diff --git a/Android.bp b/Android.bp
index 035eadf..b06e0b9 100644
--- a/Android.bp
+++ b/Android.bp
@@ -185,13 +185,19 @@
     static_libs: ["bouncycastle-unbundled"],
 }
 
-// Bouncycastle filegroup for use by platform/packages/modules/IPsec project.
+// Bouncycastle subset for use by platform/packages/modules/IPsec project.
+//
+// Avoids including the whole of bouncycastle_unbundled in IPsec.
 //
 // Specifically, SHA1Digest and MD4Digest (and their dependencies) must be used by IKEv2 to support
 // legacy authentication methods.
-filegroup {
+java_library {
     name: "bouncycastle_ike_digests",
     visibility: ["//packages/modules/IPsec"],
+    apex_available: [
+        "com.android.ipsec",
+        "test_com.android.ipsec",
+    ],
     srcs: [
         "bcprov/src/main/java/org/bouncycastle/crypto/Digest.java",
         "bcprov/src/main/java/org/bouncycastle/crypto/ExtendedDigest.java",
@@ -202,4 +208,5 @@
         "bcprov/src/main/java/org/bouncycastle/util/Memoable.java",
         "bcprov/src/main/java/org/bouncycastle/util/Pack.java",
     ],
+    sdk_version: "core_current",
 }