diff --git a/private/compat/32.0/32.0.ignore.cil b/private/compat/32.0/32.0.ignore.cil
index 4dfb304..af48421 100644
--- a/private/compat/32.0/32.0.ignore.cil
+++ b/private/compat/32.0/32.0.ignore.cil
@@ -9,6 +9,7 @@
     artd_service
     attestation_verification_service
     charger_vendor
+    cloudsearch_service
     device_config_nnapi_native_prop
     dice_maintenance_service
     dice_node_service
diff --git a/private/composd.te b/private/composd.te
index 88c4e4a..5b8f586 100644
--- a/private/composd.te
+++ b/private/composd.te
@@ -13,16 +13,19 @@
 # Start a VM
 virtualizationservice_use(composd)
 
-# Allow preparing staging directory for odrefresh
+# Prepare staging directory for odrefresh
 allow composd apex_art_data_file:dir { create_dir_perms relabelfrom };
 allow composd apex_art_staging_data_file:dir { create_dir_perms relabelto };
 
+# Delete files in the odrefresh target directory
+allow composd apex_art_data_file:file unlink;
+
 # Access our APEX data files
 allow composd apex_module_data_file:dir search;
 allow composd apex_compos_data_file:dir create_dir_perms;
 allow composd apex_compos_data_file:file create_file_perms;
 
-# TODO(b/209008712): Removed these when we run odrefresh in the VM
+# TODO(b/209008712): Remove these when we run odrefresh in the VM
 # Run odrefresh to refresh ART artifacts, and kill it if we need to
 domain_auto_trans(composd, odrefresh_exec, odrefresh)
 allow composd odrefresh:process sigkill;
@@ -33,3 +36,6 @@
 
 # Read ART's properties
 get_prop(composd, dalvik_config_prop)
+
+# We never create any artifact files directly
+neverallow composd apex_art_data_file:file ~unlink;
diff --git a/private/domain.te b/private/domain.te
index 7fedd6f..c580cae 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -304,7 +304,8 @@
 # contains boot class path and system server AOT artifacts following an ART APEX Mainline update.
 neverallow {
   domain
-  # art processes
+  # art-related processes
+  -composd
   -compos_fd_server
   -odrefresh
   -odsign
@@ -317,10 +318,10 @@
 neverallow {
   domain
   # art-related processes
+  -composd
   -compos_fd_server
   -odrefresh
   -odsign
-  -composd  # TODO: Remove
   # others
   -apexd
   -init
diff --git a/private/service_contexts b/private/service_contexts
index 2246f6e..7538aec 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -111,6 +111,7 @@
 cacheinfo                                 u:object_r:cacheinfo_service:s0
 carrier_config                            u:object_r:radio_service:s0
 clipboard                                 u:object_r:clipboard_service:s0
+cloudsearch_service                       u:object_r:cloudsearch_service:s0
 com.android.net.IProxyService             u:object_r:IProxyService_service:s0
 companiondevice                           u:object_r:companion_device_service:s0
 communal                                  u:object_r:communal_service:s0
diff --git a/private/zygote.te b/private/zygote.te
index 8e2b15a..ea983fd 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -112,7 +112,7 @@
 
 # Control cgroups.
 allow zygote cgroup:dir create_dir_perms;
-allow zygote cgroup:{ file lnk_file } r_file_perms;
+allow zygote cgroup:{ file lnk_file } { r_file_perms setattr };
 allow zygote cgroup_v2:dir create_dir_perms;
 allow zygote cgroup_v2:{ file lnk_file } { r_file_perms setattr };
 allow zygote self:global_capability_class_set sys_admin;
diff --git a/public/service.te b/public/service.te
index 1598ab3..58f596e 100644
--- a/public/service.te
+++ b/public/service.te
@@ -80,6 +80,7 @@
 type cacheinfo_service, system_api_service, system_server_service, service_manager_type;
 type cameraproxy_service, system_server_service, service_manager_type;
 type clipboard_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type cloudsearch_service, app_api_service, system_server_service, service_manager_type;
 type contexthub_service, app_api_service,  system_server_service, service_manager_type;
 type crossprofileapps_service, app_api_service, system_server_service, service_manager_type;
 type IProxyService_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;