diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index 2f0a252..c26b2ed 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -29,6 +29,7 @@
     blank_screen_tmpfs
     boot_status_prop
     bootloader_boot_reason_prop
+    bootloader_prop
     bluetooth_a2dp_offload_prop
     bpfloader
     bpfloader_exec
diff --git a/private/compat/30.0/30.0.cil b/private/compat/30.0/30.0.cil
index 6a6348a..7f96179 100644
--- a/private/compat/30.0/30.0.cil
+++ b/private/compat/30.0/30.0.cil
@@ -1348,6 +1348,7 @@
 (typeattributeset exported2_default_prop_30_0
   ( exported2_default_prop
     aac_drc_prop
+    bootloader_prop
     build_prop
     init_service_status_prop
     libc_debug_prop))
diff --git a/private/init.te b/private/init.te
index 49a98e0..453e8a4 100644
--- a/private/init.te
+++ b/private/init.te
@@ -63,3 +63,6 @@
 # Only init can write vts.native_server.on
 set_prop(init, vts_status_prop)
 neverallow { -init } vts_status_prop:property_service set;
+
+# Only init can write normal ro.boot. properties
+neverallow { -init } bootloader_prop:property_service set;
diff --git a/private/property_contexts b/private/property_contexts
index de1e085..736826a 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -192,8 +192,6 @@
 persist.odm.            u:object_r:vendor_default_prop:s0
 persist.vendor.         u:object_r:vendor_default_prop:s0
 vendor.                 u:object_r:vendor_default_prop:s0
-# ro.boot. properties are set based on kernel commandline arguments, which are vendor owned.
-ro.boot.                u:object_r:exported2_default_prop:s0
 
 # Properties that relate to time / time zone detection behavior.
 persist.time.           u:object_r:time_prop:s0
@@ -545,20 +543,24 @@
 
 ro.baseband u:object_r:exported2_default_prop:s0 exact string
 
-ro.boot.avb_version                 u:object_r:exported2_default_prop:s0 exact string
-ro.boot.baseband                    u:object_r:exported2_default_prop:s0 exact string
-ro.boot.bootdevice                  u:object_r:exported2_default_prop:s0 exact string
-ro.boot.bootloader                  u:object_r:exported2_default_prop:s0 exact string
-ro.boot.boottime                    u:object_r:exported2_default_prop:s0 exact string
-ro.boot.console                     u:object_r:exported2_default_prop:s0 exact string
-ro.boot.hardware                    u:object_r:exported2_default_prop:s0 exact string
-ro.boot.hardware.color              u:object_r:exported2_default_prop:s0 exact string
-ro.boot.hardware.sku                u:object_r:exported2_default_prop:s0 exact string
-ro.boot.keymaster                   u:object_r:exported2_default_prop:s0 exact string
-ro.boot.mode                        u:object_r:exported2_default_prop:s0 exact string
-ro.boot.vbmeta.avb_version          u:object_r:exported2_default_prop:s0 exact string
-ro.boot.verifiedbootstate           u:object_r:exported2_default_prop:s0 exact string
-ro.boot.veritymode                  u:object_r:exported2_default_prop:s0 exact string
+# ro.boot. properties are set based on kernel commandline arguments, which are vendor owned.
+ro.boot.                   u:object_r:bootloader_prop:s0
+ro.boot.avb_version        u:object_r:bootloader_prop:s0 exact string
+ro.boot.baseband           u:object_r:bootloader_prop:s0 exact string
+ro.boot.bootdevice         u:object_r:bootloader_prop:s0 exact string
+ro.boot.bootloader         u:object_r:bootloader_prop:s0 exact string
+ro.boot.boottime           u:object_r:bootloader_prop:s0 exact string
+ro.boot.console            u:object_r:bootloader_prop:s0 exact string
+ro.boot.hardware           u:object_r:bootloader_prop:s0 exact string
+ro.boot.hardware.color     u:object_r:bootloader_prop:s0 exact string
+ro.boot.hardware.sku       u:object_r:bootloader_prop:s0 exact string
+ro.boot.keymaster          u:object_r:bootloader_prop:s0 exact string
+ro.boot.mode               u:object_r:bootloader_prop:s0 exact string
+ro.boot.revision           u:object_r:bootloader_prop:s0 exact string
+ro.boot.vbmeta.avb_version u:object_r:bootloader_prop:s0 exact string
+ro.boot.verifiedbootstate  u:object_r:bootloader_prop:s0 exact string
+ro.boot.veritymode         u:object_r:bootloader_prop:s0 exact string
+
 ro.boot.dynamic_partitions          u:object_r:exported_default_prop:s0 exact string
 ro.boot.dynamic_partitions_retrofit u:object_r:exported_default_prop:s0 exact string
 
@@ -774,8 +776,6 @@
 init.userspace_reboot.userdata_remount.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
 init.userspace_reboot.watchdog.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
 
-ro.boot.revision u:object_r:exported2_default_prop:s0 exact string
-
 ro.bootmode u:object_r:exported2_default_prop:s0 exact string
 
 sys.shutdown.requested u:object_r:exported_system_prop:s0 exact string
diff --git a/public/domain.te b/public/domain.te
index a390cb3..d0d01b1 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -95,6 +95,7 @@
 
 # Public readable properties
 get_prop(domain, aaudio_config_prop)
+get_prop(domain, bootloader_prop)
 get_prop(domain, build_odm_prop)
 get_prop(domain, build_prop)
 get_prop(domain, build_vendor_prop)
diff --git a/public/property.te b/public/property.te
index 0dfbefe..5e7ac63 100644
--- a/public/property.te
+++ b/public/property.te
@@ -59,6 +59,7 @@
 system_restricted_prop(binder_cache_system_server_prop)
 system_restricted_prop(binder_cache_telephony_server_prop)
 system_restricted_prop(boot_status_prop)
+system_restricted_prop(bootloader_prop)
 system_restricted_prop(bq_config_prop)
 system_restricted_prop(build_prop)
 system_restricted_prop(charger_status_prop)