diff --git a/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java b/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java
index 81a431c..a1e4caa 100755
--- a/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java
+++ b/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java
@@ -16,6 +16,7 @@
 
 package com.android.cts.net.hostside;
 
+import static android.Manifest.permission.NETWORK_SETTINGS;
 import static android.os.Process.INVALID_UID;
 import static android.system.OsConstants.AF_INET;
 import static android.system.OsConstants.AF_INET6;
@@ -25,6 +26,9 @@
 import static android.system.OsConstants.IPPROTO_TCP;
 import static android.system.OsConstants.POLLIN;
 import static android.system.OsConstants.SOCK_DGRAM;
+import static android.test.MoreAsserts.assertNotEqual;
+
+import static com.android.compatibility.common.util.SystemUtil.runWithShellPermissionIdentity;
 
 import android.annotation.Nullable;
 import android.app.DownloadManager;
@@ -48,6 +52,8 @@
 import android.net.Uri;
 import android.net.VpnService;
 import android.net.wifi.WifiManager;
+import android.os.Handler;
+import android.os.Looper;
 import android.os.ParcelFileDescriptor;
 import android.os.Process;
 import android.os.SystemProperties;
@@ -687,6 +693,20 @@
         setAndVerifyPrivateDns(initialMode);
     }
 
+    private class NeverChangeNetworkCallback extends NetworkCallback {
+        private volatile Network mLastNetwork;
+
+        public void onAvailable(Network n) {
+            assertNull("Callback got onAvailable more than once: " + mLastNetwork + ", " + n,
+                    mLastNetwork);
+            mLastNetwork = n;
+        }
+
+        public Network getLastNetwork() {
+            return mLastNetwork;
+        }
+    }
+
     public void testDefault() throws Exception {
         if (!supportedHardware()) return;
         // If adb TCP port opened, this test may running by adb over network.
@@ -702,6 +722,14 @@
                 getInstrumentation().getTargetContext(), MyVpnService.ACTION_ESTABLISHED);
         receiver.register();
 
+
+        // Expect the system default network not to change.
+        final NeverChangeNetworkCallback neverChangeCallback = new NeverChangeNetworkCallback();
+        final Network defaultNetwork = mCM.getActiveNetwork();
+        runWithShellPermissionIdentity(() ->
+                mCM.registerSystemDefaultNetworkCallback(neverChangeCallback,
+                        new Handler(Looper.getMainLooper())), NETWORK_SETTINGS);
+
         FileDescriptor fd = openSocketFdInOtherApp(TEST_HOST, 80, TIMEOUT_MS);
 
         startVpn(new String[] {"192.0.2.2/32", "2001:db8:1:2::ffe/128"},
@@ -719,6 +747,17 @@
 
         checkTrafficOnVpn();
 
+        // Check that system default network callback has not seen any network changes, but the app
+        // default network callback has. This needs to be done before testing private DNS because
+        // checkStrictModePrivateDns will set the private DNS server to a nonexistent name, which
+        // will cause validation to fail could cause the default network to switch (e.g., from wifi
+        // to cellular).
+        assertEquals(defaultNetwork, neverChangeCallback.getLastNetwork());
+        assertNotEqual(defaultNetwork, mCM.getActiveNetwork());
+        runWithShellPermissionIdentity(
+                () ->  mCM.unregisterNetworkCallback(neverChangeCallback),
+                NETWORK_SETTINGS);
+
         checkStrictModePrivateDns();
 
         receiver.unregisterQuietly();
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index ce00652..3145d7e 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -93,6 +93,7 @@
 import android.net.wifi.WifiManager;
 import android.os.Binder;
 import android.os.Build;
+import android.os.Handler;
 import android.os.Looper;
 import android.os.MessageQueue;
 import android.os.SystemClock;
@@ -532,6 +533,13 @@
         final TestNetworkCallback defaultTrackingCallback = new TestNetworkCallback();
         mCm.registerDefaultNetworkCallback(defaultTrackingCallback);
 
+        final TestNetworkCallback systemDefaultTrackingCallback = new TestNetworkCallback();
+        runWithShellPermissionIdentity(() ->
+                mCm.registerSystemDefaultNetworkCallback(systemDefaultTrackingCallback,
+                        new Handler(Looper.getMainLooper())),
+                NETWORK_SETTINGS);
+
+
         Network wifiNetwork = null;
 
         try {
@@ -551,6 +559,9 @@
         } finally {
             mCm.unregisterNetworkCallback(callback);
             mCm.unregisterNetworkCallback(defaultTrackingCallback);
+            runWithShellPermissionIdentity(
+                    () -> mCm.unregisterNetworkCallback(systemDefaultTrackingCallback),
+                    NETWORK_SETTINGS);
         }
     }