diff --git a/microdroid/fstab.microdroid b/microdroid/fstab.microdroid
index 6e17c3e..fd8d395 100644
--- a/microdroid/fstab.microdroid
+++ b/microdroid/fstab.microdroid
@@ -1,5 +1,4 @@
 system /system ext4 noatime,ro,errors=panic wait,first_stage_mount,logical
 vendor /vendor ext4 noatime,ro,errors=panic wait,first_stage_mount,logical
 
-# TODO(b/185767624): turn on encryption
-/dev/block/by-name/userdata /data ext4 noatime,nosuid,nodev,errors=panic latemount,wait,check,formattable
+/dev/block/by-name/userdata /data ext4 noatime,nosuid,nodev,errors=panic latemount,wait,check,formattable,fileencryption=aes-256-xts
diff --git a/microdroid/init.rc b/microdroid/init.rc
index 68024e5..074e118 100644
--- a/microdroid/init.rc
+++ b/microdroid/init.rc
@@ -12,6 +12,9 @@
 
 # Cgroups are mounted right before early-init using list from /etc/cgroups.json
 on early-init
+    # set RLIMIT_NICE to allow priorities from 19 to -20
+    setrlimit nice 40 40
+
     # in microdroid, we don't use "bootstrap" mount namespace
     # because APEXes are passed from host and are available
     # from the start. We don't need to wait till /data is ready.
@@ -96,12 +99,21 @@
     trigger early-boot
     trigger boot
 
+on early-fs
+    start vold
+
 on post-fs
     # Once everything is setup, no need to modify /.
     # The bind+remount combination allows this to work in containers.
     mount rootfs rootfs / remount bind ro nodev
 
+    start keystore2
+
 on late-fs
+    start vendor.keymint-default
+
+    exec_start wait_for_keymaster
+
     mount_all /vendor/etc/fstab.microdroid --late
 
 on post-fs-data
@@ -114,6 +126,9 @@
     # We restorecon /data in case the userdata partition has been reset.
     restorecon /data
 
+    # Make sure we have the device encryption key.
+    installkey /data
+
     mkdir /data/vendor 0771 root root encryption=Require
     mkdir /data/vendor_ce 0771 root root encryption=None
     mkdir /data/vendor_de 0771 root root encryption=None
@@ -127,6 +142,25 @@
 
     start tombstoned
 
+    # set up keystore directory structure first so that we can end early boot
+    # and start apexd
+    mkdir /data/misc 01771 system misc encryption=Require
+    mkdir /data/misc/keystore 0700 keystore keystore
+    # work around b/183668221
+    restorecon /data/misc /data/misc/keystore
+
+    # Boot level 30
+    # odsign signing keys have MAX_BOOT_LEVEL=30
+    # This is currently the earliest boot level, but we start at 30
+    # to leave room for earlier levels.
+    setprop keystore.boot_level 30
+
+    # Now that /data is mounted and we have created /data/misc/keystore,
+    # we can tell keystore to stop allowing use of early-boot keys,
+    # and access its database for the first time to support creation and
+    # use of MAX_BOOT_LEVEL keys.
+    exec - system system -- /system/bin/vdc keymaster earlyBootEnded
+
     # For security reasons, /data/local/tmp should always be empty.
     # Do not place files or directories in /data/local/tmp
     mkdir /data/local 0751 root root encryption=Require
@@ -156,3 +190,5 @@
 on property:sys.boot_completed=1
     start logd-auditctl
 
+on property:vold.decrypt=trigger_post_fs_data
+    trigger post-fs-data