diff --git a/private/vold.te b/private/vold.te
index 09388f1..ba5ad8c 100644
--- a/private/vold.te
+++ b/private/vold.te
@@ -35,6 +35,7 @@
 # Vold will use Keystore instead of using Keymint directly. But it still needs
 # to manage its Keymint blobs. This is why it needs the `manage_blob` permission.
 allow vold vold_key:keystore2_key {
+    convert_storage_key_to_ephemeral
     delete
     get_info
     manage_blob