diff --git a/Android.mk b/Android.mk
index 2b529a5fc81d4fdee39ca3d2201d722858ca258a..8bf461de87d55fcbebec9932b6681b6183de8050 100644
--- a/Android.mk
+++ b/Android.mk
@@ -11,11 +11,11 @@ include $(CLEAR_VARS)
 # is frozen, we should flip this to true. This forces any currently
 # permissive domains into unconfined+enforcing.
 #
-FORCE_PERMISSIVE_TO_UNCONFINED:=false
+FORCE_PERMISSIVE_TO_UNCONFINED ?= false
 
 ifeq ($(TARGET_BUILD_VARIANT),user)
   # User builds are always forced unconfined+enforcing
-  FORCE_PERMISSIVE_TO_UNCONFINED:=true
+  FORCE_PERMISSIVE_TO_UNCONFINED := true
 endif
 
 # SELinux policy version.