diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index bb702d912..b9e1c5b28 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -39,7 +39,6 @@ role unconfined_r;
 ifdef(`enable_mls',`
 	role secadm_r;
 	role auditadm_r;
-	mls_process_set_level(kernel_t)
 ')
 
 #
@@ -48,7 +47,6 @@ ifdef(`enable_mls',`
 #
 type kernel_t, can_load_kernmodule;
 domain_base_type(kernel_t)
-mls_rangetrans_source(kernel_t)
 role system_r types kernel_t;
 sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
 
@@ -296,6 +294,9 @@ fs_manage_tmpfs_files(kernel_t)
 fs_manage_tmpfs_sockets(kernel_t)
 fs_delete_tmpfs_symlinks(kernel_t)
 
+mls_rangetrans_source(kernel_t)
+mls_process_set_level(kernel_t)
+
 selinux_getattr_fs(kernel_t)
 selinux_load_policy(kernel_t)
 
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 5aad77296..f7a086ac0 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -251,17 +251,13 @@ systemd_log_parse_environment(systemd_gpt_generator_t)
 
 allow systemd_cgroups_t self:capability net_admin;
 
-ifdef(`enable_mls',`
-	kernel_ranged_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t, s0 - mls_systemhigh)
-	mls_fd_use_all_levels(systemd_cgroups_t)
-',`
-	kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
-')
-
+kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
 kernel_dgram_send(systemd_cgroups_t)
 # for /proc/cmdline
 kernel_read_system_state(systemd_cgroups_t)
 
+mls_fd_use_all_levels(systemd_cgroups_t)
+
 selinux_getattr_fs(systemd_cgroups_t)
 
 # write to /run/systemd/cgroups-agent
@@ -274,6 +270,10 @@ seutil_libselinux_linked(systemd_cgroups_t)
 
 systemd_log_parse_environment(systemd_cgroups_t)
 
+ifdef(`enable_mls',`
+	kernel_ranged_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t, s0 - mls_systemhigh)
+')
+
 ######################################
 #
 # coredump local policy