diff --git a/private/adbd.te b/private/adbd.te
index 6ffe9b6..2c62565 100644
--- a/private/adbd.te
+++ b/private/adbd.te
@@ -87,8 +87,9 @@
 get_prop(adbd, ffs_config_prop)
 set_prop(adbd, ffs_control_prop)
 
-# Set service.adb.tls.port, persist.adb.wifi. properties
+# Set service.adb.tcp.port, service.adb.tls.port, persist.adb.wifi.* properties
 set_prop(adbd, adbd_prop)
+set_prop(adbd, adbd_config_prop)
 
 # Allow adbd start/stop mdnsd via ctl.start
 set_prop(adbd, ctl_mdnsd_prop)
@@ -105,9 +106,6 @@
 # Read persist.adb.tls_server.enable property
 get_prop(adbd, system_adbd_prop)
 
-# Read service.adb.tcp.port property
-get_prop(adbd, adbd_config_prop)
-
 # Read device's overlayfs related properties and files
 userdebug_or_eng(`
   get_prop(adbd, persistent_properties_ready_prop)
diff --git a/private/property.te b/private/property.te
index bf73c3d..53f4284 100644
--- a/private/property.te
+++ b/private/property.te
@@ -322,6 +322,16 @@
   system_adbd_prop
 }:property_service set;
 
+# Let (vendor_)init, adbd, and system_server set service.adb.tcp.port
+neverallow {
+  -init
+  -vendor_init
+  -adbd
+  -system_server
+} {
+  adbd_config_prop
+}:property_service set;
+
 neverallow {
   # Only allow init and adbd to set adbd_prop
   -init
diff --git a/private/vendor_init.te b/private/vendor_init.te
index 6a68f1f..83f001d 100644
--- a/private/vendor_init.te
+++ b/private/vendor_init.te
@@ -5,3 +5,6 @@
 
 # TODO(b/140259336) We want to remove vendor_init in the long term but allow for now
 allow vendor_init system_data_root_file:dir rw_dir_perms;
+
+# Let vendor_init set service.adb.tcp.port.
+set_prop(vendor_init, adbd_config_prop)