diff --git a/aosp_muskie.mk b/aosp_muskie.mk
index 308405b..cda3879 100644
--- a/aosp_muskie.mk
+++ b/aosp_muskie.mk
@@ -18,6 +18,10 @@
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 
+# Enforce privapp-permissions whitelist
+PRODUCT_PROPERTY_OVERRIDES += \
+    ro.control_privapp_permissions=enforce
+
 PRODUCT_NAME := aosp_muskie
 PRODUCT_DEVICE := muskie
 PRODUCT_BRAND := Android
diff --git a/aosp_walleye.mk b/aosp_walleye.mk
index 8ac05ec..3cb3004 100644
--- a/aosp_walleye.mk
+++ b/aosp_walleye.mk
@@ -18,6 +18,10 @@
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 
+# Enforce privapp-permissions whitelist
+PRODUCT_PROPERTY_OVERRIDES += \
+    ro.control_privapp_permissions=enforce
+
 PRODUCT_NAME := aosp_walleye
 PRODUCT_DEVICE := walleye
 PRODUCT_BRAND := Android