diff --git a/packages/CtsShim/CtsShim.apk b/packages/CtsShim/CtsShim.apk
index 40f7dbdc235ea..7a27a438fcc64 100644
Binary files a/packages/CtsShim/CtsShim.apk and b/packages/CtsShim/CtsShim.apk differ
diff --git a/packages/CtsShim/CtsShimPriv.apk b/packages/CtsShim/CtsShimPriv.apk
index b5dcc600d7a9d..63e86883589b0 100644
Binary files a/packages/CtsShim/CtsShimPriv.apk and b/packages/CtsShim/CtsShimPriv.apk differ
diff --git a/packages/CtsShim/build/Android.mk b/packages/CtsShim/build/Android.mk
index bf6ae4151dae6..21f0afe573bec 100644
--- a/packages/CtsShim/build/Android.mk
+++ b/packages/CtsShim/build/Android.mk
@@ -62,6 +62,27 @@ LOCAL_FULL_MANIFEST_FILE := $(gen)
 
 include $(BUILD_PACKAGE)
 
+###########################################################
+# Variant: Privileged app upgrade w/ the wrong SHA
+
+include $(CLEAR_VARS)
+# this needs to be a privileged application
+LOCAL_PRIVILEGED_MODULE := true
+
+LOCAL_MODULE_TAGS := optional
+LOCAL_SDK_VERSION := current
+LOCAL_PROGUARD_ENABLED := disabled
+LOCAL_DEX_PREOPT := false
+# anything to make this package's SHA different from CtsShimPrivUpgrade
+LOCAL_AAPT_FLAGS := --version-name WrongSHA
+
+LOCAL_PACKAGE_NAME := CtsShimPrivUpgradeWrongSHA
+
+LOCAL_MANIFEST_FILE := shim_priv_upgrade/AndroidManifest.xml
+
+include $(BUILD_PACKAGE)
+
+
 ###########################################################
 # Variant: System app
 
diff --git a/packages/CtsShim/build/README b/packages/CtsShim/build/README
index 333b87c8cb9d9..9869377738b80 100644
--- a/packages/CtsShim/build/README
+++ b/packages/CtsShim/build/README
@@ -7,12 +7,14 @@ NOTE: The need to include a binary on the system image may be deprecated if a
 solution involving a temporarily writable /system partition is implemented.
 
 build:
-    $ tapas CtsShim CtsShimPriv CtsShimPrivUpgrade
+    $ tapas CtsShim CtsShimPriv CtsShimPrivUpgrade CtsShimPrivUpgradeWrongSHA
     $ m
 
 local testing:
     $ cp $OUT/system/priv-app/CtsShimPrivUpgrade/CtsShimPrivUpgrade.apk \
         cts/hostsidetests/appsecurity/test-apps/PrivilegedUpdateApp
+    $ cp $OUT/system/priv-app/CtsShimPrivUpgradeWrongSHA/CtsShimPrivUpgradeWrongSHA.apk \
+        cts/hostsidetests/appsecurity/test-apps/PrivilegedUpdateApp
     $ cp $OUT/system/priv-app/CtsShimPriv/CtsShimPriv.apk \
         frameworks/base/packages/CtsShim
     $ cp $OUT/system/app/CtsShim/CtsShim.apk \
diff --git a/packages/CtsShim/build/shim/AndroidManifest.xml b/packages/CtsShim/build/shim/AndroidManifest.xml
index 24e942b1ba64c..9b813ace8b800 100644
--- a/packages/CtsShim/build/shim/AndroidManifest.xml
+++ b/packages/CtsShim/build/shim/AndroidManifest.xml
@@ -22,6 +22,9 @@
     <uses-sdk android:minSdkVersion="24"
         android:targetSdkVersion="24" />
 
+    <restrict-update
+        android:hash="__CAN_NOT_BE_UPDATED__" />
+
     <application
         android:hasCode="false"
         tools:ignore="AllowBackup,MissingApplicationIcon" >
diff --git a/packages/CtsShim/build/shim_priv/AndroidManifest.xml b/packages/CtsShim/build/shim_priv/AndroidManifest.xml
index 7ba76cf026d65..5195ef79d93b6 100644
--- a/packages/CtsShim/build/shim_priv/AndroidManifest.xml
+++ b/packages/CtsShim/build/shim_priv/AndroidManifest.xml
@@ -22,7 +22,7 @@
     <uses-sdk android:minSdkVersion="24"
         android:targetSdkVersion="24" />
 
-    <restrict-upgrade
+    <restrict-update
         android:hash="__HASH__" />
 
     <application