diff --git a/opendbc_repo/opendbc/car/gm/tests/test_aol_registry.py b/opendbc_repo/opendbc/car/gm/tests/test_aol_registry.py
new file mode 100644
index 0000000000..08a507499e
--- /dev/null
+++ b/opendbc_repo/opendbc/car/gm/tests/test_aol_registry.py
@@ -0,0 +1,15 @@
+"""Every qualified GM word must reach pandad's native permission publisher."""
+
+import re
+import unittest
+from pathlib import Path
+
+from opendbc.car.gm.aol import GM_AOL_WORDS
+
+
+class TestGmAolRegistry(unittest.TestCase):
+  def test_pandad_registry_matches_qualified_gm_words(self):
+    root = Path(__file__).resolve().parents[5]
+    policy = (root / "openpilot/starpilot/car/gm/aol_policy.h").read_text()
+    native_words = {int(word, 0) for word in re.findall(r"case (0x[0-9A-Fa-f]+|[0-9]+)U:", policy)}
+    self.assertEqual(native_words, GM_AOL_WORDS)
diff --git a/openpilot/selfdrive/pandad/pandad b/openpilot/selfdrive/pandad/pandad
index f890f4e205..2e121dde05 100755
Binary files a/openpilot/selfdrive/pandad/pandad and b/openpilot/selfdrive/pandad/pandad differ
diff --git a/openpilot/selfdrive/pandad/pandad.o b/openpilot/selfdrive/pandad/pandad.o
index 81a8f25afd..9b51a6bf35 100644
Binary files a/openpilot/selfdrive/pandad/pandad.o and b/openpilot/selfdrive/pandad/pandad.o differ
diff --git a/openpilot/selfdrive/pandad/tests/test_aol_protocol.cc b/openpilot/selfdrive/pandad/tests/test_aol_protocol.cc
index d35732098a..ce4e3e8589 100644
--- a/openpilot/selfdrive/pandad/tests/test_aol_protocol.cc
+++ b/openpilot/selfdrive/pandad/tests/test_aol_protocol.cc
@@ -374,7 +374,7 @@ int main() {
     forte.safety_mode = HYUNDAI_AOL_PROFILE.mode;
     assert(!aol_capable(forte, HYUNDAI_AOL_PROFILE.mode, VEHICLE_REGISTRY));
   }
-  for (const uint16_t word : {0U, 16U, 0xC161U, 0xC162U, 0x80U,
+  for (const uint16_t word : {0U, 16U, 0xC161U, 0xC162U, 0xC163U, 0x80U,
                             0xE100U, 0xE101U, 0xE102U, 0xE103U,
                             0xE110U, 0xE111U, 0xE112U, 0xE113U,
                             0xE200U, 0xE201U, 0xE202U, 0xE203U,
@@ -414,6 +414,7 @@ int main() {
     gateway.safety_mode = GM_AOL_PROFILE.mode;
     gateway.safety_param = word;
     assert(gm_aol_param(word));
+    assert(aol_runtime_enabled(false, gateway, VEHICLE_REGISTRY));
     queue(transport, gateway, gateway);
     const auto first = run(negotiator, transport, axis("gateway"), NOW, GM_AOL_PROFILE.mode);
     assert(first.plan.capable && first.plan.request_mask == 0U && first.outcome.compatible);
@@ -451,6 +452,7 @@ int main() {
     gm.safety_param = static_cast<uint16_t>(word);
     const auto decoded = parse_aol_status(bytes(gm).data(), sizeof(gm));
     assert(aol_capable(decoded, GM_AOL_PROFILE.mode, VEHICLE_REGISTRY) == gm_aol_param(gm.safety_param));
+    assert(aol_runtime_enabled(false, decoded, VEHICLE_REGISTRY) == gm_aol_param(gm.safety_param));
     gm.capability_flags = 0U;
     const auto absent = parse_aol_status(bytes(gm).data(), sizeof(gm));
     assert(!aol_capable(absent, GM_AOL_PROFILE.mode, VEHICLE_REGISTRY));
diff --git a/openpilot/starpilot/car/gm/aol_policy.h b/openpilot/starpilot/car/gm/aol_policy.h
index 19b896bd77..c8566b1093 100644
--- a/openpilot/starpilot/car/gm/aol_policy.h
+++ b/openpilot/starpilot/car/gm/aol_policy.h
@@ -48,7 +48,7 @@ inline bool gm_aol_param(uint16_t param) {
     case 0x4207U: case 0x4607U: case 0x4A07U: case 0x4E07U:
     case 0x4287U: case 0x4687U: case 0x4A87U: case 0x4E87U: case 0x4087U:
     case 0x4004U: case 0xC004U: case 0x4084U: case 0xC084U: case 0x4007U:
-    case 16U: case 0xC160U: case 0xC161U: case 0xC162U: case 0xC180U: case 0xC181U:
+    case 16U: case 0xC160U: case 0xC161U: case 0xC162U: case 0xC163U: case 0xC180U: case 0xC181U:
     case 0xC182U: case 0xC183U: case 0xC184U: case 0xC185U: case 0xC186U: case 0xC187U: case 0xC170U:
     case 0x1001U: case 0x1401U: case 0x3001U: case 0x3401U:
     case 0x1003U: case 0x1403U:
diff --git a/prebuilt.json b/prebuilt.json
index 19517a80a6..cc6a1282b4 100644
--- a/prebuilt.json
+++ b/prebuilt.json
@@ -1 +1 @@
-{"protected_inventory_sha256": "c5226e96a5fac82509846a227a852fd35d6561d3d181aca77665c9b7a11d6552", "schema_version": 1}
+{"protected_inventory_sha256": "fd87cd5ed34840cfecffedb8d655b20ed2e800516419170e4684ee8dbef761cb", "schema_version": 1}