diff --git a/images/fedora-cosmic/custom.yaml b/images/fedora-cosmic/custom.yaml
index 26accc2..9e534ff 100644
--- a/images/fedora-cosmic/custom.yaml
+++ b/images/fedora-cosmic/custom.yaml
@@ -46,6 +46,7 @@ add-files:
   - ["kanidm-password-auth", "/usr/share/fedora-cosmic/authselect/password-auth"]
   - ["kanidm-nsswitch.conf", "/usr/share/fedora-cosmic/authselect/nsswitch.conf"]
   - ["50-kanidm.preset", "/usr/lib/systemd/system-preset/50-kanidm.preset"]
+  - ["kanidm-unixd.cil", "/usr/share/fedora-cosmic/kanidm-unixd.cil"]
 
 postprocess:
   # The upstream fedora.yaml removes the Google Chrome repo from the Fedora
@@ -88,6 +89,14 @@ postprocess:
       install -m 0644 /usr/share/fedora-cosmic/authselect/nsswitch.conf /etc/nsswitch.conf
     fi
 
+  # Kanidm has no SELinux policy; install ours so nss/pam consumers (sshd,
+  # the display manager, systemd-userdbd, ...) can reach the kanidm-unixd
+  # sockets and resolve Kanidm users.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    semodule -n -i /usr/share/fedora-cosmic/kanidm-unixd.cil
+
   # Kanidm does not ship an SELinux policy yet; let the unixd daemons run.
   - |
     #!/usr/bin/env bash
diff --git a/images/fedora-cosmic/files/kanidm-unixd.cil b/images/fedora-cosmic/files/kanidm-unixd.cil
new file mode 100644
index 0000000..93b5cf1
--- /dev/null
+++ b/images/fedora-cosmic/files/kanidm-unixd.cil
@@ -0,0 +1,21 @@
+; Kanidm ships no SELinux policy. Without these allows, nss/pam consumers
+; (sshd, the display manager, systemd-userdbd, ...) are denied write access to
+; the kanidm-unixd sockets in /run/kanidm-unixd (labeled var_run_t), so Kanidm
+; users cannot be resolved or authenticated and logins fail (sshd reports
+; "invalid user"). This is the allow set produced by:
+;   grep avc: /var/log/audit/audit.log | audit2allow
+(allow accountsd_t var_run_t (sock_file (write)))
+(allow auditd_t var_run_t (sock_file (write)))
+(allow chkpwd_t var_run_t (sock_file (write)))
+(allow local_login_t var_run_t (sock_file (write)))
+(allow policykit_t var_run_t (sock_file (write)))
+(allow ssh_keygen_t var_run_t (sock_file (write)))
+(allow sshd_auth_t var_run_t (sock_file (write)))
+(allow sshd_keygen_t var_run_t (sock_file (write)))
+(allow sshd_session_t var_run_t (sock_file (write)))
+(allow sshd_t var_run_t (sock_file (write)))
+(allow systemd_bootc_generator_t var_run_t (sock_file (write)))
+(allow systemd_selinux_autorelabel_generator_t var_run_t (sock_file (write)))
+(allow systemd_userdbd_t var_run_t (sock_file (write)))
+(allow xdm_t var_run_t (sock_file (write)))
+(allow init_t unconfined_service_t (unix_stream_socket (connectto)))