@@ -1,6 +1,7 @@
 disable systemd-firstboot.service
 
 enable apparmor.service
+enable apparmor-firstboot.service
 enable bluetooth.service
 enable cups.service
 enable firewalld.service
@@ -10,4 +11,4 @@ enable gdm.service
 enable gnome-initial-setup.service
 enable NetworkManager.service
 enable systemd-resolved.service
-enable power-profiles-daemon.service
+enable power-profiles-daemon.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Restart apparmor after configs were added by tmpfiles
+ConditionFirstBoot=yes
+After=systemd-tmpfiles-setup.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/systemctl reload --no-block apparmor.service
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target