diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 66e9f69..1157187 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -257,3 +257,6 @@
   -untrusted_app_25
   -untrusted_app_27
 } mnt_sdcard_file:lnk_file *;
+
+# Only privileged apps may find the incident service
+neverallow all_untrusted_apps incident_service:service_manager find;
diff --git a/private/incidentd.te b/private/incidentd.te
index 405684a..656f69f 100644
--- a/private/incidentd.te
+++ b/private/incidentd.te
@@ -179,21 +179,6 @@
 ###
 ### neverallow rules
 ###
-
-# only specific domains can find the incident service
-neverallow {
-  domain
-  -dumpstate
-  -incident
-  -incidentd
-  -perfetto
-  -permissioncontroller_app
-  -priv_app
-  -statsd
-  -system_app
-  -system_server
-} incident_service:service_manager find;
-
 # only incidentd and the other root services in limited circumstances
 # can get to the files in /data/misc/incidents
 #