diff --git a/lib/src/install.rs b/lib/src/install.rs
index d8d553f8b..5519ecc6c 100644
--- a/lib/src/install.rs
+++ b/lib/src/install.rs
@@ -313,6 +313,15 @@ impl State {
         tracing::debug!("Loaded SELinux policy: {csum}");
         Ok(Some(r))
     }
+
+    #[context("Finalizing state")]
+    pub(crate) fn consume(self) -> Result<()> {
+        // If we had invoked `setenforce 0`, then let's re-enable it.
+        if let SELinuxFinalState::Enabled(Some(guard)) = self.selinux_state {
+            guard.consume()?;
+        }
+        Ok(())
+    }
 }
 
 /// Path to initially deployed version information
@@ -1244,10 +1253,7 @@ pub(crate) async fn install_to_disk(mut opts: InstallToDiskOpts) -> Result<()> {
 
     // At this point, all other threads should be gone.
     if let Some(state) = Arc::into_inner(state) {
-        // If we had invoked `setenforce 0`, then let's re-enable it.
-        if let SELinuxFinalState::Enabled(Some(guard)) = state.selinux_state {
-            guard.consume()?;
-        }
+        state.consume()?;
     } else {
         // This shouldn't happen...but we will make it not fatal right now
         tracing::warn!("Failed to consume state Arc");