diff --git a/private/system_server.te b/private/system_server.te
index fa59ef8e1..3b4042665 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1010,6 +1010,9 @@ allow system_server system_server_startup:unix_dgram_socket write;
 allow system_server apex_service:service_manager find;
 allow system_server apexd:binder call;
 
+# Allow system server to scan /apex for flattened APEXes
+allow system_server apex_mnt_dir:dir r_dir_perms;
+
 # Allow system server to communicate to system-suspend's control interface
 allow system_server system_suspend_control_service:service_manager find;
 binder_call(system_server, system_suspend)