diff --git a/Android.mk b/Android.mk
index 67d45c3..25a6043 100644
--- a/Android.mk
+++ b/Android.mk
@@ -43,20 +43,31 @@
 
 cacerts := $(call all-files-under,files)
 
-cacerts_target_directory := $(TARGET_OUT)/etc/security/cacerts
-$(foreach cacert, $(cacerts), $(eval $(call include-prebuilt-with-destination-directory,target-cacert-$(notdir $(cacert)),$(cacert),$(cacerts_target_directory))))
-cacerts_target := $(addprefix $(cacerts_target_directory)/,$(foreach cacert,$(cacerts),$(notdir $(cacert))))
-.PHONY: cacerts_target
-cacerts: $(cacerts_target)
+$(foreach cacert,$(cacerts),$(eval \
+  $(call include-prebuilt-with-destination-directory,\
+    target-cacert-$(notdir $(cacert)),\
+    $(cacert),\
+    $(TARGET_OUT)/etc/security/cacerts\
+  )\
+))
 
-# This is so that build/target/product/core.mk can use cacerts in PRODUCT_PACKAGES
-ALL_MODULES.cacerts.INSTALLED := $(cacerts_target)
+include $(CLEAR_VARS)
+LOCAL_MODULE := cacerts
+LOCAL_REQUIRED_MODULES := $(foreach cacert,$(cacerts),target-cacert-$(notdir $(cacert)))
+include $(BUILD_PHONY_PACKAGE)
 
-cacerts_host_directory := $(HOST_OUT)/etc/security/cacerts
-$(foreach cacert, $(cacerts), $(eval $(call include-prebuilt-with-destination-directory,host-cacert-$(notdir $(cacert)),$(cacert),$(cacerts_host_directory))))
+$(foreach cacert,$(cacerts),$(eval \
+  $(call include-prebuilt-with-destination-directory,\
+    host-cacert-$(notdir $(cacert)),\
+    $(cacert),\
+    $(HOST_OUT)/etc/security/cacerts\
+  )\
+))
 
-cacerts_host := $(addprefix $(cacerts_host_directory)/,$(foreach cacert,$(cacerts),$(notdir $(cacert))))
-.PHONY: cacerts-host
-cacerts-host: $(cacerts_host)
+include $(CLEAR_VARS)
+LOCAL_MODULE := cacerts-host
+LOCAL_IS_HOST_MODULE := true
+LOCAL_REQUIRED_MODULES := $(foreach cacert,$(cacerts),host-cacert-$(notdir $(cacert)))
+include $(BUILD_PHONY_PACKAGE)
 
 include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/google/Android.mk b/google/Android.mk
index 80de0b0..5955efd 100644
--- a/google/Android.mk
+++ b/google/Android.mk
@@ -17,18 +17,29 @@
 
 cacerts_google := $(call all-files-under,files)
 
-cacerts_google_target_directory := $(TARGET_OUT)/etc/security/cacerts_google
-$(foreach cacert, $(cacerts_google), $(eval $(call include-prebuilt-with-destination-directory,target-cacert-google-$(notdir $(cacert)),$(cacert),$(cacerts_google_target_directory))))
-cacerts_google_target := $(addprefix $(cacerts_google_target_directory)/,$(foreach cacert,$(cacerts_google),$(notdir $(cacert))))
-.PHONY: cacerts_google_target
-cacerts_google: $(cacerts_google_target)
+$(foreach cacert,$(cacerts_google),$(eval \
+	$(call include-prebuilt-with-destination-directory,\
+		target-cacert-google-$(notdir $(cacert)),\
+		$(cacert),\
+		$(TARGET_OUT)/etc/security/cacerts_google\
+	)\
+))
 
-# This is so that build/target/product/core.mk can use cacerts_google in PRODUCT_PACKAGES
-ALL_MODULES.cacerts_google.INSTALLED := $(cacerts_google_target)
+include $(CLEAR_VARS)
+LOCAL_MODULE := cacerts_google
+LOCAL_REQUIRED_MODULES := $(foreach cacert,$(cacerts_google),target-cacert-google-$(notdir $(cacert)))
+include $(BUILD_PHONY_PACKAGE)
 
-cacerts_google_host_directory := $(HOST_OUT)/etc/security/cacerts_google
-$(foreach cacert, $(cacerts_google), $(eval $(call include-prebuilt-with-destination-directory,host-cacert-google-$(notdir $(cacert)),$(cacert),$(cacerts_google_host_directory))))
+$(foreach cacert,$(cacerts_google),$(eval \
+	$(call include-prebuilt-with-destination-directory,\
+		host-cacert-google-$(notdir $(cacert)),\
+		$(cacert),\
+		$(HOST_OUT)/etc/security/cacerts_google\
+	)\
+))
 
-cacerts_google_host := $(addprefix $(cacerts_google_host_directory)/,$(foreach cacert,$(cacerts_google),$(notdir $(cacert))))
-.PHONY: cacerts_google-host
-cacerts_google-host: $(cacerts_google_host)
+include $(CLEAR_VARS)
+LOCAL_MODULE := cacerts_google-host
+LOCAL_IS_HOST_MODULE := true
+LOCAL_REQUIRED_MODULES := $(foreach cacert,$(cacerts_google),host-cacert-google-$(notdir $(cacert)))
+include $(BUILD_PHONY_PACKAGE)
diff --git a/wfa_certs/Android.mk b/wfa_certs/Android.mk
index 2014c4e..94db8ad 100644
--- a/wfa_certs/Android.mk
+++ b/wfa_certs/Android.mk
@@ -21,7 +21,7 @@
 cacerts_wfa_target_directory := $(TARGET_OUT)/etc/security/cacerts_wfa
 $(foreach cacert, $(cacerts_wfa), $(eval $(call include-prebuilt-with-destination-directory,target-cacert-wifi-$(notdir $(cacert)),$(cacert),$(cacerts_wfa_target_directory))))
 cacerts_wfa_target := $(addprefix $(cacerts_wfa_target_directory)/,$(foreach cacert,$(cacerts_wfa),$(notdir $(cacert))))
-.PHONY: cacerts_wfa_target
+.PHONY: cacerts_wfa
 cacerts_wfa: $(cacerts_wfa_target)
 
 # This is so that build/target/product/core.mk can use cacerts_wfa in PRODUCT_PACKAGES