diff --git a/apex/Android.bp b/apex/Android.bp
index 8f11771b2..dda949f0d 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -21,6 +21,8 @@ package {
     default_applicable_licenses: ["system_sepolicy_license"],
 }
 
+// TODO(b/236681553): Remove com.android.bluetooth-file_contexts
+
 filegroup {
   name: "apex_file_contexts_files",
   srcs: ["*-file_contexts"],
diff --git a/apex/com.android.btservices-file_contexts b/apex/com.android.btservices-file_contexts
new file mode 100644
index 000000000..f6b21daaa
--- /dev/null
+++ b/apex/com.android.btservices-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
diff --git a/mac_permissions.mk b/mac_permissions.mk
index dbdf14430..ad17b8f90 100644
--- a/mac_permissions.mk
+++ b/mac_permissions.mk
@@ -22,7 +22,7 @@ $(plat_mac_perms_keys.tmp): $(all_plat_mac_perms_keys) $(M4)
 	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_KEYS) > $@
 
 # Should be synced with keys.conf.
-all_plat_keys := platform sdk_sandbox media networkstack shared testkey
+all_plat_keys := platform sdk_sandbox media networkstack shared testkey bluetooth
 all_plat_keys := $(all_plat_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
 
 $(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files)