diff --git a/private/domain.te b/private/domain.te
index 61e2ea6..c92830f 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -2235,3 +2235,6 @@
 # Only init/vendor are allowed to write sysfs_pgsize_migration;
 # ueventd needs write access to all sysfs files.
 neverallow { domain -init -vendor_init -ueventd } sysfs_pgsize_migration:file no_w_file_perms;
+
+# We need to be able to rely on vsock labels, so disallow changing them.
+neverallow domain *:vsock_socket { relabelfrom relabelto };