diff --git a/services/core/java/com/android/server/ConnectivityService.java b/services/core/java/com/android/server/ConnectivityService.java
index 6b2d9df0d1..ee455af5e3 100644
--- a/services/core/java/com/android/server/ConnectivityService.java
+++ b/services/core/java/com/android/server/ConnectivityService.java
@@ -2144,7 +2144,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
                             networkCapabilities.hasCapability(NET_CAPABILITY_FOREGROUND)) {
                         Slog.wtf(TAG, "BUG: " + nai + " has CS-managed capability.");
                     }
-                    updateCapabilities(nai, networkCapabilities);
+                    updateCapabilities(nai.getCurrentScore(), nai, networkCapabilities);
                     break;
                 }
                 case NetworkAgent.EVENT_NETWORK_PROPERTIES_CHANGED: {
@@ -2221,7 +2221,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
                             final int oldScore = nai.getCurrentScore();
                             nai.lastValidated = valid;
                             nai.everValidated |= valid;
-                            updateCapabilities(nai, nai.networkCapabilities);
+                            updateCapabilities(oldScore, nai, nai.networkCapabilities);
                             // If score has changed, rebroadcast to NetworkFactories. b/17726566
                             if (oldScore != nai.getCurrentScore()) sendUpdatedScoreToFactories(nai);
                         }
@@ -2245,9 +2245,10 @@ public class ConnectivityService extends IConnectivityManager.Stub
                     }
                     // If captive portal status has changed, update capabilities.
                     if (nai != null && (visible != nai.lastCaptivePortalDetected)) {
+                        final int oldScore = nai.getCurrentScore();
                         nai.lastCaptivePortalDetected = visible;
                         nai.everCaptivePortalDetected |= visible;
-                        updateCapabilities(nai, nai.networkCapabilities);
+                        updateCapabilities(oldScore, nai, nai.networkCapabilities);
                     }
                     if (!visible) {
                         mNotifier.clearNotification(netId);
@@ -2619,7 +2620,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 mNetworkForRequestId.remove(nri.request.requestId);
                 if (!wasBackgroundNetwork && nai.isBackgroundNetwork()) {
                     // Went from foreground to background.
-                    updateCapabilities(nai, nai.networkCapabilities);
+                    updateCapabilities(nai.getCurrentScore(), nai, nai.networkCapabilities);
                 }
             }
 
@@ -4490,10 +4491,13 @@ public class ConnectivityService extends IConnectivityManager.Stub
      * augmented with any stateful capabilities implied from {@code networkAgent}
      * (e.g., validated status and captive portal status).
      *
+     * @param oldScore score of the network before any of the changes that prompted us
+     *                 to call this function.
      * @param nai the network having its capabilities updated.
      * @param networkCapabilities the new network capabilities.
      */
-    private void updateCapabilities(NetworkAgentInfo nai, NetworkCapabilities networkCapabilities) {
+    private void updateCapabilities(
+            int oldScore, NetworkAgentInfo nai, NetworkCapabilities networkCapabilities) {
         if (nai.everConnected && !nai.networkCapabilities.equalImmutableCapabilities(
                 networkCapabilities)) {
             Slog.wtf(TAG, "BUG: " + nai + " changed immutable capabilities: "
@@ -4531,7 +4535,6 @@ public class ConnectivityService extends IConnectivityManager.Stub
             }
         }
 
-        final int oldScore = nai.getCurrentScore();
         final NetworkCapabilities prevNc = nai.networkCapabilities;
         synchronized (nai) {
             nai.networkCapabilities = networkCapabilities;
@@ -4673,7 +4676,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
             teardownUnneededNetwork(oldNetwork);
         } else {
             // Put the network in the background.
-            updateCapabilities(oldNetwork, oldNetwork.networkCapabilities);
+            updateCapabilities(oldNetwork.getCurrentScore(), oldNetwork,
+                    oldNetwork.networkCapabilities);
         }
     }
 
@@ -4886,7 +4890,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
             // its foreground state. It is safe to do this after rematching the requests because
             // NET_CAPABILITY_FOREGROUND does not affect requests, as is not a requestable
             // capability and does not affect the network's score (see the Slog.wtf call above).
-            updateCapabilities(newNetwork, newNetwork.networkCapabilities);
+            updateCapabilities(score, newNetwork, newNetwork.networkCapabilities);
         } else {
             processListenRequests(newNetwork, false);
         }
diff --git a/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java b/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java
index e750fecbeb..ba39ec0166 100644
--- a/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java
+++ b/services/core/java/com/android/server/connectivity/NetworkAgentInfo.java
@@ -415,10 +415,7 @@ public class NetworkAgentInfo implements Comparable<NetworkAgentInfo> {
         }
 
         int score = currentScore;
-        // Use NET_CAPABILITY_VALIDATED here instead of lastValidated, this allows
-        // ConnectivityService.updateCapabilities() to compute the old score prior to updating
-        // networkCapabilities (with a potentially different validated state).
-        if (!networkCapabilities.hasCapability(NET_CAPABILITY_VALIDATED) && !pretendValidated) {
+        if (!lastValidated && !pretendValidated) {
             score -= UNVALIDATED_SCORE_PENALTY;
         }
         if (score < 0) score = 0;