diff --git a/private/dexopt_chroot_setup.te b/private/dexopt_chroot_setup.te
index 5dd0e5d..ede53d4 100644
--- a/private/dexopt_chroot_setup.te
+++ b/private/dexopt_chroot_setup.te
@@ -43,6 +43,7 @@
 # Allow mounting file systems, to create a chroot environment.
 allow dexopt_chroot_setup {
   apex_mnt_dir
+  apk_data_file
   binderfs
   cgroup
   cgroup_v2
@@ -119,6 +120,9 @@
 # Allow running snapshotctl through init, to map and unmap block devices.
 set_prop(dexopt_chroot_setup, snapshotctl_prop)
 
+# Allow accessing /data/app/..., to bind-mount dirs for incremental apps.
+allow dexopt_chroot_setup apk_data_file:dir { getattr search };
+
 # Neverallow rules.
 
 # Never allow running other binaries without a domain transition.