diff --git a/domain.te b/domain.te
index e7e0d7d6792545ee34c01ee1529ff8c2362a614e..2af36e8112d52ec4fc72fbc8d930c88f84f3efa5 100644
--- a/domain.te
+++ b/domain.te
@@ -209,11 +209,10 @@ neverallow domain self:capability2 mac_override;
 # Only recovery needs mac_admin to set contexts not defined in current policy.
 neverallow { domain -recovery } self:capability2 mac_admin;
 
-# Only init should be able to load SELinux policies.
+# Nobody should be able to load a new SELinux policy.
 # The first load technically occurs while still in the kernel domain,
 # but this does not trigger a denial since there is no policy yet.
-# Policy reload requires allowing this to the init domain.
-neverallow { domain -init } kernel:security load_policy;
+neverallow domain kernel:security load_policy;
 
 # Only init and the system_server can set selinux.reload_policy 1
 # to trigger a policy reload.
diff --git a/init.te b/init.te
index 437066acc5cb4f9ba702925ca5f165201d21221e..4bf40f53b4e0b72227047fc0611d1e66c58e3d65 100644
--- a/init.te
+++ b/init.te
@@ -123,7 +123,6 @@ allow init security_file:dir { create setattr };
 
 # Reload policy upon setprop selinux.reload_policy 1.
 r_dir_file(init, security_file)
-allow init kernel:security load_policy;
 
 # Any operation that can modify the kernel ring buffer, e.g. clear
 # or a read that consumes the messages that were read.