diff --git a/etc/Android.mk b/etc/Android.mk
index e76527a..4aa769c 100755
--- a/etc/Android.mk
+++ b/etc/Android.mk
@@ -85,6 +85,23 @@
 
 	LOCAL_SRC_FILES := init/$(LOCAL_MODULE)
 	include $(BUILD_PREBUILT)
+
+	include $(CLEAR_VARS)
+	LOCAL_MODULE := keystore2.rc
+	LOCAL_MODULE_TAGS := optional
+	LOCAL_MODULE_CLASS := EXECUTABLES
+	LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)/system/etc/init
+
+	LOCAL_SRC_FILES := init/$(LOCAL_MODULE)
+	include $(BUILD_PREBUILT)
+
+	include $(CLEAR_VARS)
+	LOCAL_MODULE := android.system.keystore2-service.xml
+	LOCAL_MODULE_TAGS := optional
+	LOCAL_MODULE_CLASS := EXECUTABLES
+	LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)/system/etc/vintf/manifest
+	LOCAL_SRC_FILES := init/$(LOCAL_MODULE)
+	include $(BUILD_PREBUILT)
 endif
 
 ifeq ($(AB_OTA_UPDATER),true)
diff --git a/etc/init.rc b/etc/init.rc
index a85ce90..c6f750b 100644
--- a/etc/init.rc
+++ b/etc/init.rc
@@ -49,6 +49,8 @@
 
     chown root shell /tmp
     chmod 0775 /tmp
+    mkdir /tmp/misc
+    mkdir /tmp/misc/keystore/
 
     write /proc/sys/kernel/panic_on_oops 1
     write /proc/sys/vm/max_map_count 1000000
diff --git a/etc/init/android.system.keystore2-service.xml b/etc/init/android.system.keystore2-service.xml
new file mode 100644
index 0000000..6b8d0cb
--- /dev/null
+++ b/etc/init/android.system.keystore2-service.xml
@@ -0,0 +1,9 @@
+<manifest version="1.0" type="framework">
+    <hal format="aidl">
+        <name>android.system.keystore2</name>
+        <interface>
+            <name>IKeystoreService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/etc/init/keystore2.rc b/etc/init/keystore2.rc
new file mode 100644
index 0000000..fa62662
--- /dev/null
+++ b/etc/init/keystore2.rc
@@ -0,0 +1,17 @@
+# Start the keystore2 service.
+# Keystore 2.0 changes its working directory to the first positional
+# command line option, i.e., /data/misc/keystore, where it stores its
+# database.
+# Keystore shall run as user keystore and groups keystore, readproc, and log.
+#
+# See system/core/init/README.md for information on the init.rc language.
+
+on late-init
+    start keystore2
+
+service keystore2 /system/bin/keystore2 /tmp/misc/keystore
+    class early_hal
+    user root
+    group keystore readproc log
+    writepid /dev/cpuset/foreground/tasks
+    seclabel u:r:recovery:s0