diff --git a/policy/modules/apps/gpg.te b/policy/modules/apps/gpg.te
index 991b0fe88..dca9d9225 100644
--- a/policy/modules/apps/gpg.te
+++ b/policy/modules/apps/gpg.te
@@ -359,8 +359,6 @@ miscfiles_read_localization(gpg_pinentry_t)
 
 userdom_use_user_terminals(gpg_pinentry_t)
 
-xdg_read_data_files(gpg_pinentry_t)
-
 tunable_policy(`use_nfs_home_dirs',`
 	fs_read_nfs_files(gpg_pinentry_t)
 ')
@@ -382,6 +380,10 @@ optional_policy(`
 	pulseaudio_run(gpg_pinentry_t, gpg_pinentry_roles)
 ')
 
+optional_policy(`
+	xdg_read_data_files(gpg_pinentry_t)
+')
+
 optional_policy(`
 	xserver_user_x_domain_template(gpg_pinentry, gpg_pinentry_t, gpg_pinentry_tmpfs_t)
 ')
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index c189e74cd..55081d87b 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1182,9 +1182,6 @@ template(`userdom_unpriv_user_template', `
 		fs_exec_noxattr($1_t)
 	')
 
-	# Allow users to manage xdg content in their home directories
-	userdom_xdg_user_template($1)
-
 	# Allow users to run TCP servers (bind to ports and accept connection from
 	# the same domain and outside users) disabling this forces FTP passive mode
 	# and may change other protocols
@@ -1227,6 +1224,11 @@ template(`userdom_unpriv_user_template', `
 		systemd_write_inherited_logind_inhibit_pipes($1_t)
 	')
 
+	# Allow users to manage xdg content in their home directories
+	optional_policy(`
+		userdom_xdg_user_template($1)
+	')
+
 	# Allow controlling usbguard
 	optional_policy(`
 		tunable_policy(`usbguard_user_modify_rule_files',`