diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index b0b5f19b402947352f0b40cf972bb3e25b749508..8b4d69ca59e1367358ca64f3d87238106a83b1a7 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -43,6 +43,7 @@
     exported3_default_prop
     exported3_radio_prop
     exported3_system_prop
+    fingerprint_vendor_data_file
     fs_bpf
     hal_audiocontrol_hwservice
     hal_authsecret_hwservice
diff --git a/private/file_contexts b/private/file_contexts
index b55fb9d381c357d2586c974ee35f4135523d75b5..4381f9129f732f901a29997b56d622269e0ca073 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -455,6 +455,9 @@
 # Fingerprint data
 /data/system/users/[0-9]+/fpdata(/.*)? u:object_r:fingerprintd_data_file:s0
 
+# Fingerprint vendor data file
+/data/vendor_de/[0-9]+/fpdata(/.*)? u:object_r:fingerprint_vendor_data_file:s0
+
 # Bootchart data
 /data/bootchart(/.*)?		u:object_r:bootchart_data_file:s0
 
diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te
index 4e89d6488c3c3be8cce75bbc3f7069ab4995b71c..0a115584acc3faf3997af7c075c67f8258be0a62 100644
--- a/private/vold_prepare_subdirs.te
+++ b/private/vold_prepare_subdirs.te
@@ -14,10 +14,12 @@ allow vold_prepare_subdirs {
   vendor_data_file
 }:dir { open read write add_name remove_name rmdir relabelfrom };
 allow vold_prepare_subdirs {
+    fingerprint_vendor_data_file
     storaged_data_file
     vold_data_file
 }:dir { create_dir_perms relabelto };
 allow vold_prepare_subdirs {
+    fingerprint_vendor_data_file
     storaged_data_file
     system_data_file
     vold_data_file
diff --git a/public/domain.te b/public/domain.te
index cef538fd3c8929facc84b2b78ed6da69648ca744..f58b4567cba0ef647edc911c47d254acb21c2060 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -814,6 +814,7 @@ full_treble_only(`
     -appdomain # TODO(b/34980020) remove exemption for appdomain
     -data_between_core_and_vendor_violators
     -init
+    -vold_prepare_subdirs
   } {
     data_file_type
     -core_data_file_type
@@ -825,6 +826,7 @@ full_treble_only(`
     -appdomain # TODO(b/34980020) remove exemption for appdomain
     -data_between_core_and_vendor_violators
     -init
+    -vold_prepare_subdirs
     } {
       data_file_type
       -core_data_file_type
diff --git a/public/file.te b/public/file.te
index 47beab632dbbb44c99ccff9c58398e12e6840106..8c33bedb9120cdfa9250694f6e9000ecb78dbc25 100644
--- a/public/file.te
+++ b/public/file.te
@@ -312,6 +312,8 @@ type backup_data_file, file_type, data_file_type, core_data_file_type, mlstruste
 type bluetooth_efs_file, file_type;
 # Type for fingerprint template file
 type fingerprintd_data_file, file_type, data_file_type, core_data_file_type;
+# Type for _new_ fingerprint template file
+type fingerprint_vendor_data_file, file_type, data_file_type;
 # Type for appfuse file.
 type app_fuse_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
 
diff --git a/public/hal_fingerprint.te b/public/hal_fingerprint.te
index 36de76191c0a38118a576784af64e9aaf5cb4424..ebe0b0c82a77f1a5a0c0b131f76b9a4ec20ffc47 100644
--- a/public/hal_fingerprint.te
+++ b/public/hal_fingerprint.te
@@ -8,5 +8,10 @@ allow hal_fingerprint_client hal_fingerprint_hwservice:hwservice_manager find;
 # For memory allocation
 allow hal_fingerprint ion_device:chr_file r_file_perms;
 
+allow hal_fingerprint fingerprint_vendor_data_file:file { create_file_perms };
+allow hal_fingerprint fingerprint_vendor_data_file:dir rw_dir_perms;
+
 r_dir_file(hal_fingerprint, cgroup)
 r_dir_file(hal_fingerprint, sysfs)
+
+
diff --git a/public/tee.te b/public/tee.te
index f023d5c239350e9fea693a0057f497a7b7f502ee..0f9b32dc9d4cb095f4ea361e39a52b09d0c01b29 100644
--- a/public/tee.te
+++ b/public/tee.te
@@ -5,3 +5,7 @@ type tee, domain;
 
 # Device(s) for communicating with the TEE
 type tee_device, dev_type;
+
+allow tee fingerprint_vendor_data_file:dir rw_dir_perms;
+allow tee fingerprint_vendor_data_file:file create_file_perms;
+