diff --git a/private/system_app.te b/private/system_app.te
index 4ed1982..245496f 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -70,6 +70,7 @@
 # TODO: scope this down? Too broad?
 allow system_app {
   service_manager_type
+  -apex_service
   -dumpstate_service
   -installd_service
   -netd_service