diff --git a/sepolicy/vendor/uncrypt.te b/sepolicy/vendor/uncrypt.te
new file mode 100644
index 00000000..a15cb3c4
--- /dev/null
+++ b/sepolicy/vendor/uncrypt.te
@@ -0,0 +1,2 @@
+# Fix OTA with encrypted F2FS userdata
+allow uncrypt self:capability { sys_admin fowner };