diff --git a/vault/policy_store.go b/vault/policy_store.go
index 22750cf88f..0b42b429dc 100644
--- a/vault/policy_store.go
+++ b/vault/policy_store.go
@@ -296,6 +296,10 @@ path "cubbyhole/*" {
 path "cubbyhole" {
     capabilities = ["list"]
 }
+
+path "sys/capabilities-self" {
+    capabilities = ["update"]
+}
 `)
 	if err != nil {
 		return errwrap.Wrapf("error parsing default policy: {{err}}", err)