diff --git a/private/domain.te b/private/domain.te
index 3fc55a2d8..5851d75f3 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -321,4 +321,5 @@ neverallow {
   -uncrypt
   -tee
   -hal_bootctl_server
+  -fastbootd
 } self:global_capability_class_set sys_rawio;