diff --git a/private/access_vectors b/private/access_vectors
index c1c0359..fdac890 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -731,6 +731,7 @@
 
 class keystore2_key
 {
+	convert_storage_key_to_ephemeral
 	delete
 	gen_unique_id
 	get_info
diff --git a/private/vold.te b/private/vold.te
index 09388f1..ba5ad8c 100644
--- a/private/vold.te
+++ b/private/vold.te
@@ -35,6 +35,7 @@
 # Vold will use Keystore instead of using Keymint directly. But it still needs
 # to manage its Keymint blobs. This is why it needs the `manage_blob` permission.
 allow vold vold_key:keystore2_key {
+    convert_storage_key_to_ephemeral
     delete
     get_info
     manage_blob