diff --git a/shared/config/init.vsoc.rc b/shared/config/init.vsoc.rc
index 738db6b..379a7ed 100644
--- a/shared/config/init.vsoc.rc
+++ b/shared/config/init.vsoc.rc
@@ -38,13 +38,10 @@
     mount_all /vendor/etc/fstab.${ro.hardware}
     restorecon_recursive /vendor
 
-    start rename_eth0
+    start setup_wifi
     # works around framework netiface enumeration issue
     start rename_eth1
 
-    # wait until rename_eth0 is done before attempting to stack wifi
-    wait /proc/self/net/xt_qtaguid/iface_stat/buried_eth0
-    start create_wifi
 
     # TODO(ender): Find better way to talk to serial port.
     chmod 622 /dev/kmsg
@@ -83,7 +80,7 @@
     start socket_forward_proxy
 
 
-service rename_eth0 /vendor/bin/rename_netiface eth0 buried_eth0
+service setup_wifi /vendor/bin/setup_wifi
     oneshot
 
 
@@ -91,10 +88,6 @@
     oneshot
 
 
-service create_wifi /vendor/bin/ip_link_add virt_wifi buried_eth0 wlan0
-    oneshot
-
-
 on property:sys.boot_completed=1
     trigger sys-boot-completed-set
 
diff --git a/shared/device.mk b/shared/device.mk
index 2f14e03..b363f7a 100644
--- a/shared/device.mk
+++ b/shared/device.mk
@@ -72,6 +72,7 @@
     vport_trigger \
     rename_netiface \
     ip_link_add \
+    setup_wifi \
 
 #
 # Packages for AOSP-available stuff we use from the framework
diff --git a/shared/sepolicy/file_contexts b/shared/sepolicy/file_contexts
index 47afcdc..d6a14a9 100644
--- a/shared/sepolicy/file_contexts
+++ b/shared/sepolicy/file_contexts
@@ -35,4 +35,5 @@
 /vendor/bin/hw/android\.hardware\.health\.storage@1\.0-service.cuttlefish  u:object_r:hal_health_storage_default_exec:s0
 /vendor/bin/hw/android\.hardware\.neuralnetworks@1\.2-service-sample-.*   u:object_r:hal_neuralnetworks_sample_exec:s0
 /vendor/bin/ip_link_add  u:object_r:ip_link_add_exec:s0
+/vendor/bin/setup_wifi  u:object_r:setup_wifi_exec:s0
 /vendor/bin/hw/android\.hardware\.thermal@2\.0-service\.mock  u:object_r:hal_thermal_default_exec:s0
diff --git a/shared/sepolicy/setup_wifi.te b/shared/sepolicy/setup_wifi.te
new file mode 100644
index 0000000..e6ec279
--- /dev/null
+++ b/shared/sepolicy/setup_wifi.te
@@ -0,0 +1,10 @@
+type setup_wifi, domain;
+type setup_wifi_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(setup_wifi)
+
+allow setup_wifi self:capability { net_admin net_raw sys_module };
+allow setup_wifi self:udp_socket { create ioctl };
+allow setup_wifi self:netlink_route_socket { bind create nlmsg_write read write };
+
+allow setup_wifi kernel:system module_request;