diff --git a/Patches/Common/android_vendor_divested/divestos.mk b/Patches/Common/android_vendor_divested/divestos.mk
index eee3d475..5533d4f6 100644
--- a/Patches/Common/android_vendor_divested/divestos.mk
+++ b/Patches/Common/android_vendor_divested/divestos.mk
@@ -22,8 +22,7 @@ PRODUCT_PROPERTY_OVERRIDES += \
 #Copy extra files
 PRODUCT_COPY_FILES += \
     vendor/divested/prebuilts/etc/additional_fdroid_repos.xml:system/etc/org.fdroid.fdroid/additional_repos.xml \
-    vendor/divested/prebuilts/etc/additional_fdroid_repos.xml:system/etc/org.fdroid.basic/additional_repos.xml \
-    vendor/divested/prebuilts/etc/microg.xml:system/etc/microg.xml
+    vendor/divested/prebuilts/etc/additional_fdroid_repos.xml:system/etc/org.fdroid.basic/additional_repos.xml
 
 #Include packages
 include vendor/divested/packages.mk
diff --git a/Patches/Common/android_vendor_divested/packages.mk b/Patches/Common/android_vendor_divested/packages.mk
index 378d7385..d59c8614 100644
--- a/Patches/Common/android_vendor_divested/packages.mk
+++ b/Patches/Common/android_vendor_divested/packages.mk
@@ -16,7 +16,8 @@ endif
 # Extras
 PRODUCT_PACKAGES += \
     TalkBack \
-    SupportDivestOS
+    SupportDivestOS \
+    microg.xml
 
 # Notes
 # - Available (via PrebuiltApps submodule): eSpeakNG
diff --git a/Patches/Common/android_vendor_divested/strict_microG/Android.mk b/Patches/Common/android_vendor_divested/strict_microG/Android.mk
new file mode 100644
index 00000000..40e5ff2b
--- /dev/null
+++ b/Patches/Common/android_vendor_divested/strict_microG/Android.mk
@@ -0,0 +1,31 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Set strict defaults for microG
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := microg.xml
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_TAGS := optional
+LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT_ETC)
+LOCAL_SRC_FILES := $(LOCAL_MODULE)
+LOCAL_PRODUCT_MODULE := true
+
+
+include $(BUILD_PREBUILT)
diff --git a/Patches/Common/android_vendor_divested/prebuilts/etc/microg.xml b/Patches/Common/android_vendor_divested/strict_microG/microg.xml
similarity index 100%
rename from Patches/Common/android_vendor_divested/prebuilts/etc/microg.xml
rename to Patches/Common/android_vendor_divested/strict_microG/microg.xml
diff --git a/Patches/LineageOS-20.0/android_frameworks_base/0036-Hardened-signature-spoofing.patch b/Patches/LineageOS-20.0/android_frameworks_base/0036-Hardened-signature-spoofing.patch
index b8737af9..c16d4d7d 100644
--- a/Patches/LineageOS-20.0/android_frameworks_base/0036-Hardened-signature-spoofing.patch
+++ b/Patches/LineageOS-20.0/android_frameworks_base/0036-Hardened-signature-spoofing.patch
@@ -92,7 +92,7 @@ index a01ec67630de..20ab9e79ae79 100644
  
      <!-- Package name(s) of Advanced Driver Assistance applications. These packages have additional
 diff --git a/services/core/java/com/android/server/pm/ComputerEngine.java b/services/core/java/com/android/server/pm/ComputerEngine.java
-index 58448bfefdaf..50678f515dde 100644
+index 58448bfefdaf..6047737af2ab 100644
 --- a/services/core/java/com/android/server/pm/ComputerEngine.java
 +++ b/services/core/java/com/android/server/pm/ComputerEngine.java
 @@ -99,6 +99,7 @@ import android.os.IBinder;
diff --git a/Scripts/Common/Functions.sh b/Scripts/Common/Functions.sh
index ec7b06c8..9f6e7ce4 100644
--- a/Scripts/Common/Functions.sh
+++ b/Scripts/Common/Functions.sh
@@ -507,8 +507,10 @@ hardenLocationSerials() {
 	#Prevent Qualcomm location stack from sending chipset serial number
 
 	#Devices using blob xtra-daemon (which Deblob.sh removes)
-	find device -name "hal_gnss*.te" -type f -exec sh -c "awk -i inplace '!/sysfs_soc/' {}" \;
-	find device -name "location.te" -type f -exec sh -c "awk -i inplace '!/sysfs_soc/' {}" \;
+	if [[ "$DOS_VERSION" != "LineageOS-20.0" ]]; then #20.0 has sysfs_soc_sensitive label
+		find device -name "hal_gnss*.te" -type f -exec sh -c "awk -i inplace '!/sysfs_soc/' {}" \;
+		find device -name "location.te" -type f -exec sh -c "awk -i inplace '!/sysfs_soc/' {}" \;
+	fi;
 
 	#Devices using source built libloc, these ones typically have broad /sys access
 	## Null out the User-Agent header
diff --git a/Scripts/init.sh b/Scripts/init.sh
index bbbae481..a095be42 100644
--- a/Scripts/init.sh
+++ b/Scripts/init.sh
@@ -65,7 +65,7 @@ export DOS_GRAPHENE_MALLOC=true; #Enables use of GrapheneOS' hardened memory all
 export DOS_GRAPHENE_EXEC=true; #Enables use of GrapheneOS' exec spawning feature on 16.0+17.1+18.1+19.1+20.0
 export DOS_HOSTS_BLOCKING=true; #Set false to prevent inclusion of a HOSTS file
 export DOS_HOSTS_BLOCKING_LIST="https://divested.dev/hosts-wildcards"; #Must be in the format "127.0.0.1 bad.domain.tld"
-export DOS_MICROG_SUPPORT=true; #Opt-in unprivileged microG support on 17.1+18.1+19.1+20.0
+export DOS_MICROG_SUPPORT=false; #Opt-in unprivileged microG support on 17.1+18.1+19.1+20.0
 export DOS_SENSORS_PERM=false; #Set true to provide a per-app sensors permission for 14.1/15.1 #XXX: can break things like camera
 export DOS_STRONG_ENCRYPTION_ENABLED=false; #Set true to enable AES 256-bit FDE encryption on 14.1+15.1 XXX: THIS WILL **DESTROY** EXISTING INSTALLS!
 export DOS_WEBVIEW_LFS=true; #Whether to `git lfs pull` in the WebView repository