diff --git a/dex2oat.te b/dex2oat.te
index 164e89c4df63f58defea107f0b5ad921639a41a3..2df9947ddf3cecba75b2ff80bd2793d2ef8a8b5e 100644
--- a/dex2oat.te
+++ b/dex2oat.te
@@ -6,4 +6,7 @@ allow dex2oat dalvikcache_data_file:file write;
 allow dex2oat installd:fd use;
 
 # Read already open asec_apk_file file descriptors passed by installd.
+# Also allow reading unlabeled files, to allow for upgrading forward
+# locked APKs.
 allow dex2oat asec_apk_file:file read;
+allow dex2oat unlabeled:file read;