diff --git a/recovery.te b/recovery.te
index 41038c8114c82a23c2c5181ba9b6232f145db759..3efae4ec6046f317641ffa6c3c05072f0c52b7c7 100644
--- a/recovery.te
+++ b/recovery.te
@@ -8,7 +8,7 @@ type recovery, domain;
 # Otherwise recovery is only allowed the domain rules.
 recovery_only(`
   allow recovery rootfs:file entrypoint;
-  unconfined_domain(recovery)
+  permissive_or_unconfined(recovery)
 
   # Set security contexts on files that are not known to the loaded policy.
   allow recovery self:capability2 mac_admin;