diff --git a/core/config.mk b/core/config.mk
index c388fc0a3f..fc1140521b 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -888,9 +888,21 @@ BUILD_DATETIME_FROM_FILE := $$(cat $(BUILD_DATETIME_FILE))
 
 # SEPolicy versions
 
-# PLATFORM_SEPOLICY_VERSION is a number of the form "YYYYMM" with "YYYYMM"
-# mapping to vFRC version.
-PLATFORM_SEPOLICY_VERSION := $(BOARD_API_LEVEL)
+# PLATFORM_SEPOLICY_VERSION is a number of the form "YYYYMM.0" with "YYYYMM"
+# mapping to vFRC version.  This value will be set to 1000000.0 to represent
+# tip-of-tree development that is inherently unstable and thus designed not to
+# work with any shipping vendor policy.  This is similar in spirit to how
+# DEFAULT_APP_TARGET_SDK is set.
+sepolicy_vers := $(BOARD_API_LEVEL).0
+
+TOT_SEPOLICY_VERSION := 1000000.0
+ifeq (true,$(RELEASE_BOARD_API_LEVEL_FROZEN))
+    PLATFORM_SEPOLICY_VERSION := $(sepolicy_vers)
+else
+    PLATFORM_SEPOLICY_VERSION := $(TOT_SEPOLICY_VERSION)
+endif
+sepolicy_vers :=
+
 BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION)
 .KATI_READONLY := PLATFORM_SEPOLICY_VERSION BOARD_SEPOLICY_VERS
 
@@ -907,6 +919,7 @@ PLATFORM_SEPOLICY_COMPAT_VERSIONS := $(filter-out $(PLATFORM_SEPOLICY_VERSION),
 .KATI_READONLY := \
     PLATFORM_SEPOLICY_COMPAT_VERSIONS \
     PLATFORM_SEPOLICY_VERSION \
+    TOT_SEPOLICY_VERSION \
 
 ifeq ($(PRODUCT_RETROFIT_DYNAMIC_PARTITIONS),true)
   ifneq ($(PRODUCT_USE_DYNAMIC_PARTITIONS),true)
diff --git a/core/soong_config.mk b/core/soong_config.mk
index 84179a07bb..7d03aa3104 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -228,6 +228,7 @@ $(call add_json_str,  SystemExtSepolicyPrebuiltApiDir,   $(BOARD_SYSTEM_EXT_PREB
 $(call add_json_str,  ProductSepolicyPrebuiltApiDir,     $(BOARD_PRODUCT_PREBUILT_DIR))
 
 $(call add_json_str,  PlatformSepolicyVersion,           $(PLATFORM_SEPOLICY_VERSION))
+$(call add_json_str,  TotSepolicyVersion,                $(TOT_SEPOLICY_VERSION))
 $(call add_json_list, PlatformSepolicyCompatVersions,    $(PLATFORM_SEPOLICY_COMPAT_VERSIONS))
 
 $(call add_json_bool, ForceApexSymlinkOptimization,      $(filter true,$(TARGET_FORCE_APEX_SYMLINK_OPTIMIZATION)))