diff --git a/post-fs-data.sh b/post-fs-data.sh
new file mode 100755
index 0000000..404cd3b
--- /dev/null
+++ b/post-fs-data.sh
@@ -0,0 +1,12 @@
+#!/system/bin/sh
+
+set -eufo pipefail
+
+system_patch="$(getprop ro.build.version.security_patch)"
+vendor_patch="$(getprop ro.vendor.build.security_patch)"
+
+# Fix mismatching security patch levels
+if [[ "$system_patch" != "$vendor_patch" ]]; then
+    resetprop ro.build.version.security_patch "$vendor_patch"
+    resetprop ro.build.version.real_security_patch "$system_patch"
+fi