diff --git a/core/Makefile b/core/Makefile
index 8214c77385..41b9cad01d 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -1109,6 +1109,7 @@ bootimage_16k: $(BUILT_BOOTIMAGE_16K_TARGET)
 BUILT_BOOT_OTA_PACKAGE_16K := $(PRODUCT_OUT)/boot_ota_16k.zip
 $(BUILT_BOOT_OTA_PACKAGE_16K): $(OTA_FROM_RAW_IMG) $(BUILT_BOOTIMAGE_16K_TARGET) $(DEFAULT_SYSTEM_DEV_CERTIFICATE).pk8
 	$(OTA_FROM_RAW_IMG) --package_key $(DEFAULT_SYSTEM_DEV_CERTIFICATE) \
+                      --max_timestamp `cat $(BUILD_DATETIME_FILE)` \
                       --path $(HOST_OUT) \
                       --partition_name boot \
                       --output $@ \
diff --git a/tools/releasetools/ota_from_raw_img.py b/tools/releasetools/ota_from_raw_img.py
index ac4f9fb8c7..37504d19ad 100644
--- a/tools/releasetools/ota_from_raw_img.py
+++ b/tools/releasetools/ota_from_raw_img.py
@@ -58,6 +58,8 @@ def main(argv):
                       help="Partition names to install the images, default to basename of the image(no file name extension)")
   parser.add_argument('--output', type=str,
                       help='Paths to output merged ota', required=True)
+  parser.add_argument('--max_timestamp', type=int,
+                      help='Maximum build timestamp allowed to install this OTA')
   parser.add_argument("-v", action="store_true",
                       help="Enable verbose logging", dest="verbose")
   AddSigningArgumentParse(parser)
@@ -74,6 +76,8 @@ def main(argv):
     cmd.append("--partition_names=" + ",".join(args.partition_names))
     cmd.append("--new_partitions=" + ",".join(args.images))
     cmd.append("--out_file=" + unsigned_payload.name)
+    if args.max_timestamp:
+      cmd.append("--max_timestamp=" + str(args.max_timestamp))
     logger.info("Running %s", cmd)
 
     subprocess.run(cmd)