diff --git a/elements/fedora/finalise.d/11-selinux-autorelabel b/elements/fedora/finalise.d/11-selinux-autorelabel
new file mode 100755
index 00000000..880fdba2
--- /dev/null
+++ b/elements/fedora/finalise.d/11-selinux-autorelabel
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Without fixing selinux file labels, sshd will run in the kernel_t domain
+# instead of the sshd_t domain, making ssh connections fail with
+# "Unable to get valid context for <user>" error message
+touch /.autorelabel