diff --git a/domain.te b/domain.te
index b0892b7377e192f9cea25853313b3701b70b3170..d42f35dbe3a0cbd56a9f1bd0b023a328791a6142 100644
--- a/domain.te
+++ b/domain.te
@@ -505,7 +505,7 @@ neverallow {
 
 # Only domains spawned from zygote and runas may have the appdomain attribute.
 neverallow { domain -runas -zygote } {
-  appdomain -shell userdebug_or_eng(`-su')
+  appdomain -shell userdebug_or_eng(`-su') -bluetooth
 }:process { transition dyntransition };
 
 # Minimize read access to shell- or app-writable symlinks.