diff --git a/public/postinstall.te b/public/postinstall.te
index 2ef68bd..bcea2dc 100644
--- a/public/postinstall.te
+++ b/public/postinstall.te
@@ -35,6 +35,10 @@
 # Need to talk to the otadexopt service.
 allow postinstall otadexopt_service:service_manager find;
 
+# Allow postinstall scripts to trigger f2fs garbage collection
+allow postinstall sysfs_fs_f2fs:file rw_file_perms;
+allow postinstall sysfs_fs_f2fs:dir r_dir_perms;
+
 # No domain other than update_engine and recovery (via update_engine_sideload)
 # should transition to postinstall, as it is only meant to run during the
 # update.