diff --git a/private/domain.te b/private/domain.te
index 5d8d960..b91d36d 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -359,7 +359,7 @@
 neverallow {
     domain
     -apexd
-    recovery_only(`userdebug_or_eng(`-fastbootd')')
+    recovery_only(`-fastbootd')
     -init
     -kernel
     -otapreopt_chroot
diff --git a/private/fastbootd.te b/private/fastbootd.te
index 98eb23c..0174faa 100644
--- a/private/fastbootd.te
+++ b/private/fastbootd.te
@@ -38,4 +38,7 @@
 
   # Get fastbootd protocol property
   get_prop(fastbootd, fastbootd_protocol_prop)
+
+  # Mount /metadata to interact with Virtual A/B snapshots.
+  allow fastbootd labeledfs:filesystem { mount unmount };
 ')