diff --git a/private/apexd.te b/private/apexd.te
index 7b1c0417550b576fc0567dfa3abee9b7ca597e9a..bed895306fe4452cd627cc6c6ec4840700567109 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -46,6 +46,10 @@ allow apexd apex_mnt_dir:lnk_file create_file_perms;
 allow apexd apk_tmp_file:file relabelfrom;
 allow apexd apex_data_file:file relabelto;
 
+# allow apexd to read files from /data/staging and hardlink them to /data/apex.
+allow apexd staging_data_file:dir r_dir_perms;
+allow apexd staging_data_file:file { r_file_perms link };
+
 # Unmount and mount filesystems
 allow apexd labeledfs:filesystem { mount unmount };
 
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index f40ca7768b54fc79bea48f66fbcfd464193c438e..de0cc7987b49b2358cf9fedee0c1544cca778b12 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -142,6 +142,7 @@
     secure_element_service
     server_configurable_flags_data_file
     slice_service
+    staging_data_file
     stats
     stats_data_file
     stats_exec
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index 88cf5d6216e173932cb130f57132bdd0b6fdf96b..429725c70e0bc95f24184161c252b6cb259d69cc 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -141,6 +141,7 @@
     statsdw_socket
     storaged_data_file
     super_block_device
+    staging_data_file
     system_boot_reason_prop
     system_lmk_prop
     system_suspend_hwservice
diff --git a/private/compat/28.0/28.0.ignore.cil b/private/compat/28.0/28.0.ignore.cil
index 824761481332028dc056b8f050dd0e5112c81601..9133c44916709be32713f77d0c4eb5422f6911df 100644
--- a/private/compat/28.0/28.0.ignore.cil
+++ b/private/compat/28.0/28.0.ignore.cil
@@ -75,10 +75,11 @@
     rss_hwm_reset_exec
     runtime_service
     sensor_privacy_service
+    server_configurable_flags_data_file
     super_block_device
     system_lmk_prop
     system_suspend_hwservice
-    server_configurable_flags_data_file
+    staging_data_file
     time_prop
     timedetector_service
     timezonedetector_service
diff --git a/private/domain.te b/private/domain.te
index 15179e23b12f43a8b43e856776d1d43f1cefe1fb..bc1defb63865d5cd9c9917fcd1b633358ad8174c 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -138,6 +138,17 @@ neverallow {
   -installd
 } { privapp_data_file app_data_file }:dir_file_class_set { relabelfrom relabelto };
 
+# The staging directory contains APEX and APK files. It is important to ensure
+# that these files cannot be accessed by other domains to ensure that the files
+# do not change between system_server staging the files and apexd processing
+# the files.
+neverallow { domain -init -system_server -apexd } staging_data_file:dir *;
+neverallow { domain -init -system_server -apexd } staging_data_file:file *;
+neverallow { domain -init -system_server } staging_data_file:dir no_w_dir_perms;
+# apexd needs the link permission, so list every `no_w_file_perms` except for `link`.
+neverallow { domain -init -system_server } staging_data_file:file
+  { append create unlink relabelfrom rename setattr write no_x_file_perms };
+
 neverallow {
     domain
     -appdomain # for oemfs
diff --git a/private/file_contexts b/private/file_contexts
index 13d87ff1fcf7955b5ce6b1ba3dde2c54080a0aea..da41ef74ae9bdc3a9d7a60a2bac971b7e1074a20 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -429,6 +429,7 @@
 /data/preloads/media(/.*)?	u:object_r:preloads_media_file:s0
 /data/preloads/demo(/.*)?	u:object_r:preloads_media_file:s0
 /data/server_configurable_flags(/.*)? u:object_r:server_configurable_flags_data_file:s0
+/data/staging(/.*)?		u:object_r:staging_data_file:s0
 
 # Misc data
 /data/misc/adb(/.*)?            u:object_r:adb_keys_file:s0
diff --git a/private/system_server.te b/private/system_server.te
index b8e051117cccc06eb4661c2e2c88e11c3bc6adee..f3d2ffd99582415fd8a5a4fb4bf651aa893d5703 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -471,6 +471,10 @@ allow system_server wifi_data_file:file create_file_perms;
 allow system_server zoneinfo_data_file:dir create_dir_perms;
 allow system_server zoneinfo_data_file:file create_file_perms;
 
+# Manage /data/staging.
+allow system_server staging_data_file:dir create_dir_perms;
+allow system_server staging_data_file:file create_file_perms;
+
 # Walk /data/data subdirectories.
 # Types extracted from seapp_contexts type= fields.
 allow system_server {
diff --git a/public/file.te b/public/file.te
index 2a5e6f42920dd13d7d4a3db18340fd9e4441943b..86a85dc61034405daf577b0e2b3d987d26690b28 100644
--- a/public/file.te
+++ b/public/file.te
@@ -253,6 +253,8 @@ type preloads_media_file, file_type, data_file_type, core_data_file_type;
 type dhcp_data_file, file_type, data_file_type, core_data_file_type;
 # /data/server_configurable_flags
 type server_configurable_flags_data_file, file_type, data_file_type, core_data_file_type;
+# /data/staging
+type staging_data_file, file_type, data_file_type, core_data_file_type;
 
 # Mount locations managed by vold
 type mnt_media_rw_file, file_type;