diff --git a/rootdir/init.rc b/rootdir/init.rc
index 746fc61dc..e290072c6 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -807,6 +807,10 @@ on post-fs-data
     wait_for_prop apexd.status activated
     perform_apex_config
 
+    # After apexes are mounted, tell keymaster early boot has ended, so it will
+    # stop allowing use of early-boot keys
+    exec - system system -- /system/bin/vdc keymaster early-boot-ended
+
     # Special-case /data/media/obb per b/64566063
     mkdir /data/media 0770 media_rw media_rw encryption=None
     exec - media_rw media_rw -- /system/bin/chattr +F /data/media