diff --git a/src/java.base/share/lib/security/default.policy b/src/java.base/share/lib/security/default.policy
index e9a6b0c502a..089cecef7cd 100644
--- a/src/java.base/share/lib/security/default.policy
+++ b/src/java.base/share/lib/security/default.policy
@@ -218,6 +218,8 @@ grant codeBase "jrt:/jdk.security.jgss" {
 
 grant codeBase "jrt:/jdk.zipfs" {
     permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete";
+    // SapMachine 2026-04-13: symlink support for zipfs entries in sapext.
+    permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.access";
     permission java.lang.RuntimePermission "fileSystemProvider";
     permission java.lang.RuntimePermission "accessUserInformation";
     permission java.util.PropertyPermission "os.name", "read";