diff --git a/core/java/android/hardware/fingerprint/FingerprintManager.java b/core/java/android/hardware/fingerprint/FingerprintManager.java
index 82d3e0ac50bd0..15c7aaf993c48 100644
--- a/core/java/android/hardware/fingerprint/FingerprintManager.java
+++ b/core/java/android/hardware/fingerprint/FingerprintManager.java
@@ -519,6 +519,21 @@ public class FingerprintManager {
         return result;
     }
 
+    /**
+     * Finishes enrollment and cancels the current auth token.
+     * @hide
+     */
+    @RequiresPermission(MANAGE_FINGERPRINT)
+    public int postEnroll() {
+        int result = 0;
+        if (mService != null) try {
+            result = mService.postEnroll(mToken);
+        } catch (RemoteException e) {
+            Log.w(TAG, "Remote exception in post enroll: ", e);
+        }
+        return result;
+    }
+
     /**
      * Remove given fingerprint template from fingerprint hardware and/or protected storage.
      * @param fp the fingerprint item to remove
diff --git a/core/java/android/hardware/fingerprint/IFingerprintDaemon.aidl b/core/java/android/hardware/fingerprint/IFingerprintDaemon.aidl
index 186d36ebd3736..9c13523e7b186 100644
--- a/core/java/android/hardware/fingerprint/IFingerprintDaemon.aidl
+++ b/core/java/android/hardware/fingerprint/IFingerprintDaemon.aidl
@@ -21,7 +21,7 @@ import android.hardware.fingerprint.IFingerprintDaemonCallback;
  * Communication channel from FingerprintService to FingerprintDaemon (fingerprintd)
  * @hide
  */
- 
+
 interface IFingerprintDaemon {
     int authenticate(long sessionId, int groupId);
     int cancelAuthentication();
@@ -34,4 +34,5 @@ interface IFingerprintDaemon {
     long openHal();
     int closeHal();
     void init(IFingerprintDaemonCallback callback);
+    int postEnroll();
 }
diff --git a/core/java/android/hardware/fingerprint/IFingerprintService.aidl b/core/java/android/hardware/fingerprint/IFingerprintService.aidl
index f596c9396222b..5e233b87343eb 100644
--- a/core/java/android/hardware/fingerprint/IFingerprintService.aidl
+++ b/core/java/android/hardware/fingerprint/IFingerprintService.aidl
@@ -54,6 +54,9 @@ interface IFingerprintService {
     // Get a pre-enrollment authentication token
     long preEnroll(IBinder token);
 
+    // Finish an enrollment sequence and invalidate the authentication token
+    int postEnroll(IBinder token);
+
     // Determine if a user has at least one enrolled fingerprint
     boolean hasEnrolledFingerprints(int groupId, String opPackageName);
 
diff --git a/services/core/java/com/android/server/fingerprint/FingerprintService.java b/services/core/java/com/android/server/fingerprint/FingerprintService.java
index 96a60ee521410..4d8d10568f0ad 100644
--- a/services/core/java/com/android/server/fingerprint/FingerprintService.java
+++ b/services/core/java/com/android/server/fingerprint/FingerprintService.java
@@ -301,6 +301,20 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe
         return 0;
     }
 
+    public int startPostEnroll(IBinder token) {
+        IFingerprintDaemon daemon = getFingerprintDaemon();
+        if (daemon == null) {
+            Slog.w(TAG, "startPostEnroll: no fingeprintd!");
+            return 0;
+        }
+        try {
+            return daemon.postEnroll();
+        } catch (RemoteException e) {
+            Slog.e(TAG, "startPostEnroll failed", e);
+        }
+        return 0;
+    }
+
     private void stopPendingOperations() {
         if (mEnrollClient != null) {
             stopEnrollment(mEnrollClient.token, true);
@@ -634,6 +648,12 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe
             return startPreEnroll(token);
         }
 
+        @Override // Binder call
+        public int postEnroll(IBinder token) {
+            checkPermission(MANAGE_FINGERPRINT);
+            return startPostEnroll(token);
+        }
+
         @Override // Binder call
         public void enroll(final IBinder token, final byte[] cryptoToken, final int groupId,
                 final IFingerprintServiceReceiver receiver, final int flags) {