diff --git a/private/hal_bluetooth_default.te b/private/hal_bluetooth_default.te
index 4fcb3221dfdaa3be6915d8cbe1b456f532887e68..d22015b72d0a834e9634c88774d3e45caad3dde5 100644
--- a/private/hal_bluetooth_default.te
+++ b/private/hal_bluetooth_default.te
@@ -4,11 +4,6 @@ hal_server_domain(hal_bluetooth_default, hal_bluetooth)
 type hal_bluetooth_default_exec, exec_type, file_type;
 init_daemon_domain(hal_bluetooth_default)
 
-# VTS tests need to be able to toggle rfkill
-userdebug_or_eng(`
-  allow hal_bluetooth_default self:capability net_admin;
-')
-
 # Logging for backward compatibility
 allow hal_bluetooth_default bluetooth_data_file:dir ra_dir_perms;
 allow hal_bluetooth_default bluetooth_data_file:file create_file_perms;
diff --git a/public/hal_bluetooth.te b/public/hal_bluetooth.te
index 207f718b3133b0052e5d077e03c612826eca459d..e9679de5c61973533f97c92af2cddc32c182177a 100644
--- a/public/hal_bluetooth.te
+++ b/public/hal_bluetooth.te
@@ -4,6 +4,9 @@ binder_call(hal_bluetooth_server, hal_bluetooth_client)
 
 wakelock_use(hal_bluetooth);
 
+# The HAL toggles rfkill to power the chip off/on.
+allow hal_bluetooth self:capability net_admin;
+
 # bluetooth factory file accesses.
 r_dir_file(hal_bluetooth, bluetooth_efs_file)