diff --git a/core/prebuilt.mk b/core/prebuilt.mk
index 706dfc6..2693f5d 100644
--- a/core/prebuilt.mk
+++ b/core/prebuilt.mk
@@ -51,7 +51,12 @@
 else ifeq ($(LOCAL_CERTIFICATE),PRESIGNED)
   # The magic string "PRESIGNED" means this package is already checked
   # signed with its release key.
-  # Can't re-sign this package, so predexopt is not available.
+  #
+  # By setting .CERTIFICATE but not .PRIVATE_KEY, this package will be
+  # mentioned in apkcerts.txt (with certificate set to "PRESIGNED")
+  # but the dexpreopt process will not try to re-sign the app.
+  PACKAGES.$(LOCAL_MODULE).CERTIFICATE := PRESIGNED
+  PACKAGES := $(PACKAGES) $(LOCAL_MODULE)
 else
   # If this is not an absolute certificate, assign it to a generic one.
   ifeq ($(dir $(strip $(LOCAL_CERTIFICATE))),./)
diff --git a/tools/releasetools/sign_target_files_apks b/tools/releasetools/sign_target_files_apks
index c974026..03610b2 100755
--- a/tools/releasetools/sign_target_files_apks
+++ b/tools/releasetools/sign_target_files_apks
@@ -89,9 +89,15 @@
     if not line: continue
     m = re.match(r'^name="(.*)"\s+certificate="(.*)\.x509\.pem"\s+'
                  r'private_key="\2\.pk8"$', line)
-    if not m:
-      raise SigningError("failed to parse line from apkcerts.txt:\n" + line)
-    certmap[m.group(1)] = OPTIONS.key_map.get(m.group(2), m.group(2))
+    if m:
+      certmap[m.group(1)] = OPTIONS.key_map.get(m.group(2), m.group(2))
+    else:
+      m = re.match(r'^name="(.*)"\s+certificate="PRESIGNED"\s+'
+                 r'private_key=""$', line)
+      if m:
+        certmap[m.group(1)] = None
+      else:
+        raise ValueError("failed to parse line from apkcerts.txt:\n" + line)
   for apk, cert in OPTIONS.extra_apks.iteritems():
     certmap[apk] = OPTIONS.key_map.get(cert, cert)
   return certmap