diff --git a/config/common.mk b/config/common.mk
index 51feb85..f175568 100644
--- a/config/common.mk
+++ b/config/common.mk
@@ -94,6 +94,10 @@ PRODUCT_PACKAGES += \
     PawletSetupWizard \
     BgUpd
 
+# bg-upd's own sepolicy domain — lives in its own repo (packages/apps/BgUpd/sepolicy),
+# included unconditionally since it's a core PawletOS system app, not an optional one.
+BOARD_SEPOLICY_DIRS += packages/apps/BgUpd/sepolicy
+
 # ---------------------------------------------------------------------------
 # Day-one default WebView provider (com.android.webview / "chromium"), so the
 # device boots with a working WebView before bg-upd's first check ever runs.
diff --git a/config/version.mk b/config/version.mk
index 6b08e40..de655f3 100644
--- a/config/version.mk
+++ b/config/version.mk
@@ -42,6 +42,17 @@ PAWLET_VERSION := $(PAWLET_MAJOR_VERSION).$(PAWLET_MINOR_VERSION)-$(PAWLET_VERSI
 # Short display version (major-suffix, like LineageOS 23-<suffix>)
 PAWLET_DISPLAY_VERSION := $(PAWLET_MAJOR_VERSION)-$(PAWLET_VERSION_SUFFIX)
 
+# ---------------------------------------------------------------------------
+# Security patch level
+# ---------------------------------------------------------------------------
+# Bumped manually whenever a monthly AOSP security bulletin's patches are
+# actually backported into the tree — this is a record of work done, not
+# something CI infers automatically. See PawletOS-Build/docs/security-patch-process.md
+# and PawletOS-Build/scripts/check_security_patch.py (run the latter to see
+# how far behind this date is against the latest published AOSP bulletin).
+PAWLET_SECURITY_PATCH := 2026-07-05
+PLATFORM_SECURITY_PATCH := $(PAWLET_SECURITY_PATCH)
+
 # ---------------------------------------------------------------------------
 # System properties written into /product/build.prop
 # ---------------------------------------------------------------------------