diff --git a/private/system_server.te b/private/system_server.te
index c0c7c16..7d26410 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -891,6 +891,15 @@
 	use
 };
 
+# Allow lock_settings service to manage RoR keys.
+allow system_server resume_on_reboot_key:keystore2_key {
+	delete
+	get_info
+	rebind
+	update
+	use
+};
+
 # Allow system server to search and write to the persistent factory reset
 # protection partition. This block device does not get wiped in a factory reset.
 allow system_server block_device:dir search;