diff --git a/installd.te b/installd.te
index ebd759174821d69e55668209bda569c207929e5a..ab0aadcd1c42a53ac1a332ba90343c2a5371bc6d 100644
--- a/installd.te
+++ b/installd.te
@@ -72,11 +72,6 @@ domain_auto_trans(installd, profman_exec, profman)
 # Run idmap in its own sandbox.
 domain_auto_trans(installd, idmap_exec, idmap)
 
-# Run otapreopt in its own sandbox.
-domain_auto_trans(installd, otapreopt_chroot_exec, otapreopt_chroot)
-# otapreopt_chroot will transition into postinstall_dexopt, which will spawn a child.
-allow installd postinstall_dexopt:process sigchld;
-
 # Upgrade from unlabeled userdata.
 # Just need enough to remove and/or relabel it.
 allow installd unlabeled:dir { getattr search relabelfrom rw_dir_perms rmdir };
diff --git a/otapreopt_chroot.te b/otapreopt_chroot.te
index b3f8807b0d2167f9a226ce05ee890d6224babc62..3f426709c86ca5ccdf91f733bfe189103ec8dfc2 100644
--- a/otapreopt_chroot.te
+++ b/otapreopt_chroot.te
@@ -10,5 +10,8 @@ allow otapreopt_chroot self:capability { sys_admin sys_chroot };
 # Allow to transition to postinstall_ota, to run otapreopt in its own sandbox.
 domain_auto_trans(otapreopt_chroot, postinstall_file, postinstall_dexopt)
 
-# Allow otapreopt to use file descriptors from installd.
-allow otapreopt_chroot installd:fd use;
+# Allow otapreopt to use file descriptors from update-engine. It will
+# close them immediately.
+allow otapreopt_chroot postinstall:fd use;
+allow otapreopt_chroot update_engine:fd use;
+allow otapreopt_chroot update_engine:fifo_file write;
diff --git a/postinstall.te b/postinstall.te
index 5c261efe96ae53a152dd74f25cb9f360d9db511b..0560606c75015f12b89794e2dde356502ce2c823 100644
--- a/postinstall.te
+++ b/postinstall.te
@@ -32,4 +32,6 @@ binder_use(postinstall)
 binder_call(postinstall, system_server)
 
 # Need to talk to the otadexopt service.
-allow postinstall otadexopt_service:service_manager find;
\ No newline at end of file
+allow postinstall otadexopt_service:service_manager find;
+
+domain_auto_trans(postinstall, otapreopt_chroot_exec, otapreopt_chroot)
diff --git a/postinstall_dexopt.te b/postinstall_dexopt.te
index 1a236fc6eaee2e761220e83649d28db92f2b37df..c5b2533a19e2df85fc9f4e94ef37749f2e09fb0b 100644
--- a/postinstall_dexopt.te
+++ b/postinstall_dexopt.te
@@ -49,8 +49,8 @@ selinux_check_access(postinstall_dexopt)
 # We have to manually transition, as we don't have an entrypoint.
 domain_auto_trans(postinstall_dexopt, postinstall_file, dex2oat)
 
-# installd wants to know about our child.
-allow postinstall_dexopt installd:process sigchld;
+# Postinstall wants to know about our child.
+allow postinstall_dexopt postinstall:process sigchld;
 
 # Allow otapreopt to use file descriptors from otapreopt_chroot.
 # TODO: Probably we can actually close file descriptors...