diff --git a/private/init.te b/private/init.te
index 02d45a1..ca32e6f 100644
--- a/private/init.te
+++ b/private/init.te
@@ -79,3 +79,6 @@
 
 # Only init can write ro.property_service.version
 neverallow { -init } property_service_version_prop:property_service set;
+
+# Only init can set keystore.boot_level
+neverallow { -init } keystore_listen_prop:property_service set;