diff --git a/compos/apex/composd.rc b/compos/apex/composd.rc
index 3e2efb1..df04642 100644
--- a/compos/apex/composd.rc
+++ b/compos/apex/composd.rc
@@ -19,3 +19,10 @@
     interface aidl android.system.composd
     disabled
     oneshot
+    # Explicitly specify empty capabilities, otherwise composd will inherit all
+    # the capabilities from init.
+    # Note: whether a process can use capabilities is controlled by SELinux, so
+    # inheriting all the capabilities from init is not a security issue.
+    # However, for defense-in-depth and just for the sake of bookkeeping it's
+    # better to explicitly state that composd doesn't need any capabilities.
+    capabilities