diff --git a/core/api/system-current.txt b/core/api/system-current.txt
index b5b681b18bf7c..2a0dddc6d088d 100644
--- a/core/api/system-current.txt
+++ b/core/api/system-current.txt
@@ -380,6 +380,7 @@ package android {
     field public static final int config_systemSpeechRecognizer;
     field public static final int config_systemTelevisionNotificationHandler;
     field public static final int config_systemTextIntelligence;
+    field public static final int config_systemUi;
     field public static final int config_systemUiIntelligence;
     field public static final int config_systemVisualIntelligence;
     field public static final int config_systemWellbeing;
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index 9d65e71317c56..f9945c70efd71 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -5578,12 +5578,12 @@
     <!-- @SystemApi Allows sensor privacy to be modified.
          @hide -->
     <permission android:name="android.permission.MANAGE_SENSOR_PRIVACY"
-                android:protectionLevel="signature" />
+                android:protectionLevel="internal|role" />
 
     <!-- @SystemApi Allows sensor privacy changes to be observed.
          @hide -->
     <permission android:name="android.permission.OBSERVE_SENSOR_PRIVACY"
-                android:protectionLevel="signature|installer" />
+                android:protectionLevel="internal|role|installer" />
 
     <!-- @SystemApi Permission that protects the {@link Intent#ACTION_REVIEW_ACCESSIBILITY_SERVICES}
          intent.
diff --git a/core/res/res/values/config.xml b/core/res/res/values/config.xml
index 097244d2a5a0c..c2a7e079b1f9f 100644
--- a/core/res/res/values/config.xml
+++ b/core/res/res/values/config.xml
@@ -1951,6 +1951,8 @@
     <string name="config_systemTelevisionNotificationHandler" translatable="false"></string>
     <!-- The name of the package that will hold the system activity recognizer role. -->
     <string name="config_systemActivityRecognizer" translatable="false"></string>
+    <!-- The name of the package that will hold the system ui role -->
+    <string name="config_systemUi" translatable="false">com.android.systemui</string>
 
     <!-- The name of the package that will be allowed to change its components' label/icon. -->
     <string name="config_overrideComponentUiPackage" translatable="false">com.android.stk</string>
diff --git a/core/res/res/values/public.xml b/core/res/res/values/public.xml
index 2a76c57f9e07a..c716000742178 100644
--- a/core/res/res/values/public.xml
+++ b/core/res/res/values/public.xml
@@ -3228,6 +3228,8 @@
     <public name="config_systemActivityRecognizer" />
     <!-- @hide @SystemApi -->
     <public name="config_systemCompanionDeviceProvider"/>
+    <!-- @hide @SystemApi -->
+    <public name="config_systemUi" />
   </staging-public-group>
 
   <staging-public-group type="id" first-id="0x01020055">
diff --git a/services/java/com/android/server/SystemServer.java b/services/java/com/android/server/SystemServer.java
index 4c4c5821a2dbb..6dedca190e2b9 100644
--- a/services/java/com/android/server/SystemServer.java
+++ b/services/java/com/android/server/SystemServer.java
@@ -2731,13 +2731,6 @@ public final class SystemServer implements Dumpable {
                 t.traceEnd();
             }
 
-            t.traceBegin("StartSystemUI");
-            try {
-                startSystemUi(context, windowManagerF);
-            } catch (Throwable e) {
-                reportWtf("starting System UI", e);
-            }
-            t.traceEnd();
             // Enable airplane mode in safe mode. setAirplaneMode() cannot be called
             // earlier as it sends broadcasts to other services.
             // TODO: This may actually be too late if radio firmware already started leaking
@@ -2939,6 +2932,14 @@ public final class SystemServer implements Dumpable {
             }
         }, t);
 
+        t.traceBegin("StartSystemUI");
+        try {
+            startSystemUi(context, windowManagerF);
+        } catch (Throwable e) {
+            reportWtf("starting System UI", e);
+        }
+        t.traceEnd();
+
         t.traceEnd(); // startOtherServices
     }