diff --git a/private/art_apex_postinstall.te b/private/art_apex_postinstall.te
index 4c775e8..314fb7c 100644
--- a/private/art_apex_postinstall.te
+++ b/private/art_apex_postinstall.te
@@ -21,3 +21,16 @@
 # Script helpers.
 allow art_apex_postinstall shell_exec:file rx_file_perms;
 allow art_apex_postinstall toolbox_exec:file rx_file_perms;
+
+# Fsverity in the same domain.
+allow art_apex_postinstall system_file:file execute_no_trans;
+# Fsverity work.
+allowxperm art_apex_postinstall ota_data_file:file ioctl {
+  FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY
+};
+
+allow art_apex_postinstall kernel:key search;
+# For testing purposes, allow keys installed with su.
+userdebug_or_eng(`
+  allow art_apex_postinstall su:key search;
+')