diff --git a/libwvdrmengine/cdm/include/wv_content_decryption_module.h b/libwvdrmengine/cdm/include/wv_content_decryption_module.h
index 1630ae93..fab928ac 100644
--- a/libwvdrmengine/cdm/include/wv_content_decryption_module.h
+++ b/libwvdrmengine/cdm/include/wv_content_decryption_module.h
@@ -159,8 +159,14 @@ class WvContentDecryptionModule : public android::RefBase, public TimerHandler {
   // Closes the CdmEngine and sessions associated with the given CdmIdentifier.
   virtual CdmResponseType CloseCdm(const CdmIdentifier& identifier);
 
+  // When positive, the keybox will be ignored at initialization and force the
+  // device to request a keybox OTA reprovisioning.
   virtual CdmResponseType SetDebugIgnoreKeyboxCount(uint32_t count);
 
+  // Allow the device to continue with a test keybox. Otherwise, it will fall
+  // back to L3.
+  virtual CdmResponseType SetAllowTestKeybox(bool allow);
+
   virtual CdmResponseType SetDecryptHash(const std::string& hash_data,
                                          CdmSessionId* session_id);
   virtual CdmResponseType GetDecryptHashError(const CdmSessionId& session_id,
diff --git a/libwvdrmengine/cdm/src/wv_content_decryption_module.cpp b/libwvdrmengine/cdm/src/wv_content_decryption_module.cpp
index 3256d102..e87d7890 100644
--- a/libwvdrmengine/cdm/src/wv_content_decryption_module.cpp
+++ b/libwvdrmengine/cdm/src/wv_content_decryption_module.cpp
@@ -505,6 +505,11 @@ CdmResponseType WvContentDecryptionModule::SetDebugIgnoreKeyboxCount(
   return CdmEngine::SetDebugIgnoreKeyboxCount(count);
 }
 
+CdmResponseType WvContentDecryptionModule::SetAllowTestKeybox(bool allow) {
+  // TODO(210807585) add functionality in next CL.
+  return NO_ERROR;
+}
+
 CdmResponseType WvContentDecryptionModule::SetDecryptHash(
     const std::string& hash_data, CdmSessionId* id) {
   if (id == nullptr) {
diff --git a/libwvdrmengine/mediadrm/src/WVDrmPlugin.cpp b/libwvdrmengine/mediadrm/src/WVDrmPlugin.cpp
index 76f09a49..0ba2a251 100644
--- a/libwvdrmengine/mediadrm/src/WVDrmPlugin.cpp
+++ b/libwvdrmengine/mediadrm/src/WVDrmPlugin.cpp
@@ -679,6 +679,18 @@ status_t WVDrmPlugin::setPropertyString(const String8& name,
     }
     CdmResponseType res = mCDM->SetDebugIgnoreKeyboxCount(count);
     return mapCdmResponseType(res);
+  } else if (name == "allowTestKeybox") {
+    bool allow;
+    if (value == kEnable) {
+      allow = true;
+    } else if (value == kDisable) {
+      allow = false;
+    } else {
+      ALOGE("App requested unknown allowTestKeybox %s", value.string());
+      return android::BAD_VALUE;
+    }
+    CdmResponseType res = mCDM->SetAllowTestKeybox(allow);
+    return mapCdmResponseType(res);
   } else if (name == "decryptHash") {
     CdmSessionId sessionId;
     CdmResponseType res =
diff --git a/libwvdrmengine/mediadrm/src_hidl/WVDrmPlugin.cpp b/libwvdrmengine/mediadrm/src_hidl/WVDrmPlugin.cpp
index aa1efe37..73744a4f 100644
--- a/libwvdrmengine/mediadrm/src_hidl/WVDrmPlugin.cpp
+++ b/libwvdrmengine/mediadrm/src_hidl/WVDrmPlugin.cpp
@@ -1443,6 +1443,18 @@ Return<Status> WVDrmPlugin::setPropertyString(const hidl_string& propertyName,
     }
     CdmResponseType res = mCDM->SetDebugIgnoreKeyboxCount(count);
     return mapCdmResponseType(res);
+  } else if (name == "allowTestKeybox") {
+    bool allow;
+    if (_value == kEnable) {
+      allow = true;
+    } else if (_value == kDisable) {
+      allow = false;
+    } else {
+      ALOGE("App requested unknown allowTestKeybox %s", _value.c_str());
+      return Status::BAD_VALUE;
+    }
+    CdmResponseType res = mCDM->SetAllowTestKeybox(allow);
+    return mapCdmResponseType(res);
   } else if (name == "decryptHash") {
     wvcdm::CdmSessionId sessionId;
     CdmResponseType res =