diff --git a/data/etc/Android.bp b/data/etc/Android.bp
index 6a1f3f9..ade20d2 100644
--- a/data/etc/Android.bp
+++ b/data/etc/Android.bp
@@ -60,6 +60,12 @@
     src: "preinstalled-packages-asl-files.xml",
 }
 
+prebuilt_etc {
+    name: "preinstalled-packages-strict-signature.xml",
+    sub_dir: "sysconfig",
+    src: "preinstalled-packages-strict-signature.xml",
+}
+
 // Privapp permission whitelist files
 
 prebuilt_etc {
diff --git a/data/etc/preinstalled-packages-strict-signature.xml b/data/etc/preinstalled-packages-strict-signature.xml
new file mode 100644
index 0000000..3cbfa8c
--- /dev/null
+++ b/data/etc/preinstalled-packages-strict-signature.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  ~ Copyright (C) 2023 The Android Open Source Project
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<!--
+This XML file declares which preinstalled apps, after updated, need to have strict signature check
+in boot time and avoid the cached results. This is to ensure the updated version still verifies
+against the preinstalled version.
+
+Example usage:
+    <require-strict-signature package="com.foo.bar"/>
+-->
+
+<config></config>