diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index ca18c0396cc606235005e48f19ede76712673ba5..819408ac3e2f51240b1b5eab51289969372a6599 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -173,10 +173,12 @@ neverallow all_untrusted_apps *:hwservice_manager ~find;
 #   by surfaceflinger Binder service, which apps are permitted to access
 # - hal_omx_hwservice: because this is a HwBinder version of the mediacodec
 #   Binder service which apps were permitted to access.
+# - hal_codec2_hwservice: because this is a newer version of hal_omx_hwservice.
 neverallow all_untrusted_apps {
   hwservice_manager_type
   -same_process_hwservice
   -coredomain_hwservice
+  -hal_codec2_hwservice
   -hal_configstore_ISurfaceFlingerConfigs
   -hal_graphics_allocator_hwservice
   -hal_omx_hwservice
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index d4de3b956c921b39359137ef7d7f1dc866ee54fd..0cd9d0e59e7e73974a8948958a1ec2a2d4e4af3c 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -47,6 +47,7 @@
     hal_authsecret_hwservice
     hal_broadcastradio_hwservice
     hal_cas_hwservice
+    hal_codec2_hwservice
     hal_confirmationui_hwservice
     hal_lowpan_hwservice
     hal_neuralnetworks_hwservice
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index fc00e959937922855d28a3e8051c58e39a3e5029..a375dc832b7562dcb5ea1dcb47c3cc0ab1dd1268 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -42,6 +42,7 @@
     fingerprint_vendor_data_file
     fs_bpf
     hal_authsecret_hwservice
+    hal_codec2_hwservice
     hal_confirmationui_hwservice
     hal_lowpan_hwservice
     hal_secure_element_hwservice
diff --git a/private/mediaserver.te b/private/mediaserver.te
index a9b85be0cb1f90bed7a3a85b19daeb09f9e3ef4b..a5fa9e10e23daf345cbb0f4b6596890915804f8d 100644
--- a/private/mediaserver.te
+++ b/private/mediaserver.te
@@ -7,4 +7,5 @@ hal_client_domain(mediaserver, hal_graphics_allocator)
 
 # TODO(b/36375899): Remove this once OMX HAL is attributized and mediaserver is marked as a client
 # of OMX HAL.
+allow mediaserver hal_codec2_hwservice:hwservice_manager find;
 allow mediaserver hal_omx_hwservice:hwservice_manager find;
diff --git a/private/system_server.te b/private/system_server.te
index 72d408aa6eafbe64b837eb6907f83cd9bac945bc..48ec63499650611880804e2ec5ef510bda5da2ca 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -199,6 +199,7 @@ hal_client_domain(system_server, hal_light)
 hal_client_domain(system_server, hal_memtrack)
 hal_client_domain(system_server, hal_neuralnetworks)
 hal_client_domain(system_server, hal_oemlock)
+allow system_server hal_codec2_hwservice:hwservice_manager find;
 allow system_server hal_omx_hwservice:hwservice_manager find;
 allow system_server hidl_token_hwservice:hwservice_manager find;
 hal_client_domain(system_server, hal_power)
diff --git a/public/app.te b/public/app.te
index 0c5008ddb4dea5594aee29acc35f6f5ad669e535..4ebf4803ead094c003837d64bad50c5d12e8d586 100644
--- a/public/app.te
+++ b/public/app.te
@@ -222,6 +222,7 @@ binder_call(appdomain, ephemeral_app)
 # TODO(b/36375899): Replace this with hal_client_domain once mediacodec is properly attributized
 # as OMX HAL
 hwbinder_use({ appdomain  -isolated_app })
+allow { appdomain -isolated_app } hal_codec2_hwservice:hwservice_manager find;
 allow { appdomain -isolated_app } hal_omx_hwservice:hwservice_manager find;
 allow { appdomain -isolated_app } hidl_token_hwservice:hwservice_manager find;
 
diff --git a/public/hwservice.te b/public/hwservice.te
index 2b745c0b3fba6c10a5dada2e0427e0e0834afc94..ca2025870c4efc96d81aca9f35f59fe992017ed8 100644
--- a/public/hwservice.te
+++ b/public/hwservice.te
@@ -8,6 +8,7 @@ type hal_bluetooth_hwservice, hwservice_manager_type;
 type hal_bootctl_hwservice, hwservice_manager_type;
 type hal_broadcastradio_hwservice, hwservice_manager_type;
 type hal_camera_hwservice, hwservice_manager_type;
+type hal_codec2_hwservice, hwservice_manager_type;
 type hal_configstore_ISurfaceFlingerConfigs, hwservice_manager_type;
 type hal_confirmationui_hwservice, hwservice_manager_type;
 type hal_contexthub_hwservice, hwservice_manager_type;
diff --git a/public/mediacodec.te b/public/mediacodec.te
index bcccbb81ac0255c4e086e109e4b74d687259b357..e5b4a7d352dd42a048bae2d2658330c9ef598147 100644
--- a/public/mediacodec.te
+++ b/public/mediacodec.te
@@ -33,6 +33,7 @@ allow mediacodec hal_camera:fd use;
 
 crash_dump_fallback(mediacodec)
 
+add_hwservice(mediacodec, hal_codec2_hwservice)
 add_hwservice(mediacodec, hal_omx_hwservice)
 
 hal_client_domain(mediacodec, hal_allocator)