diff --git a/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml b/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
index 8c9f52392..71a7470e1 100644
--- a/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
+++ b/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
@@ -502,6 +502,7 @@
       loop:
         - "{{ tftp_boot_folder }}"
         - "{{ tftp_boot_folder }}/pxelinux.cfg"
+        - "{{ ironic_tftp_master_path }}"
 
     - name: "Add proper context on created data for http_boot"
       sefcontext:
@@ -518,8 +519,9 @@
       loop:
         - "{{ http_boot_folder }}"
         - "{{ tftp_boot_folder }}"
+        - "{{ ironic_tftp_master_path }}"
   when: (ansible_os_family == 'RedHat' or ansible_os_family == 'Suse') and
-         ansible_selinux.status == 'enabled' and ansible_selinux.mode == "enforcing"
+         ansible_selinux.status == 'enabled'
 - name: "Configure remote logging"
   template: src=10-rsyslog-remote.conf.j2 dest=/etc/rsyslog.d/10-rsyslog-remote.conf
   when:
diff --git a/releasenotes/notes/selinux-tftp-c37e34311238f8fd.yaml b/releasenotes/notes/selinux-tftp-c37e34311238f8fd.yaml
new file mode 100644
index 000000000..e2b817134
--- /dev/null
+++ b/releasenotes/notes/selinux-tftp-c37e34311238f8fd.yaml
@@ -0,0 +1,7 @@
+---
+fixes:
+  - |
+    An issue has been fixed where enforcing SELinux resulted in files in
+    ``tftp_boot_folder`` not being readable by dnsmasq. This has been fixed by
+    ensuring files in ``ironic_tftp_master_path`` have the SELinux context
+    ``tftpdir_t``.
\ No newline at end of file