diff --git a/target/product/security/Android.mk b/target/product/security/Android.mk
index cedad5b4902da05b73f78f970cf974221818b14b..2e94b4af7a41a858ca3e485ffd1914c942fc7323 100644
--- a/target/product/security/Android.mk
+++ b/target/product/security/Android.mk
@@ -63,8 +63,15 @@ LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_STEM := otacerts.zip
 LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security
 include $(BUILD_SYSTEM)/base_rules.mk
-$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
-$(LOCAL_BUILT_MODULE): $(SOONG_ZIP) $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
+
+ifneq (,$(wildcard user-keys/releasekey.x509.pem))
+DEFAULT_OTA_CERTIFICATE := user-keys/releasekey
+else
+DEFAULT_OTA_CERTIFICATE := $(DEFAULT_SYSTEM_DEV_CERTIFICATE)
+endif
+
+$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_OTA_CERTIFICATE).x509.pem
+$(LOCAL_BUILT_MODULE): $(SOONG_ZIP) $(DEFAULT_OTA_CERTIFICATE).x509.pem
 	$(SOONG_ZIP) -o $@ -j -symlinks=false -f $(PRIVATE_CERT)
 
 
@@ -82,11 +89,17 @@ include $(BUILD_SYSTEM)/base_rules.mk
 
 extra_recovery_keys := $(patsubst %,%.x509.pem,$(PRODUCT_EXTRA_RECOVERY_KEYS))
 
-$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
+ifneq (,$(wildcard user-keys/releasekey.x509.pem))
+DEFAULT_OTA_CERTIFICATE := user-keys/releasekey
+else
+DEFAULT_OTA_CERTIFICATE := $(DEFAULT_SYSTEM_DEV_CERTIFICATE)
+endif
+
+$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_OTA_CERTIFICATE).x509.pem
 $(LOCAL_BUILT_MODULE): PRIVATE_EXTRA_RECOVERY_KEYS := $(extra_recovery_keys)
 $(LOCAL_BUILT_MODULE): \
 	    $(SOONG_ZIP) \
-	    $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem \
+	    $(DEFAULT_OTA_CERTIFICATE).x509.pem \
 	    $(extra_recovery_keys)
 	$(SOONG_ZIP) -o $@ -j -symlinks=false \
 	    $(foreach key_file, $(PRIVATE_CERT) $(PRIVATE_EXTRA_RECOVERY_KEYS), -f $(key_file))