diff --git a/private/app.te b/private/app.te
index c635aed..710b94d 100644
--- a/private/app.te
+++ b/private/app.te
@@ -71,6 +71,9 @@
 allow appdomain { apex_art_data_file apex_module_data_file }:dir search;
 allow appdomain apex_art_data_file:file r_file_perms;
 
+# Allow APFE device info to read Virtual A/B props.
+get_prop(appdomain, virtual_ab_prop)
+
 # Sensitive app domains are not allowed to execute from /data
 # to prevent persistence attacks and ensure all code is executed
 # from read-only locations.
@@ -88,3 +91,4 @@
   -system_data_file # shared libs in apks
   -apk_data_file
 }:file no_x_file_perms;
+
diff --git a/private/compat/30.0/30.0.ignore.cil b/private/compat/30.0/30.0.ignore.cil
index 6648338..e2e9633 100644
--- a/private/compat/30.0/30.0.ignore.cil
+++ b/private/compat/30.0/30.0.ignore.cil
@@ -21,6 +21,7 @@
     debugfs_kprobes
     debugfs_mm_events_tracing
     device_config_profcollect_native_boot_prop
+    device_config_connectivity_prop
     device_state_service
     dm_user_device
     dmabuf_heap_device
@@ -96,6 +97,6 @@
     userspace_reboot_metadata_file
     vcn_management_service
     vibrator_manager_service
-    vpnmanager_service
+    vpn_management_service
     watchdog_metadata_file
     zygote_config_prop))
diff --git a/private/fastbootd.te b/private/fastbootd.te
index f0ba02c..98eb23c 100644
--- a/private/fastbootd.te
+++ b/private/fastbootd.te
@@ -28,6 +28,14 @@
   allow fastbootd port:tcp_socket name_bind;
   allow fastbootd self:tcp_socket { create_socket_perms_no_ioctl listen accept };
 
+  # Start snapuserd for merging VABC updates
+  set_prop(fastbootd, ctl_snapuserd_prop)
+
+  # Needed to communicate with snapuserd to complete merges.
+  allow fastbootd snapuserd_socket:sock_file write;
+  allow fastbootd snapuserd:unix_stream_socket connectto;
+  allow fastbootd dm_user_device:dir r_dir_perms;
+
   # Get fastbootd protocol property
   get_prop(fastbootd, fastbootd_protocol_prop)
 ')
diff --git a/private/flags_health_check.te b/private/flags_health_check.te
index de5f37e..983bad6 100644
--- a/private/flags_health_check.te
+++ b/private/flags_health_check.te
@@ -17,6 +17,7 @@
 set_prop(flags_health_check, device_config_sys_traced_prop)
 set_prop(flags_health_check, device_config_window_manager_native_boot_prop)
 set_prop(flags_health_check, device_config_configuration_prop)
+set_prop(flags_health_check, device_config_connectivity_prop)
 
 # system property device_config_boot_count_prop is used for deciding when to perform server
 # configurable flags related disaster recovery. Mistakenly set up by unrelated components can, at a
diff --git a/private/keystore2_key_contexts b/private/keystore2_key_contexts
index 1c6573c..b926265 100644
--- a/private/keystore2_key_contexts
+++ b/private/keystore2_key_contexts
@@ -13,3 +13,5 @@
 # vold_key is a keystore2_key namespace for vold. It allows using raw Keymint blobs.
 100            u:object_r:vold_key:s0
 
