diff --git a/MetadataCrypt.cpp b/MetadataCrypt.cpp
index 088960e..acd5b59 100644
--- a/MetadataCrypt.cpp
+++ b/MetadataCrypt.cpp
@@ -56,6 +56,14 @@
 static const char* kFn_keymaster_key_blob_upgraded = "keymaster_key_blob_upgraded";
 
 static bool mount_via_fs_mgr(const char* mount_point, const char* blk_device) {
+    // We're about to mount data not verified by verified boot.  Tell Keymaster that early boot has
+    // ended.
+    //
+    // TODO(paulcrowley): Make a Keymaster singleton or something, so we don't have to repeatedly
+    // open and initialize the service.
+    ::android::vold::Keymaster keymaster;
+    keymaster.earlyBootEnded();
+
     // fs_mgr_do_mount runs fsck. Use setexeccon to run trusted
     // partitions in the fsck domain.
     if (setexeccon(android::vold::sFsckContext)) {