diff --git a/authfs/service/Android.bp b/authfs/service/Android.bp
index 3f3a0c3..943db35 100644
--- a/authfs/service/Android.bp
+++ b/authfs/service/Android.bp
@@ -19,4 +19,5 @@
         "libshared_child",
     ],
     prefer_rlib: true,
+    init_rc: ["authfs_service.rc"],
 }
diff --git a/authfs/service/authfs_service.rc b/authfs/service/authfs_service.rc
new file mode 100644
index 0000000..9ad0ce6
--- /dev/null
+++ b/authfs/service/authfs_service.rc
@@ -0,0 +1,2 @@
+service authfs_service /system/bin/authfs_service
+    disabled
diff --git a/authfs/service/src/authfs.rs b/authfs/service/src/authfs.rs
index 5b41244..3b4febb 100644
--- a/authfs/service/src/authfs.rs
+++ b/authfs/service/src/authfs.rs
@@ -123,6 +123,8 @@
     debuggable: bool,
 ) -> Result<SharedChild> {
     let mut args = vec![mountpoint.to_owned(), OsString::from("--cid=2")];
+    args.push(OsString::from("-o"));
+    args.push(OsString::from("fscontext=u:object_r:authfs_fuse:s0"));
     for conf in in_fds {
         // TODO(b/185178698): Many input files need to be signed and verified.
         // or can we use debug cert for now, which is better than nothing?
diff --git a/authfs/service/src/main.rs b/authfs/service/src/main.rs
index 0ba19cb..e426734 100644
--- a/authfs/service/src/main.rs
+++ b/authfs/service/src/main.rs
@@ -40,8 +40,7 @@
 };
 
 const SERVICE_NAME: &str = "authfs_service";
-// TODO: Replace with a valid directory setup in the VM.
-const SERVICE_ROOT: &str = "/data/local/tmp/authfs";
+const SERVICE_ROOT: &str = "/data/misc/authfs";
 
 /// Implementation of `IAuthFsService`.
 pub struct AuthFsService {
diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index a0215c3..4926e2c 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -111,6 +111,7 @@
             deps: [
                 "apkdmverity",
                 "authfs",
+                "authfs_service",
                 "zipfuse",
 
                 // TODO(b/184872979): Needed by authfs. Remove once the Rust API is created.
diff --git a/microdroid/init.rc b/microdroid/init.rc
index d43ab22..f9cd915 100644
--- a/microdroid/init.rc
+++ b/microdroid/init.rc
@@ -136,6 +136,9 @@
 
     start keystore2
 
+    mkdir /data/misc/authfs 0700 root root
+    start authfs_service
+
 on late-fs
     start vendor.keymint-microdroid