+# odsign_key is a keystore2_key namespace for the on-device signing daemon.
+101            u:object_r:odsign_key:s0
diff --git a/private/keystore_keys.te b/private/keystore_keys.te
index cff37eb..990bc29 100644
--- a/private/keystore_keys.te
+++ b/private/keystore_keys.te
@@ -10,3 +10,6 @@
 # A keystore2 namespace for vold. Vold need special permission to handle
 # its own Keymint blobs.
 type vold_key, keystore2_key_type;
+
+# A keystore2 namespace for the on-device signing daemon.
+type odsign_key, keystore2_key_type;
diff --git a/private/network_stack.te b/private/network_stack.te
index ab5a56e..f130e80 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -44,3 +44,6 @@
 # in order to invoke side effect of close() on such a socket calling synchronize_rcu()
 # TODO: Remove this permission when 4.9 kernel is deprecated.
 allow network_stack self:key_socket create;
+
+# Grant read permission of connectivity namespace system property prefix.
+get_prop(network_stack, device_config_connectivity_prop)
diff --git a/private/odsign.te b/private/odsign.te
index b7fd1f4..b35a3ca 100644
--- a/private/odsign.te
+++ b/private/odsign.te
@@ -21,6 +21,20 @@
   FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY FS_IOC_GETFLAGS
 };
 
+# talk to binder services (for keystore)
+binder_use(odsign);
+
+# talk to keystore specifically
+use_keystore(odsign);
+
+# Use our dedicated keystore key
+allow odsign odsign_key:keystore2_key {
+    delete
+    get_info
+    rebind
+    use
+};
+
 # talk to keymaster
 hal_client_domain(odsign, hal_keymaster)
 
diff --git a/private/property.te b/private/property.te
index 0885b91..5dc75b8 100644
--- a/private/property.te
+++ b/private/property.te
@@ -8,6 +8,7 @@
 system_internal_prop(device_config_sys_traced_prop)
 system_internal_prop(device_config_window_manager_native_boot_prop)
 system_internal_prop(device_config_configuration_prop)
+system_internal_prop(device_config_connectivity_prop)
 system_internal_prop(fastbootd_protocol_prop)
 system_internal_prop(gsid_prop)
 system_internal_prop(init_perf_lsm_hooks_prop)
diff --git a/private/property_contexts b/private/property_contexts
index 5b832dc..8778016 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -221,6 +221,7 @@
 persist.device_config.activity_manager_native_boot. u:object_r:device_config_activity_manager_native_boot_prop:s0
 persist.device_config.attempted_boot_count          u:object_r:device_config_boot_count_prop:s0
 persist.device_config.configuration.                u:object_r:device_config_configuration_prop:s0
+persist.device_config.connectivity.                 u:object_r:device_config_connectivity_prop:s0
 persist.device_config.input_native_boot.            u:object_r:device_config_input_native_boot_prop:s0
 persist.device_config.media_native.                 u:object_r:device_config_media_native_prop:s0
 persist.device_config.netd_native.                  u:object_r:device_config_netd_native_prop:s0
@@ -1059,8 +1060,8 @@
 ro.zygote.disable_gl_preload u:object_r:zygote_config_prop:s0 exact bool
 
 # Enable Keystore 2.0.
-# TODO remove this propertye when Keystore 2.0 migration is complete b/171563717
-ro.android.security.keystore2.enable    u:object_r:keystore2_enable_prop:s0 exact bool
+# TODO remove this property when Keystore 2.0 migration is complete b/171563717
+persist.android.security.keystore2.enable    u:object_r:keystore2_enable_prop:s0 exact bool
 
 partition.system.verified     u:object_r:verity_status_prop:s0 exact string
 partition.system_ext.verified u:object_r:verity_status_prop:s0 exact string
diff --git a/private/recovery.te b/private/recovery.te
index 207dfb6..00d7132 100644
--- a/private/recovery.te
+++ b/private/recovery.te
@@ -31,6 +31,14 @@
   allow recovery self:tcp_socket { create ioctl };
   allowxperm recovery self:tcp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
 
