diff --git a/Ext4Crypt.cpp b/Ext4Crypt.cpp
index a7d359e..472ffc8 100644
--- a/Ext4Crypt.cpp
+++ b/Ext4Crypt.cpp
@@ -747,6 +747,12 @@
             if (!ensure_policy(ce_raw_ref, misc_ce_path)) return false;
             if (!ensure_policy(ce_raw_ref, media_ce_path)) return false;
             if (!ensure_policy(ce_raw_ref, user_ce_path)) return false;
+
+            // Now that credentials have been installed, we can run restorecon
+            // over these paths
+            // NOTE: these paths need to be kept in sync with libselinux
+            android::vold::RestoreconRecursive(system_ce_path);
+            android::vold::RestoreconRecursive(misc_ce_path);
         }
     }