diff --git a/services/core/java/com/android/server/location/contexthub/ContextHubClientBroker.java b/services/core/java/com/android/server/location/contexthub/ContextHubClientBroker.java
index 442abc91a3704..dcf415f4cb4ac 100644
--- a/services/core/java/com/android/server/location/contexthub/ContextHubClientBroker.java
+++ b/services/core/java/com/android/server/location/contexthub/ContextHubClientBroker.java
@@ -605,6 +605,9 @@ public class ContextHubClientBroker extends IContextHubClient.Stub
         for (String permission : permissions) {
             int opCode = mAppOpsManager.permissionToOpCode(permission);
             if (opCode != AppOpsManager.OP_NONE) {
+                // The noteOp call may check for required permissions. Use the below logic to ensure
+                // that the system server permission is enforced at the call.
+                long token = Binder.setCallingWorkSourceUid(android.os.Process.myUid());
                 try {
                     if (mAppOpsManager.noteOp(opCode, mUid, mPackage, mAttributionTag, noteMessage)
                             != AppOpsManager.MODE_ALLOWED) {
@@ -614,6 +617,8 @@ public class ContextHubClientBroker extends IContextHubClient.Stub
                     Log.e(TAG, "SecurityException: noteOp for pkg " + mPackage + " opcode "
                             + opCode + ": " + e.getMessage());
                     return false;
+                } finally {
+                    Binder.restoreCallingWorkSource(token);
                 }
             }
         }