diff --git a/src/basic/env-file.c b/src/basic/env-file.c
index 226d578d38..c2cbff4d84 100644
--- a/src/basic/env-file.c
+++ b/src/basic/env-file.c
@@ -637,3 +637,11 @@ int write_env_file(int dir_fd, const char *fname, char **headers, char **l) {
         (void) unlinkat(dir_fd, p, 0);
         return r;
 }
+
+int write_vconsole_conf(int dir_fd, const char *fname, char **l) {
+        char **headers = STRV_MAKE(
+                "# Written by systemd-localed(8) or systemd-firstboot(1), read by systemd-localed",
+                "# and systemd-vconsole-setup(8). Use localectl(1) to update this file.");
+
+        return write_env_file(dir_fd, fname, headers, l);
+}
diff --git a/src/basic/env-file.h b/src/basic/env-file.h
index a9714cfd53..37db30765b 100644
--- a/src/basic/env-file.h
+++ b/src/basic/env-file.h
@@ -20,3 +20,5 @@ int load_env_file_pairs_fd(int fd, const char *fname, char ***ret);
 int merge_env_file(char ***env, FILE *f, const char *fname);
 
 int write_env_file(int dir_fd, const char *fname, char **headers, char **l);
+
+int write_vconsole_conf(int dir_fd, const char *fname, char **l);
diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
index 6a5b5715c1..6cf7415a18 100644
--- a/src/firstboot/firstboot.c
+++ b/src/firstboot/firstboot.c
@@ -534,7 +534,7 @@ static int process_keymap(int rfd) {
 
         keymap = STRV_MAKE(strjoina("KEYMAP=", arg_keymap));
 
-        r = write_env_file(pfd, f, NULL, keymap);
+        r = write_vconsole_conf(pfd, f, keymap);
         if (r < 0)
                 return log_error_errno(r, "Failed to write /etc/vconsole.conf: %m");
 
diff --git a/src/locale/localed-util.c b/src/locale/localed-util.c
index eca765c3f2..199f05b917 100644
--- a/src/locale/localed-util.c
+++ b/src/locale/localed-util.c
@@ -532,7 +532,7 @@ int vconsole_write_data(Context *c) {
                 return 0;
         }
 
-        r = write_env_file_label(AT_FDCWD, "/etc/vconsole.conf", NULL, l);
+        r = write_vconsole_conf_label(l);
         if (r < 0)
                 return r;
 
diff --git a/src/shared/env-file-label.c b/src/shared/env-file-label.c
index 0ab2bb9b74..5917b6377f 100644
--- a/src/shared/env-file-label.c
+++ b/src/shared/env-file-label.c
@@ -19,3 +19,17 @@ int write_env_file_label(int dir_fd, const char *fname, char **headers, char **l
 
         return r;
 }
+
+int write_vconsole_conf_label(char **l) {
+        int r;
+
+        r = mac_selinux_create_file_prepare("/etc/vconsole.conf", S_IFREG);
+        if (r < 0)
+                return r;
+
+        r = write_vconsole_conf(AT_FDCWD, "/etc/vconsole.conf", l);
+
+        mac_selinux_create_file_clear();
+
+        return r;
+}
diff --git a/src/shared/env-file-label.h b/src/shared/env-file-label.h
index 1f1d727b69..5ba45e4005 100644
--- a/src/shared/env-file-label.h
+++ b/src/shared/env-file-label.h
@@ -6,3 +6,5 @@
  * for all */
 
 int write_env_file_label(int dir_fd, const char *fname, char **headers, char **l);
+
+int write_vconsole_conf_label(char **l);