diff --git a/access_vectors b/access_vectors
index 65b7e2226a9bb0d220661603062d507ad3c8fbf7..e79ad1b80e87d8d06da32d303684777da4eb0410 100644
--- a/access_vectors
+++ b/access_vectors
@@ -910,6 +910,7 @@ class keystore_key
 	sync_uid
 	password_uid
 	add_auth
+	user_changed
 }
 
 class debuggerd
diff --git a/system_app.te b/system_app.te
index 407b85e7de9f4b8309a8cd3dd2fdf07afb1e0327..811f4367be1c2fcd1feec98ffb3e7f7b45ef51cf 100644
--- a/system_app.te
+++ b/system_app.te
@@ -73,6 +73,7 @@ allow system_app keystore:keystore_key {
 	grant
 	duplicate
 	clear_uid
+	user_changed
 };
 
 control_logd(system_app)
diff --git a/system_server.te b/system_server.te
index fb163970c0334d0df0880f9e6116b1814b579656..7eb3dd3857dca9d36e60906d483197ab71e52e19 100644
--- a/system_server.te
+++ b/system_server.te
@@ -401,6 +401,7 @@ allow system_server keystore:keystore_key {
 	sync_uid
 	password_uid
 	add_auth
+	user_changed
 };
 
 # Allow system server to search and write to the persistent factory reset