diff --git a/sepolicy/vendor/thermal-engine.te b/sepolicy/vendor/thermal-engine.te
index ef381df..33742e6 100644
--- a/sepolicy/vendor/thermal-engine.te
+++ b/sepolicy/vendor/thermal-engine.te
@@ -4,4 +4,8 @@ allow thermal-engine thermal_data_file:file create_file_perms;
 allow thermal-engine self:capability { chown fowner };
 allow thermal-engine sysfs_devfreq:dir r_dir_perms;
 
+# Allow thermal-engine to read files in /sys because <Q blobs require broader
+# sysfs access and we don't want to relabel stuff like /sys/class/kgsl
+r_dir_file(thermal-engine, sysfs)
+
 set_prop(thermal-engine, vendor_thermal_normal_prop)