diff --git a/cc/cc.go b/cc/cc.go
index 426bac89b..f2c852573 100644
--- a/cc/cc.go
+++ b/cc/cc.go
@@ -1913,14 +1913,14 @@ func (c *Module) QueueBazelCall(ctx android.BaseModuleContext) {
 // IsMixedBuildSupported returns true if the module should be analyzed by Bazel
 // in any of the --bazel-mode(s).
 func (c *Module) IsMixedBuildSupported(ctx android.BaseModuleContext) bool {
-	if !allEnabledSanitizersSupportedByBazel(c) {
+	if !allEnabledSanitizersSupportedByBazel(ctx, c) {
 		//TODO(b/278772861) support sanitizers in Bazel rules
 		return false
 	}
 	return c.bazelHandler != nil
 }
 
-func allEnabledSanitizersSupportedByBazel(c *Module) bool {
+func allEnabledSanitizersSupportedByBazel(ctx android.BaseModuleContext, c *Module) bool {
 	if c.sanitize == nil {
 		return true
 	}
@@ -1943,12 +1943,17 @@ func allEnabledSanitizersSupportedByBazel(c *Module) bool {
 			// TODO(b/261058727): enable mixed builds for all modules with UBSan
 			// Currently we can only support ubsan when minimum runtime is used.
 			ubsanEnabled := Bool(sanitizeProps.Integer_overflow) || len(sanitizeProps.Misc_undefined) > 0
-			if ubsanEnabled && !c.MinimalRuntimeNeeded() {
-				return false
+			if !ubsanEnabled || c.MinimalRuntimeNeeded() {
+				continue
 			}
 		} else if san == cfi {
-			continue
-		} else if c.sanitize.isSanitizerEnabled(san) {
+			apexInfo := ctx.Provider(android.ApexInfoProvider).(android.ApexInfo)
+			// Only allow cfi if this is an apex variant
+			if !apexInfo.IsForPlatform() {
+				continue
+			}
+		}
+		if c.sanitize.isSanitizerEnabled(san) {
 			return false
 		}
 	}