diff --git a/keystore2/src/legacy_importer.rs b/keystore2/src/legacy_importer.rs
index 24f3263..0d8dc4a 100644
--- a/keystore2/src/legacy_importer.rs
+++ b/keystore2/src/legacy_importer.rs
@@ -786,7 +786,7 @@
                 .context(ks_err!("Trying to load legacy blob."))?;
 
             // Determine if the key needs special handling to be deleted.
-            let (need_gc, is_super_encrypted) = km_blob_params
+            let (need_gc, is_super_encrypted, is_de_critical) = km_blob_params
                 .as_ref()
                 .map(|(blob, params)| {
                     let params = match params {
@@ -798,13 +798,18 @@
                             KeyParameterValue::RollbackResistance == *kp.key_parameter_value()
                         }),
                         blob.is_encrypted(),
+                        blob.is_critical_to_device_encryption(),
                     )
                 })
-                .unwrap_or((false, false));
+                .unwrap_or((false, false, false));
 
             if keep_non_super_encrypted_keys && !is_super_encrypted {
                 continue;
             }
+            if uid == rustutils::users::AID_SYSTEM && is_de_critical {
+                log::info!("skip deletion of system key '{alias}' which is DE-critical");
+                continue;
+            }
 
             if need_gc {
                 let mark_deleted = match km_blob_params