diff --git a/authfs/service/src/authfs.rs b/authfs/service/src/authfs.rs
index 5b41244..3b4febb 100644
--- a/authfs/service/src/authfs.rs
+++ b/authfs/service/src/authfs.rs
@@ -123,6 +123,8 @@
     debuggable: bool,
 ) -> Result<SharedChild> {
     let mut args = vec![mountpoint.to_owned(), OsString::from("--cid=2")];
+    args.push(OsString::from("-o"));
+    args.push(OsString::from("fscontext=u:object_r:authfs_fuse:s0"));
     for conf in in_fds {
         // TODO(b/185178698): Many input files need to be signed and verified.
         // or can we use debug cert for now, which is better than nothing?
diff --git a/authfs/service/src/main.rs b/authfs/service/src/main.rs
index 0ba19cb..e426734 100644
--- a/authfs/service/src/main.rs
+++ b/authfs/service/src/main.rs
@@ -40,8 +40,7 @@
 };
 
 const SERVICE_NAME: &str = "authfs_service";
-// TODO: Replace with a valid directory setup in the VM.
-const SERVICE_ROOT: &str = "/data/local/tmp/authfs";
+const SERVICE_ROOT: &str = "/data/misc/authfs";
 
 /// Implementation of `IAuthFsService`.
 pub struct AuthFsService {