diff --git a/packages/CtsShim/Android.mk b/packages/CtsShim/Android.mk
index cd5b288617d8c..fa6423ecb8c7f 100644
--- a/packages/CtsShim/Android.mk
+++ b/packages/CtsShim/Android.mk
@@ -53,3 +53,4 @@ LOCAL_SRC_FILES := CtsShim.apk
 
 include $(BUILD_PREBUILT)
 
+include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/packages/CtsShim/build/Android.mk b/packages/CtsShim/build/Android.mk
index b550c1c253f3f..bf6ae4151dae6 100644
--- a/packages/CtsShim/build/Android.mk
+++ b/packages/CtsShim/build/Android.mk
@@ -16,25 +16,6 @@
 
 LOCAL_PATH := $(my-dir)
 
-###########################################################
-# Variant: Privileged app
-
-include $(CLEAR_VARS)
-# this needs to be a privileged application
-LOCAL_PRIVILEGED_MODULE := true
-
-LOCAL_MODULE_TAGS := optional
-LOCAL_SDK_VERSION := current
-LOCAL_PROGUARD_ENABLED := disabled
-LOCAL_DEX_PREOPT := false
-
-LOCAL_PACKAGE_NAME := CtsShimPriv
-
-LOCAL_MANIFEST_FILE := shim_priv/AndroidManifest.xml
-
-include $(BUILD_PACKAGE)
-
-
 ###########################################################
 # Variant: Privileged app upgrade
 
@@ -52,7 +33,34 @@ LOCAL_PACKAGE_NAME := CtsShimPrivUpgrade
 LOCAL_MANIFEST_FILE := shim_priv_upgrade/AndroidManifest.xml
 
 include $(BUILD_PACKAGE)
+my_shim_priv_upgrade_apk := $(LOCAL_BUILT_MODULE)
 
+###########################################################
+# Variant: Privileged app
+
+include $(CLEAR_VARS)
+# this needs to be a privileged application
+LOCAL_PRIVILEGED_MODULE := true
+
+LOCAL_MODULE_TAGS := optional
+LOCAL_SDK_VERSION := current
+LOCAL_PROGUARD_ENABLED := disabled
+LOCAL_DEX_PREOPT := false
+
+LOCAL_PACKAGE_NAME := CtsShimPriv
+
+# Generate the upgrade key by taking the hash of the built CtsShimPrivUpgrade apk
+gen := $(call intermediates-dir-for,APPS,$(LOCAL_PACKAGE_NAME),,true)/AndroidManifest.xml
+$(gen): PRIVATE_CUSTOM_TOOL = sed -e "s/__HASH__/`sha512sum $(PRIVATE_INPUT_APK) | cut -d' ' -f1`/" $< >$@
+$(gen): PRIVATE_INPUT_APK := $(my_shim_priv_upgrade_apk)
+$(gen): $(LOCAL_PATH)/shim_priv/AndroidManifest.xml $(my_shim_priv_upgrade_apk)
+	$(transform-generated-source)
+
+my_shim_priv_upgrade_apk :=
+
+LOCAL_FULL_MANIFEST_FILE := $(gen)
+
+include $(BUILD_PACKAGE)
 
 ###########################################################
 # Variant: System app
diff --git a/packages/CtsShim/build/README b/packages/CtsShim/build/README
index 1f154e1d70b08..333b87c8cb9d9 100644
--- a/packages/CtsShim/build/README
+++ b/packages/CtsShim/build/README
@@ -6,31 +6,18 @@ must specify the singular APK that can be used to upgrade it.
 NOTE: The need to include a binary on the system image may be deprecated if a
 solution involving a temporarily writable /system partition is implemented.
 
-MAKING THE PREBUILTS
-In order to generate the upgrade key, the shim directory needs to be built multiple
-times. First to generate the upgrade APK [so its hash can be obtained] and again
-once the hash has been included as part of the pre-installed APK.
-
 build:
-    $ mmm frameworks/base/packages/CtsShim/build
+    $ tapas CtsShim CtsShimPriv CtsShimPrivUpgrade
+    $ m
 
-update the manifest:
-    $ sed -i -e "s/__HASH__/`sha512sum out/target/product/shamu/system/priv-app/CtsShimPrivUpgrade/CtsShimPrivUpgrade.apk | cut -d' ' -f1`/" \
-        frameworks/base/packages/CtsShim/build/shim_priv/AndroidManifest.xml
-
-build:
-    $ mmm frameworks/base/packages/CtsShim/build
-
-update prebuilts:
-    $ cp out/target/product/shamu/system/priv-app/CtsShimPrivUpgrade/CtsShimPrivUpgrade.apk \
+local testing:
+    $ cp $OUT/system/priv-app/CtsShimPrivUpgrade/CtsShimPrivUpgrade.apk \
         cts/hostsidetests/appsecurity/test-apps/PrivilegedUpdateApp
-    $ cp out/target/product/shamu/system/priv-app/CtsShimPriv/CtsShimPriv.apk \
+    $ cp $OUT/system/priv-app/CtsShimPriv/CtsShimPriv.apk \
         frameworks/base/packages/CtsShim
-    $ cp out/target/product/shamu/system/app/CtsShim/CtsShim.apk \
+    $ cp $OUT/system/app/CtsShim/CtsShim.apk \
         frameworks/base/packages/CtsShim
 
-revert manifest:
-    $ pushd frameworks/base && git checkout -- packages/CtsShim/build/shim_priv/AndroidManifest.xml && popd
-
-Finally, upload and submit both the cts/ and frameworks/base/ repos.
+For final submission, the APKs should be downloaded from the build server, then
+submitted to the cts/ and frameworks/base/ repos.