diff --git a/private/app.te b/private/app.te
index 9ede35717a45b24395c4c6ca679e4f52c5a8a0f2..1bda9f41c0ab8fcd79fd22b4be51910e3bc2967a 100644
--- a/private/app.te
+++ b/private/app.te
@@ -114,6 +114,7 @@ full_treble_only(`
 # Allow apps access to /vendor/app except for privileged
 # apps which cannot be in /vendor.
 r_dir_file({ appdomain -ephemeral_app -untrusted_v2_app }, vendor_app_file)
+allow { appdomain -ephemeral_app -untrusted_v2_app } vendor_app_file:file execute;
 
 # Allow apps access to /vendor/overlay
 r_dir_file(appdomain, vendor_overlay_file)