diff --git a/Android.bp b/Android.bp
index 0cbf286..be9f44c 100644
--- a/Android.bp
+++ b/Android.bp
@@ -208,6 +208,7 @@
         "libfec",
         "liblz4",
         "libziparchive",
+        "libselinux",
     ],
 }
 
diff --git a/payload_consumer/postinstall_runner_action.cc b/payload_consumer/postinstall_runner_action.cc
index 6e10cea..1ada63b 100644
--- a/payload_consumer/postinstall_runner_action.cc
+++ b/payload_consumer/postinstall_runner_action.cc
@@ -19,6 +19,7 @@
 #include <fcntl.h>
 #include <signal.h>
 #include <stdlib.h>
+#include <selinux/selinux.h>
 #include <sys/mount.h>
 #include <sys/types.h>
 #include <unistd.h>
@@ -224,11 +225,23 @@
     utils::MountFilesystem(mountable_device, fs_mount_dir_, MS_NOATIME | MS_NODEV | MS_NODIRATIME,
                            partition.filesystem_type, "seclabel");
 
+    // Switch to a permissive domain
+    if (setexeccon("u:r:backuptool:s0")) {
+      LOG(ERROR) << "Failed to set backuptool context";
+      return false;
+    }
+
     // Run backuptool script
     int ret = system("/postinstall/system/bin/backuptool_postinstall.sh");
     if (ret == -1 || WEXITSTATUS(ret) != 0) {
       LOG(ERROR) << "Backuptool postinstall step failed. ret=" << ret;
     }
+
+    // Switch back to update_engine domain
+    if (setexeccon(nullptr)) {
+      LOG(ERROR) << "Failed to set update_engine context";
+      return false;
+    }
   } else {
     LOG(INFO) << "Skipping backuptool scripts";
   }