diff --git a/src/com/android/settings/spa/app/specialaccess/InstallUnknownApps.kt b/src/com/android/settings/spa/app/specialaccess/InstallUnknownApps.kt
index 1446bbca5b4..18ce585f1ee 100644
--- a/src/com/android/settings/spa/app/specialaccess/InstallUnknownApps.kt
+++ b/src/com/android/settings/spa/app/specialaccess/InstallUnknownApps.kt
@@ -23,6 +23,7 @@ import android.app.AppOpsManager.MODE_DEFAULT
 import android.app.AppOpsManager.OP_REQUEST_INSTALL_PACKAGES
 import android.content.Context
 import android.content.pm.ApplicationInfo
+import android.os.Process
 import android.os.UserManager
 import androidx.compose.runtime.Composable
 import com.android.settings.R
@@ -94,7 +95,10 @@ class InstallUnknownAppsListModel(private val context: Context) :
         private fun isChangeable(
             record: InstallUnknownAppsRecord,
             potentialPackageNames: Set<String>,
-        ) = record.app.packageName in potentialPackageNames
+        ) =
+           record.app.uid != Process.SYSTEM_UID && record.app.uid != Process.ROOT_UID &&
+               (record.appOpsController.getMode() != MODE_DEFAULT ||
+                    record.app.packageName in potentialPackageNames)
 
         private fun getPotentialPackageNames(userId: Int): Set<String> =
             AppGlobals.getPackageManager()