diff --git a/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt b/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
index b0a964a6570cf..b1369fe68b135 100644
--- a/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
+++ b/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
@@ -519,9 +519,15 @@ class AppIdPermissionPolicy : SchemePolicy() {
                 val isPermissionChanged = oldPermission == null ||
                     newPackageName != oldPermission.packageName ||
                     newPermission.protectionLevel != oldPermission.protectionLevel || (
-                        oldPermission.isReconciled && newPermission.isRuntime &&
-                            newPermission.groupName != null &&
-                            newPermission.groupName != oldPermission.groupName
+                        oldPermission.isReconciled && (
+                            (
+                                newPermission.isKnownSigner &&
+                                    newPermission.knownCerts != oldPermission.knownCerts
+                            ) || (
+                                newPermission.isRuntime && newPermission.groupName != null &&
+                                    newPermission.groupName != oldPermission.groupName
+                            )
+                        )
                     )
                 if (isPermissionChanged) {
                     changedPermissionNames += permissionName