diff --git a/keystore2/keystore2.rc b/keystore2/keystore2.rc
index 139c94b2..bc040e51 100644
--- a/keystore2/keystore2.rc
+++ b/keystore2/keystore2.rc
@@ -5,8 +5,16 @@
 # Keystore shall run as user keystore and groups keystore, readproc, and log.
 #
 # See system/core/init/README.md for information on the init.rc language.
+
+# Start Keystore 2 conditionally
+# TODO b/171563717 Remove when Keystore 2 migration is complete.
+on nonencrypted && property:ro.android.security.keystore2.enable=true
+    enable keystore2
+
 service keystore2 /system/bin/keystore2 /data/misc/keystore
     class main
     user keystore
     group keystore readproc log
     writepid /dev/cpuset/foreground/tasks
+    # TODO b/171563717 Remove when Keystore 2 migration is complete.
+    disabled