diff --git a/legacy/zuma/vendor/device.te b/legacy/zuma/vendor/device.te
index dce1d92..6ea01d9 100644
--- a/legacy/zuma/vendor/device.te
+++ b/legacy/zuma/vendor/device.te
@@ -11,7 +11,3 @@ type faceauth_heap_device, dmabuf_heap_device_type, dev_type;
 type vscaler_secure_heap_device, dmabuf_heap_device_type, dev_type;
 type framebuffer_secure_heap_device, dmabuf_heap_device_type, dev_type;
 type gcma_camera_heap_device, dmabuf_heap_device_type, dev_type;
-
-# SecureElement SPI device
-type st54spi_device, dev_type;
-
diff --git a/tracking_denials/keys.conf b/tracking_denials/keys.conf
index 56f6721..e450fcb 100644
--- a/tracking_denials/keys.conf
+++ b/tracking_denials/keys.conf
@@ -10,5 +10,3 @@ ALL : device/google/zumapro-sepolicy/tracking_denials/certs/camera_fishfood.x509
 [@CAMERASERVICES]
 ALL : device/google/zumapro-sepolicy/tracking_denials/certs/com_google_android_apps_camera_services.x509.pem
 
-[@EUICCSUPPORTPIXEL]
-ALL : device/google/zumapro-sepolicy/tracking_denials/certs/EuiccSupportPixel.x509.pem
diff --git a/tracking_denials/mac_permissions.xml b/tracking_denials/mac_permissions.xml
index c0c0cc9..48536b9 100644
--- a/tracking_denials/mac_permissions.xml
+++ b/tracking_denials/mac_permissions.xml
@@ -33,7 +33,4 @@
     <signer signature="@CAMERASERVICES" >
       <seinfo value="CameraServices" />
     </signer>
-    <signer signature="@EUICCSUPPORTPIXEL" >
-        <seinfo value="EuiccSupportPixel" />
-    </signer>
 </policy>
diff --git a/tracking_denials/seapp_contexts b/tracking_denials/seapp_contexts
index 74fea00..961c13c 100644
--- a/tracking_denials/seapp_contexts
+++ b/tracking_denials/seapp_contexts
@@ -1,6 +1,3 @@
-# Domain for EuiccSupportPixel
-user=_app isPrivApp=true seinfo=EuiccSupportPixel name=com.google.euiccpixel domain=euiccpixel_app type=app_data_file levelFrom=all
-
 # Domain for connectivity monitor
 user=_app isPrivApp=true seinfo=platform name=com.google.android.connectivitymonitor domain=con_monitor_app type=app_data_file levelFrom=all
 
diff --git a/tracking_denials/certs/EuiccSupportPixel.x509.pem b/vendor/certs/EuiccSupportPixel.x509.pem
similarity index 100%
rename from tracking_denials/certs/EuiccSupportPixel.x509.pem
rename to vendor/certs/EuiccSupportPixel.x509.pem
diff --git a/vendor/device.te b/vendor/device.te
index 10aff49..9712743 100644
--- a/vendor/device.te
+++ b/vendor/device.te
@@ -1,4 +1,8 @@
+# Device types
 type lwis_device, dev_type;
 type tee_persist_block_device, dev_type;
 type tee_userdata_block_device, dev_type;
 type hw_jpg_device, dev_type, mlstrustedobject;
+
+# SecureElement SPI device
+type st54spi_device, dev_type;
diff --git a/legacy/zuma/vendor/euiccpixel_app.te b/vendor/euiccpixel_app.te
similarity index 90%
rename from legacy/zuma/vendor/euiccpixel_app.te
rename to vendor/euiccpixel_app.te
index 0e4d65b..bc7c842 100644
--- a/legacy/zuma/vendor/euiccpixel_app.te
+++ b/vendor/euiccpixel_app.te
@@ -1,3 +1,4 @@
+# Euiccpixel_app
 type euiccpixel_app, domain;
 app_domain(euiccpixel_app)
 
@@ -18,4 +19,4 @@ userdebug_or_eng(`
 ')
 
 # b/265286368 framework UI rendering properties
-dontaudit euiccpixel_app default_prop:file { read };
\ No newline at end of file
+dontaudit euiccpixel_app default_prop:file { read };
diff --git a/vendor/keys.conf b/vendor/keys.conf
new file mode 100644
index 0000000..3ffa695
--- /dev/null
+++ b/vendor/keys.conf
@@ -0,0 +1,3 @@
+[@EUICCSUPPORTPIXEL]
+ALL : device/google/zumapro-sepolicy/vendor/certs/EuiccSupportPixel.x509.pem
+
diff --git a/vendor/mac_permissions.xml b/vendor/mac_permissions.xml
new file mode 100644
index 0000000..0eab982
--- /dev/null
+++ b/vendor/mac_permissions.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<policy>
+
+<!--
+
+    * A signature is a hex encoded X.509 certificate or a tag defined in
+      keys.conf and is required for each signer tag.
+    * A signer tag may contain a seinfo tag and multiple package stanzas.
+    * A default tag is allowed that can contain policy for all apps not signed with a
+      previously listed cert. It may not contain any inner package stanzas.
+    * Each signer/default/package tag is allowed to contain one seinfo tag. This tag
+      represents additional info that each app can use in setting a SELinux security
+      context on the eventual process.
+    * When a package is installed the following logic is used to determine what seinfo
+      value, if any, is assigned.
+      - All signatures used to sign the app are checked first.
+      - If a signer stanza has inner package stanzas, those stanza will be checked
+        to try and match the package name of the app. If the package name matches
+        then that seinfo tag is used. If no inner package matches then the outer
+        seinfo tag is assigned.
+      - The default tag is consulted last if needed.
+-->
+    <!-- google apps key -->
+    <signer signature="@EUICCSUPPORTPIXEL" >
+        <seinfo value="EuiccSupportPixel" />
+    </signer>
+</policy>
diff --git a/vendor/seapp_contexts b/vendor/seapp_contexts
new file mode 100644
index 0000000..4116372
--- /dev/null
+++ b/vendor/seapp_contexts
@@ -0,0 +1,3 @@
+# Domain for EuiccSupportPixel
+user=_app isPrivApp=true seinfo=EuiccSupportPixel name=com.google.euiccpixel domain=euiccpixel_app type=app_data_file levelFrom=all
+