diff --git a/rootdir/init.rc b/rootdir/init.rc
index 27fa05951..2589619ea 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -583,6 +583,7 @@ on post-fs
     restorecon_recursive /metadata/apex
 
     mkdir /metadata/staged-install 0770 root system
+    mkdir /metadata/sepolicy 0700 root root
 on late-fs
     # Ensure that tracefs has the correct permissions.
     # This does not work correctly if it is called in post-fs.