diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
index 682b47c..40243be 100644
--- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
@@ -1123,7 +1123,12 @@ private fun KeyMintAttestation.toAuthorizations(
         }
         return Authorization().apply {
             this.keyParameter = param
-            this.securityLevel = SecurityLevel.SOFTWARE
+            // Real KeyMint HAL marks keystore-enforced metadata (creation
+            // time, user id, etc.) with SecurityLevel.KEYSTORE (0x64), not
+            // SOFTWARE (0x00). Using SOFTWARE here is detectable by probes
+            // that scan the generateKey reply parcel for the 0x00 byte at
+            // the securityLevel slot of the last authorization entry.
+            this.securityLevel = SecurityLevel.KEYSTORE
         }
     }