diff --git a/toys/lsb/mknod.c b/toys/lsb/mknod.c
index 35a127d..0fec5a2 100644
--- a/toys/lsb/mknod.c
+++ b/toys/lsb/mknod.c
@@ -4,7 +4,7 @@
  *
  * http://refspecs.linuxfoundation.org/LSB_4.1.0/LSB-Core-generic/LSB-Core-generic/mknod.html
 
-USE_MKNOD(NEWTOY(mknod, "<2>4m(mode):", TOYFLAG_BIN|TOYFLAG_UMASK))
+USE_MKNOD(NEWTOY(mknod, "<2>4m(mode):"USE_MKNOD_Z("Z:"), TOYFLAG_BIN|TOYFLAG_UMASK))
 
 config MKNOD
   bool "mknod"
@@ -16,12 +16,22 @@
     c or u for character device, p for named pipe (which ignores MAJOR/MINOR).
 
     -m	Mode (file permissions) of new device, in octal or u+x format
+
+config MKNOD_Z
+  bool
+  default y
+  depends on MKNOD && !TOYBOX_LSM_NONE
+  help
+    usage: mknod [-Z CONTEXT] ...
+
+    -Z	Set security context to created file
 */
 
 #define FOR_mknod
 #include "toys.h"
 
 GLOBALS(
+  char *arg_context;
   char *m;
 )
 
@@ -40,6 +50,13 @@
     minor = atoi(toys.optargs[3]);
   }
 
-  if (mknod(toys.optargs[0], mode | modes[type], makedev(major, minor)))
+  if (mknod(toys.optargs[0], mode | modes[type], makedev(major, minor))) {
     perror_exit("mknod %s failed", toys.optargs[0]);
+  }
+  else if (CFG_MKNOD_Z && (toys.optflags & FLAG_Z)) {
+    if (lsm_set_context(toys.optargs[0], TT.arg_context) < 0) {
+      unlink(toys.optargs[0]);
+      error_msg("'%s': bad -Z '%s'", toys.optargs[0], TT.arg_context);
+    }
+  }
 }