diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index a5d5f02a..a282566c 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -59,6 +59,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@3ab4101902695724f9365a384f86c1074d94e18c # tag=v3.24.7
+        uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # tag=v3.28.10
         with:
           sarif_file: results.sarif
diff --git a/Android.bp b/Android.bp
index a8913ed9..fc144cb0 100644
--- a/Android.bp
+++ b/Android.bp
@@ -41,6 +41,49 @@ license {
     ],
 }
 
+cc_binary {
+    name: "zstd",
+
+    cflags: [
+        "-DZSTD_GZCOMPRESS",
+        "-DZSTD_GZDECOMPRESS",
+        "-DZSTD_LZ4COMPRESS",
+        "-DZSTD_LZ4DECOMPRESS",
+        "-DZSTD_MULTITHREAD",
+        "-Wall",
+        "-Werror",
+    ],
+
+    shared_libs: [
+        "liblz4",
+        "libz",
+        "libzstd",
+    ],
+
+    srcs: ["programs/*.c"],
+    system_ext_specific: true,
+
+    required: ["zstdgrep", "zstdless"],
+
+    symlinks: [
+        "zstdcat",
+        "zstdmt",
+        "unzstd",
+    ],
+}
+
+sh_binary {
+    name: "zstdgrep",
+    src: "programs/zstdgrep",
+    system_ext_specific: true,
+}
+
+sh_binary {
+    name: "zstdless",
+    src: "programs/zstdless",
+    system_ext_specific: true,
+}
+
 cc_library {
     name: "libzstd",
     min_sdk_version: "apex_inherit",
@@ -61,6 +104,7 @@ cc_library {
         "//external/dwarves:__subpackages__",
         "//external/elfutils:__subpackages__",
         "//external/libbpf:__subpackages__",
+        "//external/rsync:__subpackages__",
         "//external/squashfs-tools/squashfs-tools:__subpackages__",
         "//external/stg:__subpackages__",
         "//frameworks/libs/binary_translation/tools:__subpackages__",
@@ -77,6 +121,7 @@ cc_library {
     product_available: true,
     recovery_available: true,
     vendor_available: true,
+    system_ext_specific: true,
     host_supported: true,
     native_bridge_supported: true,
     ramdisk_available: true,
@@ -118,6 +163,7 @@ cc_defaults {
         "lib/dictBuilder",
         "tests/fuzz",
     ],
+    system_ext_specific: true,
     cflags: [
         "-Wno-error",
         "-Wno-pointer-arith",