diff --git a/contrib/apparmor/template.go b/contrib/apparmor/template.go
index 20ac3c9bf..75df0d99e 100644
--- a/contrib/apparmor/template.go
+++ b/contrib/apparmor/template.go
@@ -77,6 +77,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   deny /sys/fs/c[^g]*/** wklx,
   deny /sys/fs/cg[^r]*/** wklx,
   deny /sys/firmware/** rwklx,
+  deny /sys/devices/virtual/powercap/** rwklx,
   deny /sys/kernel/security/** rwklx,
 
   # allow processes within the container to trace each other,