diff --git a/rootdir/init.rc b/rootdir/init.rc
index 51246fb..e28af4d 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -391,11 +391,15 @@
     setprop net.tcp.buffersize.evdo     4094,87380,262144,4096,16384,262144
 
     class_start core
-    class_start main
 
 on nonencrypted
+    class_start main
     class_start late_start
 
+on property:vold.decrypt=trigger_default_encryption
+    start surfaceflinger
+    start defaultcrypto
+
 on charger
     class_start charger
 
@@ -529,6 +533,13 @@
     group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc mediadrm
     ioprio rt 4
 
+# One shot invocation to deal with encrypted volume.
+service defaultcrypto /system/bin/vdc --wait cryptfs mountdefaultencrypted
+    disabled
+    oneshot
+    # vold will set vold.decrypt to trigger_restart_framework (default
+    # encryption) or trigger_restart_min_framework (other encryption)
+
 service bootanim /system/bin/bootanimation
     class main
     user graphics