndexed { _, parsedPermission ->
+        val androidPackage = packageState.androidPackage!!
+        // This may not be the same package as the old permission because the old permission owner
+        // can be different, hence using this somewhat strange name to prevent misuse.
+        val oldNewPackage = oldState.externalState.packageStates[packageState.packageName]
+            ?.androidPackage
+        val isPackageSigningChanged = oldNewPackage != null &&
+                androidPackage.signingDetails != oldNewPackage.signingDetails
+        androidPackage.permissions.forEachIndexed { _, parsedPermission ->
             val newPermissionInfo = PackageInfoUtils.generatePermissionInfo(
                 parsedPermission, PackageManager.GET_META_DATA.toLong()
             )!!
@@ -520,7 +527,7 @@ class AppIdPermissionPolicy : SchemePolicy() {
                     newPackageName != oldPermission.packageName ||
                     newPermission.protectionLevel != oldPermission.protectionLevel || (
                         oldPermission.isReconciled && (
-                            (
+                            (newPermission.isSignature && isPackageSigningChanged) || (
                                 newPermission.isKnownSigner &&
                                     newPermission.knownCerts != oldPermission.knownCerts
                             ) || (