diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index df14019..78c1b86 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -180,6 +180,7 @@
 neverallow all_untrusted_apps {
   default_android_hwservice
   hal_audio_hwservice
+  hal_authsecret_hwservice
   hal_bluetooth_hwservice
   hal_bootctl_hwservice
   hal_camera_hwservice
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index ae0d4e7..3a493e0 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -35,6 +35,7 @@
     exported3_default_prop
     exported3_system_prop
     fs_bpf
+    hal_authsecret_hwservice
     hal_broadcastradio_hwservice
     hal_cas_hwservice
     hal_confirmationui_hwservice
diff --git a/private/hwservice_contexts b/private/hwservice_contexts
index 96233fc..d7ffb8f 100644
--- a/private/hwservice_contexts
+++ b/private/hwservice_contexts
@@ -3,6 +3,7 @@
 android.frameworks.sensorservice::ISensorManager                u:object_r:fwk_sensor_hwservice:s0
 android.hardware.audio.effect::IEffectsFactory                  u:object_r:hal_audio_hwservice:s0
 android.hardware.audio::IDevicesFactory                         u:object_r:hal_audio_hwservice:s0
+android.hardware.authsecret::IAuthSecret                        u:object_r:hal_authsecret_hwservice:s0
 android.hardware.biometrics.fingerprint::IBiometricsFingerprint u:object_r:hal_fingerprint_hwservice:s0
 android.hardware.bluetooth::IBluetoothHci                       u:object_r:hal_bluetooth_hwservice:s0
 android.hardware.boot::IBootControl                             u:object_r:hal_bootctl_hwservice:s0
diff --git a/private/system_server.te b/private/system_server.te
index 6ba98f5..e9942ed 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -179,6 +179,7 @@
 
 # Use HALs
 hal_client_domain(system_server, hal_allocator)
+hal_client_domain(system_server, hal_authsecret)
 hal_client_domain(system_server, hal_broadcastradio)
 hal_client_domain(system_server, hal_configstore)
 hal_client_domain(system_server, hal_contexthub)