diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index eb69f10..97d7c77 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -1,4 +1,9 @@
 /data/misc/pawletcache(/.*)?    u:object_r:pawletcache_policy_file:s0
 
-# OEM/vendor-baked default policy — see vendor-config/README.md.
-/vendor/etc/pawletcache(/.*)?   u:object_r:pawletcache_vendor_config_file:s0
+# OEM/vendor-baked default policy — see vendor-config/README.md. No custom
+# type/label needed: this falls under AOSP's default /vendor/etc(/.*)? ->
+# vendor_configs_file file_contexts pattern, and every domain already has
+# blanket read access to vendor_configs_file (system/sepolicy/private/
+# domain.te). A custom vendor_file_type subtype here would trip the
+# coredomain-can't-read-/vendor neverallow, since it isn't in that rule's
+# exception list the way vendor_configs_file is.
diff --git a/sepolicy/pawlet_cache.te b/sepolicy/pawlet_cache.te
index ccc1d54..15ea7f8 100644
--- a/sepolicy/pawlet_cache.te
+++ b/sepolicy/pawlet_cache.te
@@ -33,8 +33,7 @@ allow pawlet_cache pawletcache_policy_file:file { read open getattr };
 allow pawlet_cache pawletcache_policy_file:dir { read open getattr search };
 
 # OEM/vendor-baked default policy (read-only, build-time) — see
-# vendor-config/README.md. vendor_file_type is required for a type to live
-# under /vendor per Treble's vendor/system sepolicy split.
-type pawletcache_vendor_config_file, file_type, vendor_file_type;
-allow pawlet_cache pawletcache_vendor_config_file:file { read open getattr };
-allow pawlet_cache pawletcache_vendor_config_file:dir { read open getattr search };
+# vendor-config/README.md and sepolicy/file_contexts. Lives under
+# /vendor/etc/pawletcache, labeled vendor_configs_file by AOSP's default
+# file_contexts pattern; no per-domain allow rule needed since every domain
+# already has blanket read access to vendor_configs_file platform-wide.