diff --git a/core/java/android/provider/MediaStore.java b/core/java/android/provider/MediaStore.java
index aa774a6f0e865..23937d6c85a6e 100644
--- a/core/java/android/provider/MediaStore.java
+++ b/core/java/android/provider/MediaStore.java
@@ -3304,6 +3304,14 @@ public final class MediaStore {
     @TestApi
     public static @NonNull File getVolumePath(@NonNull String volumeName)
             throws FileNotFoundException {
+        final StorageManager sm = AppGlobals.getInitialApplication()
+                .getSystemService(StorageManager.class);
+        return getVolumePath(sm.getVolumes(), volumeName);
+    }
+
+    /** {@hide} */
+    public static @NonNull File getVolumePath(@NonNull List<VolumeInfo> volumes,
+            @NonNull String volumeName) throws FileNotFoundException {
         if (TextUtils.isEmpty(volumeName)) {
             throw new IllegalArgumentException();
         }
@@ -3312,19 +3320,18 @@ public final class MediaStore {
             case VOLUME_INTERNAL:
             case VOLUME_EXTERNAL:
                 throw new FileNotFoundException(volumeName + " has no associated path");
-            case VOLUME_EXTERNAL_PRIMARY:
-                return Environment.getExternalStorageDirectory();
         }
 
-        final StorageManager sm = AppGlobals.getInitialApplication()
-                .getSystemService(StorageManager.class);
-        for (VolumeInfo vi : sm.getVolumes()) {
-            if (Objects.equals(vi.getNormalizedFsUuid(), volumeName)) {
-                final File path = vi.getPathForUser(UserHandle.myUserId());
+        final boolean wantPrimary = VOLUME_EXTERNAL_PRIMARY.equals(volumeName);
+        for (VolumeInfo volume : volumes) {
+            final boolean matchPrimary = wantPrimary
+                    && volume.isPrimary();
+            final boolean matchSecondary = !wantPrimary
+                    && Objects.equals(volume.getNormalizedFsUuid(), volumeName);
+            if (matchPrimary || matchSecondary) {
+                final File path = volume.getPathForUser(UserHandle.myUserId());
                 if (path != null) {
                     return path;
-                } else {
-                    throw new FileNotFoundException("Failed to find path for " + vi);
                 }
             }
         }
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index b634bb2a6e9ee..142e2a4e7a5d9 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -4434,7 +4434,7 @@
     <!-- Allows an application to watch changes and/or active state of app ops.
          @hide <p>Not for use by third-party applications. -->
     <permission android:name="android.permission.WATCH_APPOPS"
-        android:protectionLevel="signature" />
+        android:protectionLevel="signature|privileged" />
 
     <!-- Allows an application to directly open the "Open by default" page inside a package's
          Details screen.
diff --git a/data/etc/privapp-permissions-platform.xml b/data/etc/privapp-permissions-platform.xml
index b96c59ab83a7f..e524216d5c550 100644
--- a/data/etc/privapp-permissions-platform.xml
+++ b/data/etc/privapp-permissions-platform.xml
@@ -195,6 +195,7 @@ applications that come with the platform
         <permission name="android.permission.MANAGE_USERS"/>
         <permission name="android.permission.USE_RESERVED_DISK"/>
         <permission name="android.permission.WRITE_MEDIA_STORAGE"/>
+        <permission name="android.permission.WATCH_APPOPS"/>
     </privapp-permissions>
 
     <privapp-permissions package="com.android.providers.telephony">
diff --git a/packages/Shell/AndroidManifest.xml b/packages/Shell/AndroidManifest.xml
index 16fce89e0c132..0fa415522f6b9 100644
--- a/packages/Shell/AndroidManifest.xml
+++ b/packages/Shell/AndroidManifest.xml
@@ -170,7 +170,6 @@
     <!-- Permission needed to enable/disable Bluetooth/Wifi -->
     <uses-permission android:name="android.permission.MANAGE_BLUETOOTH_WHEN_WIRELESS_CONSENT_REQUIRED" />
     <uses-permission android:name="android.permission.MANAGE_WIFI_WHEN_WIRELESS_CONSENT_REQUIRED" />
-    <uses-permission android:name="android.permission.WATCH_APPOPS" />
     <!-- Permission needed to invoke DynamicSystem (AOT) -->
     <uses-permission android:name="android.permission.INSTALL_DYNAMIC_SYSTEM" />
 
diff --git a/packages/SystemUI/AndroidManifest.xml b/packages/SystemUI/AndroidManifest.xml
index 4b4912cb1e8a5..7db8969e2e042 100644
--- a/packages/SystemUI/AndroidManifest.xml
+++ b/packages/SystemUI/AndroidManifest.xml
@@ -222,9 +222,6 @@
     <!-- to change themes - light or dark -->
     <uses-permission android:name="android.permission.CHANGE_OVERLAY_PACKAGES" />
 
-    <!-- Listen app op changes -->
-    <uses-permission android:name="android.permission.WATCH_APPOPS" />
-
     <!-- to read and change hvac values in a car -->
     <uses-permission android:name="android.car.permission.CONTROL_CAR_CLIMATE" />