diff --git a/apex/Android.bp b/apex/Android.bp
index c06740a..bbd4aa5 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -49,10 +49,6 @@
         "fd_server",
         "vm",
         "compos_key_cmd",
-
-        // tools to create composite images
-        "mk_cdisk",
-        "mk_payload",
     ],
     prebuilts: [
         "com.android.virt.init.rc",
diff --git a/microdroid/sepolicy/system/private/virtualizationservice.te b/microdroid/sepolicy/system/private/virtualizationservice.te
index 4c6f1f9..097f0a0 100644
--- a/microdroid/sepolicy/system/private/virtualizationservice.te
+++ b/microdroid/sepolicy/system/private/virtualizationservice.te
@@ -14,9 +14,6 @@
 # When virtualizationservice execs a file with the crosvm_exec label, run it in the crosvm domain.
 domain_auto_trans(virtualizationservice, crosvm_exec, crosvm)
 
-# Let virtualizationservice exec other files (e.g. mk_cdisk) in the same domain.
-allow virtualizationservice system_file:file execute_no_trans;
-
 # Let virtualizationservice kill crosvm.
 allow virtualizationservice crosvm:process sigkill;