diff --git a/android/neverallow.go b/android/neverallow.go
index a7f4f82..217a8d4 100644
--- a/android/neverallow.go
+++ b/android/neverallow.go
@@ -56,7 +56,7 @@
 		without("vendor", "true").
 		without("owner", "").
 		because("a VNDK module can never have an owner."),
-	neverallow().notIn("libcore", "development", "external/conscrypt").with("no_standard_libs", "true"),
+	neverallow().notIn("libcore", "development", "external/bouncycastle", "external/conscrypt", "external/okhttp").with("no_standard_libs", "true"),
 
 	// TODO(b/67974785): always enforce the manifest
 	neverallow().
diff --git a/java/config/config.go b/java/config/config.go
index 3d27b70..85cb588 100644
--- a/java/config/config.go
+++ b/java/config/config.go
@@ -27,9 +27,9 @@
 var (
 	pctx = android.NewPackageContext("android/soong/java/config")
 
-	DefaultBootclasspathLibraries = []string{"core-oj", "core-libart", "core-simple"}
+	DefaultBootclasspathLibraries = []string{"core-oj", "core-libart", "core-simple", "bouncycastle", "conscrypt", "okhttp"}
 	DefaultSystemModules          = "core-system-modules"
-	DefaultLibraries              = []string{"ext", "framework", "okhttp"}
+	DefaultLibraries              = []string{"ext", "framework"}
 	DefaultLambdaStubsLibrary     = "core-lambda-stubs"
 	SdkLambdaStubsPath            = "prebuilts/sdk/tools/core-lambda-stubs.jar"
 
diff --git a/java/java_test.go b/java/java_test.go
index 1bfd24b..76244f0 100644
--- a/java/java_test.go
+++ b/java/java_test.go
@@ -115,9 +115,11 @@
 		"core-libart",
 		"core-lambda-stubs",
 		"core-simple",
+		"bouncycastle",
+		"conscrypt",
+		"okhttp",
 		"framework",
 		"ext",
-		"okhttp",
 		"android_stubs_current",
 		"android_system_stubs_current",
 		"android_test_stubs_current",
@@ -365,16 +367,16 @@
 }{
 	{
 		name:          "default",
-		bootclasspath: []string{"core-oj", "core-libart", "core-simple"},
+		bootclasspath: []string{"core-oj", "core-libart", "core-simple", "bouncycastle", "conscrypt", "okhttp"},
 		system:        "core-system-modules",
-		classpath:     []string{"ext", "framework", "okhttp"},
+		classpath:     []string{"ext", "framework"},
 	},
 	{
 		name:          "blank sdk version",
 		properties:    `sdk_version: "",`,
-		bootclasspath: []string{"core-oj", "core-libart", "core-simple"},
+		bootclasspath: []string{"core-oj", "core-libart", "core-simple", "bouncycastle", "conscrypt", "okhttp"},
 		system:        "core-system-modules",
-		classpath:     []string{"ext", "framework", "okhttp"},
+		classpath:     []string{"ext", "framework"},
 	},
 	{
 
@@ -1062,12 +1064,6 @@
 			name: "droiddoc-templates-sdk",
 			path: ".",
 		}
-		java_library {
-			name: "conscrypt",
-		}
-		java_library {
-			name: "bouncycastle",
-		}
 		java_sdk_library {
 			name: "foo",
 			srcs: ["a.java", "b.java"],
diff --git a/java/sdk_library.go b/java/sdk_library.go
index a8c3b11..c1b8880 100644
--- a/java/sdk_library.go
+++ b/java/sdk_library.go
@@ -519,7 +519,7 @@
 	// Src_lib and Src_lib_whitelist_* properties just above.
 	// If we don't add them to the classpath, errors messages are generated by doclava,
 	// though they don't break the build.
-	props.Libs = append(props.Libs, "conscrypt", "bouncycastle", "okhttp", "framework")
+	props.Libs = append(props.Libs, "framework")
 
 	mctx.CreateModule(android.ModuleFactoryAdaptor(DroiddocFactory), &props)
 }