diff --git a/device.mk b/device.mk
index 59a1be72c7653038b5b1f6df93b5251b5ca2ea99..88559ead88bbadd9e970a663342f03dd099b6485 100644
--- a/device.mk
+++ b/device.mk
@@ -263,7 +263,8 @@ PRODUCT_VENDOR_PROPERTIES += ro.hardware.egl=adreno
 # DRM
 PRODUCT_PACKAGES += \
     android.hardware.drm-V1-ndk.vendor \
-    android.hardware.drm-service.clearkey
+    android.hardware.drm-service.clearkey \
+    android.hardware.drm@1.3.vendor
 
 PRODUCT_VENDOR_PROPERTIES += \
     drm.service.enabled=true
diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts
index 7c8ec62849bdf51679ceee4d95638725d9eb8ba6..f67ef82f57bc8ee3daeaf4c2d322bcc428b92ac0 100644
--- a/sepolicy/vendor/file_contexts
+++ b/sepolicy/vendor/file_contexts
@@ -15,3 +15,5 @@
 
 # Custom wcnss_service
 /(vendor|system/vendor)/bin/wcnss_service_prebuilt       u:object_r:wcnss_service_exec:s0
+
+/vendor/bin/hw/android.hardware.drm-service.widevine    u:object_r:hal_drm_widevine_exec:s0
diff --git a/sepolicy/vendor/service_contexts b/sepolicy/vendor/service_contexts
new file mode 100644
index 0000000000000000000000000000000000000000..17b715c3b584ffec4ad093fef8cc264b407cd3f3
--- /dev/null
+++ b/sepolicy/vendor/service_contexts
@@ -0,0 +1 @@
+android.hardware.drm.IDrmFactory/widevine   u:object_r:hal_drm_service:s0