diff --git a/packages/release/prepare-local.service b/packages/release/prepare-local.service
index 167873d9c50..bec31ad6bbe 100644
--- a/packages/release/prepare-local.service
+++ b/packages/release/prepare-local.service
@@ -21,6 +21,10 @@ ExecStart=/usr/bin/mkdir -p \
     ${LOCAL_DIR}/var/lib/kernel-devel/.overlay/work \
     ${LOCAL_DIR}/var/lib/kernel-modules/.overlay/upper \
     ${LOCAL_DIR}/var/lib/kernel-modules/.overlay/work
+ExecStart=/usr/sbin/setfiles -r ${LOCAL_DIR} \
+    -F /etc/selinux/fortified/contexts/files/file_contexts \
+    ${LOCAL_DIR}/var/lib/kernel-devel \
+    ${LOCAL_DIR}/var/lib/kernel-modules
 
 # Create the directories we need to set up a read-write overlayfs for any CNI
 # plugin binaries.
@@ -31,6 +35,9 @@ ExecStart=/usr/bin/mkdir -p \
     ${LOCAL_DIR}/opt/cni/bin \
     ${LOCAL_DIR}/var/lib/cni-plugins/.overlay/upper \
     ${LOCAL_DIR}/var/lib/cni-plugins/.overlay/work
+ExecStart=/usr/sbin/setfiles -r ${LOCAL_DIR} \
+    -F /etc/selinux/fortified/contexts/files/file_contexts \
+    ${LOCAL_DIR}/var/lib/cni-plugins
 
 RemainAfterExit=true
 StandardError=journal+console
diff --git a/packages/selinux-policy/fs.cil b/packages/selinux-policy/fs.cil
index 457aace294a..844ef56094e 100644
--- a/packages/selinux-policy/fs.cil
+++ b/packages/selinux-policy/fs.cil
@@ -80,6 +80,14 @@
 (filecon "/var/lib/netdog" any lease)
 (filecon "/var/lib/netdog/.*" any lease)
 
+; Label local directories for overlayfs mounts.
+(filecon "/var/lib/cni-plugins" any state)
+(filecon "/var/lib/cni-plugins/.*" any state)
+(filecon "/var/lib/kernel-devel" any state)
+(filecon "/var/lib/kernel-devel/.*" any state)
+(filecon "/var/lib/kernel-modules" any state)
+(filecon "/var/lib/kernel-modules/.*" any state)
+
 ; Label kernel filesystem mounts.
 (filecon "/proc" any proc)
 (filecon "/proc/.*" any ())