diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 4937662b91d4c..58783ad8976ed 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -15468,6 +15468,14 @@ public class PackageManagerService extends IPackageManager.Stub {
             Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER);
         }
 
+        // Ephemeral apps must have target SDK >= O.
+        // TODO: Update conditional and error message when O gets locked down
+        if (ephemeral && pkg.applicationInfo.targetSdkVersion <= Build.VERSION_CODES.N_MR1) {
+            res.setError(PackageManager.INSTALL_FAILED_EPHEMERAL_INVALID,
+                    "Ephemeral apps must have target SDK version of at least O");
+            return;
+        }
+
         // If we are installing a clustered package add results for the children
         if (pkg.childPackages != null) {
             synchronized (mPackages) {