diff --git a/TEST_MAPPING b/TEST_MAPPING
index f7dc8f0..1d0f234 100644
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -16,9 +16,7 @@
     // so in theory the infra would not need to reinstall/reboot devices to run both.
     {
       "name": "NetworkStackTests[CaptivePortalLoginGoogle.apk+NetworkStackGoogle.apk+com.google.android.resolv.apex+com.google.android.tethering.apex]"
-    }
-  ],
-  "mainline-postsubmit": [
+    },
     {
       "name": "NetworkStackIntegrationTests[CaptivePortalLoginGoogle.apk+NetworkStackGoogle.apk+com.google.android.resolv.apex+com.google.android.tethering.apex]"
     }
diff --git a/tests/integration/Android.bp b/tests/integration/Android.bp
index 2bf0529..f21cf33 100644
--- a/tests/integration/Android.bp
+++ b/tests/integration/Android.bp
@@ -78,6 +78,7 @@
     min_sdk_version: "29",
     target_sdk_version: "30",
     jarjar_rules: ":NetworkStackJarJarRules",
+    test_config_template: "AndroidTestTemplate_Integration.xml",
 }
 
 // Network stack next integration tests.
@@ -99,6 +100,7 @@
     platform_apis: true,
     test_suites: ["device-tests"],
     jarjar_rules: ":NetworkStackJarJarRules",
+    test_config_template: "AndroidTestTemplate_Integration.xml",
 }
 
 // Network stack integration root tests.
diff --git a/tests/integration/AndroidTestTemplate_Integration.xml b/tests/integration/AndroidTestTemplate_Integration.xml
new file mode 100644
index 0000000..7ea8ad6
--- /dev/null
+++ b/tests/integration/AndroidTestTemplate_Integration.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2022 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Test config for {MODULE}">
+    <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
+        <option name="cleanup-apks" value="true" />
+        <option name="test-file-name" value="{MODULE}.apk" />
+    </target_preparer>
+
+    <!-- Needed to push to the app's data directory. Without root, there appears to be no directory
+         that the shell can write to and that the networkstack can read from. -->
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer"/>
+
+    <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
+        <option name="package" value="com.android.server.networkstack.integrationtests" />
+        <option name="runner" value="androidx.test.runner.AndroidJUnitRunner" />
+        <!-- By default, include and exclude filters go into /data/local/tmp/ajur/, which these
+             tests cannot access because they run in the network_stack selinux context. Move
+             them to the tests' data directory instead.
+
+             This avoids confusing module errors in presubmit when a test fails, the test infra
+             attempts to retry it, but the retry run results in the test process crashing with a
+             permission denial trying to read the exclude file. -->
+        <option name="test-filter-dir" value="/data/data/{PACKAGE}/cache" />
+        <option name="hidden-api-checks" value="false"/>
+    </test>
+</configuration>
diff --git a/tests/integration/AndroidTest_Coverage.xml b/tests/integration/AndroidTest_Coverage.xml
index 3e7361b..1c63a93 100644
--- a/tests/integration/AndroidTest_Coverage.xml
+++ b/tests/integration/AndroidTest_Coverage.xml
@@ -22,6 +22,14 @@
     <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
         <option name="package" value="com.android.server.networkstack.coverage" />
         <option name="runner" value="androidx.test.runner.AndroidJUnitRunner" />
+        <!-- By default, include and exclude filters go into /data/local/tmp/ajur/, which these
+             tests cannot access because they run in the network_stack selinux context. Move
+             them to the tests' data directory instead.
+
+             This avoids confusing module errors in presubmit when a test fails, the test infra
+             attempts to retry it, but the retry run results in the test process crashing with a
+             permission denial trying to read the exclude file. -->
+        <option name="test-filter-dir" value="/data/data/{PACKAGE}/cache" />
         <option name="hidden-api-checks" value="false"/>
         <option name="device-listeners" value="com.android.modules.utils.testing.NativeCoverageHackInstrumentationListener" />
     </test>