diff --git a/microdroid/init.rc b/microdroid/init.rc
index 043577d..d43ab22 100644
--- a/microdroid/init.rc
+++ b/microdroid/init.rc
@@ -117,17 +117,9 @@
     # The bind+remount combination allows this to work in containers.
     mount rootfs rootfs / remount bind ro nodev
 
-    start keystore2
-
-on late-fs
-    start vendor.keymint-microdroid
-
     # TODO(b/185767624): change the hard-coded size?
     mount tmpfs tmpfs /data noatime nosuid nodev rw size=128M
 
-on post-fs-data
-    mark_post_data
-
     # We chown/chmod /data again so because mount is run as root + defaults
     chown system system /data
     chmod 0771 /data
@@ -135,6 +127,21 @@
     # We restorecon /data in case the userdata partition has been reset.
     restorecon /data
 
+    # set up keystore directory structure first so that we can end early boot
+    # and start apexd
+    mkdir /data/misc 01771 system misc
+    mkdir /data/misc/keystore 0700 keystore keystore
+    # work around b/183668221
+    restorecon /data/misc /data/misc/keystore
+
+    start keystore2
+
+on late-fs
+    start vendor.keymint-microdroid
+
+on post-fs-data
+    mark_post_data
+
     mkdir /data/vendor 0771 root root
     mkdir /data/vendor_ce 0771 root root
     mkdir /data/vendor_de 0771 root root
@@ -148,13 +155,6 @@
 
     start tombstoned
 
-    # set up keystore directory structure first so that we can end early boot
-    # and start apexd
-    mkdir /data/misc 01771 system misc
-    mkdir /data/misc/keystore 0700 keystore keystore
-    # work around b/183668221
-    restorecon /data/misc /data/misc/keystore
-
     # Boot level 30
     # odsign signing keys have MAX_BOOT_LEVEL=30
     # This is currently the earliest boot level, but we start at 30