diff --git a/elements/rpm-distro/finalise.d/11-selinux-fixfiles-restore b/elements/rpm-distro/finalise.d/11-selinux-fixfiles-restore
index a82525a6..84ff7e58 100755
--- a/elements/rpm-distro/finalise.d/11-selinux-fixfiles-restore
+++ b/elements/rpm-distro/finalise.d/11-selinux-fixfiles-restore
@@ -5,7 +5,7 @@ if [ ${DIB_DEBUG_TRACE:-1} -gt 0 ]; then
 fi
 set -eu
 set -o pipefail
-SETFILES=$(which setfiles)
+SETFILES=$(which setfiles || true)
 if [ -e /etc/selinux/targeted/contexts/files/file_contexts -a -x "${SETFILES}" ]; then
     # Without fixing selinux file labels, sshd will run in the kernel_t domain
     # instead of the sshd_t domain, making ssh connections fail with