+  # Start snapuserd for merging VABC updates
+  set_prop(recovery, ctl_snapuserd_prop)
+
+  # Needed to communicate with snapuserd to complete merges.
+  allow recovery snapuserd_socket:sock_file write;
+  allow recovery snapuserd:unix_stream_socket connectto;
+  allow recovery dm_user_device:dir r_dir_perms;
+
   # Set fastbootd protocol property
   set_prop(recovery, fastbootd_protocol_prop)
 
diff --git a/private/service.te b/private/service.te
index 821b740..7f692f3 100644
--- a/private/service.te
+++ b/private/service.te
@@ -8,4 +8,5 @@
 type stats_service,                 service_manager_type;
 type statscompanion_service,        system_server_service, service_manager_type;
 type statsmanager_service,          system_api_service, system_server_service, service_manager_type;
+type tracingproxy_service,          system_server_service, service_manager_type;
 type uce_service,                   service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 3eee0d5..ed457ee 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -259,6 +259,7 @@
 time_zone_detector                        u:object_r:timezonedetector_service:s0
 timezone                                  u:object_r:timezone_service:s0
 thermalservice                            u:object_r:thermal_service:s0
+tracing.proxy                             u:object_r:tracingproxy_service:s0
 transformer                               u:object_r:transformer_service:s0
 trust                                     u:object_r:trust_service:s0
 tv_input                                  u:object_r:tv_input_service:s0
@@ -276,7 +277,7 @@
 virtual_touchpad                          u:object_r:virtual_touchpad_service:s0
 voiceinteraction                          u:object_r:voiceinteraction_service:s0
 vold                                      u:object_r:vold_service:s0
-vpnmanager                                u:object_r:vpnmanager_service:s0
+vpn_management                            u:object_r:vpn_management_service:s0
 vr_hwc                                    u:object_r:vr_hwc_service:s0
 vrflinger_vsync                           u:object_r:vrflinger_vsync_service:s0
 vrmanager                                 u:object_r:vr_manager_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index abfafa9..65a5e1e 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -529,6 +529,9 @@
 allow system_server tombstone_data_file:dir r_dir_perms;
 allow system_server tombstone_data_file:file r_file_perms;
 
+# Allow write access to be able to truncate tombstones.
+allow system_server tombstone_data_file:file write;
+
 # Manage /data/misc/vpn.
 allow system_server vpn_data_file:dir create_dir_perms;
 allow system_server vpn_data_file:file create_file_perms;
@@ -664,6 +667,7 @@
 set_prop(system_server, device_config_sys_traced_prop)
 set_prop(system_server, device_config_window_manager_native_boot_prop)
 set_prop(system_server, device_config_configuration_prop)
+set_prop(system_server, device_config_connectivity_prop)
 
 # BootReceiver to read ro.boot.bootreason
 get_prop(system_server, bootloader_boot_reason_prop)
@@ -1113,6 +1117,7 @@
   -flags_health_check
 } {
   device_config_activity_manager_native_boot_prop
+  device_config_connectivity_prop
   device_config_input_native_boot_prop
   device_config_netd_native_prop
   device_config_runtime_native_boot_prop
diff --git a/private/traced.te b/private/traced.te
index 89d3cd2..aa16966 100644
--- a/private/traced.te
+++ b/private/traced.te
@@ -37,6 +37,11 @@
 allow traced traceur_app:fd use;
 allow traced trace_data_file:file { read write };
 
+# Allow perfetto to access the proxy service for notifying Traceur.
+allow traced tracingproxy_service:service_manager find;
+binder_use(traced);
+binder_call(traced, system_server);
+
 # Allow iorapd to pass memfd descriptors to traced, so traced can directly
 # write into the shmem buffer file without doing roundtrips over IPC.
 allow traced iorapd:fd use;
diff --git a/public/service.te b/public/service.te
index cf223da..928016b 100644
--- a/public/service.te
+++ b/public/service.te
@@ -215,7 +215,7 @@
 type vibrator_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type vibrator_manager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type voiceinteraction_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
-type vpnmanager_service, app_api_service, system_server_service, service_manager_type;
+type vpn_management_service, app_api_service, system_server_service, service_manager_type;
 type vr_manager_service, system_server_service, service_manager_type;
 type wallpaper_service, app_api_service, system_server_service, service_manager_type;
 type webviewupdate_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;