diff --git a/module/post-fs-data.sh b/module/post-fs-data.sh
index 2129668..3249525 100644
--- a/module/post-fs-data.sh
+++ b/module/post-fs-data.sh
@@ -13,18 +13,25 @@ fi
 
 # Conditional early sensitive properties
 
-# RootBeer, Microsoft
-resetprop_if_diff ro.build.tags release-keys
-
 # Samsung
 resetprop_if_diff ro.boot.warranty_bit 0
 resetprop_if_diff ro.vendor.boot.warranty_bit 0
 resetprop_if_diff ro.vendor.warranty_bit 0
 resetprop_if_diff ro.warranty_bit 0
 
+# Xiaomi
+resetprop_if_diff ro.secureboot.lockstate locked
+
+# Realme
+resetprop_if_diff ro.boot.realme.lockstate 1
+resetprop_if_diff ro.boot.realmebootstate green
+
 # OnePlus
 resetprop_if_diff ro.is_ever_orange 0
 
+# Microsoft, RootBeer
+resetprop_if_diff ro.build.tags release-keys
+
 # Other
 resetprop_if_diff ro.build.type user
 resetprop_if_diff ro.debuggable 0
diff --git a/module/service.sh b/module/service.sh
index 6a02e95..5ace630 100644
--- a/module/service.sh
+++ b/module/service.sh
@@ -9,6 +9,8 @@ resetprop_if_match ro.boot.mode recovery unknown
 resetprop_if_match vendor.boot.mode recovery unknown
 
 # SELinux
+resetprop_if_diff ro.boot.selinux enforcing
+# use delete since it can be 0 or 1 for enforcing depending on OEM
 if [ -n "$(resetprop ro.build.selinux)" ]; then
     resetprop --delete ro.build.selinux
 fi