diff --git a/rootdir/init.rc b/rootdir/init.rc
index 9fad0ed..452758c 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -227,6 +227,8 @@
     mkdir /cache/lost+found 0770 root root
 
 on post-fs-data
+    installkey /data
+
     # We chown/chmod /data again so because mount is run as root + defaults
     chown system system /data
     chmod 0771 /data
@@ -308,6 +310,14 @@
     # Separate location for storing security policy files on data
     mkdir /data/security 0711 system system
 
+    # Create all remaining /data root dirs so that they are made through init
+    # and get proper encryption policy installed
+    mkdir /data/backup 0700 system system
+    mkdir /data/media 0770 media_rw media_rw
+    mkdir /data/ss 0700 system system
+    mkdir /data/system 0775 system system
+    mkdir /data/user 0711 system system
+
     # Reload policy from /data/security if present.
     setprop selinux.reload_policy 1
 
@@ -443,6 +453,7 @@
     class_start main
 
 on property:vold.decrypt=trigger_restart_framework
+    installkey /data
     class_start main
     class_start late_start