diff --git a/config/device/common/gen4pixel.yml b/config/device/common/gen4pixel.yml
index ce2a3aa..98325a8 100644
--- a/config/device/common/gen4pixel.yml
+++ b/config/device/common/gen4pixel.yml
@@ -8,6 +8,7 @@ includes:
 device:
   build_id: TP1A.221005.002.B2
   prev_build_id: TP1A.221005.002
+  platform_security_patch_level_override: 2022-11-01
 
 filters:
   files:
diff --git a/src/build/make.ts b/src/build/make.ts
index a960296..08de098 100644
--- a/src/build/make.ts
+++ b/src/build/make.ts
@@ -246,6 +246,13 @@ PRODUCT_MANUFACTURER := ${mk.manufacturer}`)
 endif`)
   }
 
+  let splOverride = config?.device?.platform_security_patch_level_override
+  if (splOverride !== undefined) {
+    blocks.push(`ifneq ($(PLATFORM_SECURITY_PATCH),${splOverride})
+  $(error PLATFORM_SECURITY_PATCH: expected ${splOverride}, got $(PLATFORM_SECURITY_PATCH))
+endif`)
+  }
+
   return finishBlocks(blocks)
 }
 
diff --git a/src/config/device.ts b/src/config/device.ts
index 51f8f93..f3e2cba 100644
--- a/src/config/device.ts
+++ b/src/config/device.ts
@@ -29,6 +29,8 @@ export interface DeviceConfig {
     system_fs_type: FsType
     build_id: string
     prev_build_id: string
+    // ignored when undefined
+    platform_security_patch_level_override?: string
   }
 
   platform: {