diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index 008a8ba9b6..e40898d10b 100644
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -185,7 +185,7 @@ int mac_selinux_generic_access_check(
         _cleanup_free_ char *cl = NULL;
         _cleanup_freecon_ char *fcon = NULL;
         char **cmdline = NULL;
-        const bool enforce = mac_selinux_enforcing();
+        bool enforce;
         int r = 0;
 
         assert(message);
@@ -196,6 +196,9 @@ int mac_selinux_generic_access_check(
         if (r <= 0)
                 return r;
 
+        /* delay call until we checked in `access_init()` if SELinux is actually enabled */
+        enforce = mac_selinux_enforcing();
+
         r = sd_bus_query_sender_creds(
                         message,
                         SD_BUS_CREDS_PID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_EGID|