diff --git a/libwvdrmengine/apex/Android.bp b/libwvdrmengine/apex/Android.bp
index e29d4e72..84ae897a 100644
--- a/libwvdrmengine/apex/Android.bp
+++ b/libwvdrmengine/apex/Android.bp
@@ -58,6 +58,11 @@ apex {
     key: "com.google.android.widevine.key",
     certificate: ":com.google.android.widevine.certificate",
     updatable: false,
+
+    // install sysconfig to allow the apex to be updatable
+    required: [
+        "allowlist_com.google.android.widevine.xml",
+    ],
 }
 
 linker_config {
@@ -81,3 +86,10 @@ prebuilt_etc {
     name: "com.google.android.widevine.rc",
     src: "com.google.android.widevine.rc",
 }
+
+prebuilt_etc {
+    name: "allowlist_com.google.android.widevine.xml",
+    src: "allowlist_com.google.android.widevine.xml",
+    vendor: true,
+    sub_dir: "sysconfig",
+}
\ No newline at end of file
diff --git a/libwvdrmengine/apex/allowlist_com.google.android.widevine.xml b/libwvdrmengine/apex/allowlist_com.google.android.widevine.xml
new file mode 100644
index 00000000..91581b9d
--- /dev/null
+++ b/libwvdrmengine/apex/allowlist_com.google.android.widevine.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!--
+ This XML file declares the vendor apex package names eligible for installation.
+-->
+
+<config>
+<allowed-vendor-apex package="com.google.android.widevine" installerPackage="com.android.vending" />
+</config>
diff --git a/libwvdrmengine/apex/apex_manifest.json b/libwvdrmengine/apex/apex_manifest.json
index c6d18914..96795d7b 100644
--- a/libwvdrmengine/apex/apex_manifest.json
+++ b/libwvdrmengine/apex/apex_manifest.json
@@ -1,4 +1,5 @@
 {
     "name": "com.google.android.widevine",
-    "version": 1
+    "version": 1,
+    "supportsRebootlessUpdate": true
 }
\ No newline at end of file
diff --git a/libwvdrmengine/apex/com.google.android.widevine.rc b/libwvdrmengine/apex/com.google.android.widevine.rc
index 381d0d69..d7f0b0e2 100644
--- a/libwvdrmengine/apex/com.google.android.widevine.rc
+++ b/libwvdrmengine/apex/com.google.android.widevine.rc
@@ -1,8 +1,12 @@
-on apex-ready
+on property:apex.all.ready=true
     mkdir /data/vendor/mediadrm 0770 media mediadrm
 
+# Start service after update
+on property:apex.com.google.android.widevine.ready=true
+    start vendor.drm-widevine-hal
+
 service vendor.drm-widevine-hal /apex/com.google.android.widevine/bin/hw/android.hardware.drm-service.widevine
-    interface aidl android.hardware.drm::IDrmFactory/widevine
+    interface aidl android.hardware.drm.IDrmFactory/widevine
     class hal
     user media
     group media mediadrm drmrpc system