diff --git a/private/odrefresh.te b/private/odrefresh.te
index 811b7cf..c6ab7bb 100644
--- a/private/odrefresh.te
+++ b/private/odrefresh.te
@@ -49,9 +49,20 @@
 # odrefesh.
 allow odrefresh composd:fd use;
 
-# Run system binaries, e.g. pvm_exec, in the same domain
+# Run binaries from the CompOS APEX in the same domain
 allow odrefresh system_file:file execute_no_trans;
 
+# Make binder calls back to composd
+binder_use(odrefresh)
+allow odrefresh compos_service:service_manager find;
+binder_call(odrefresh, composd)
+
+# Run fd_server in its own domain
+domain_auto_trans(odrefresh, fd_server_exec, compos_fd_server)
+
+# And kill it via SIGTERM
+allow odrefresh compos_fd_server:process signal;
+
 # Do not audit unused resources from parent processes (adb, shell, su).
 # These appear to be unnecessary for odrefresh.
 dontaudit odrefresh { adbd shell }:fd use;