diff --git a/documentation/modules/ROOT/pages/lab-setup.adoc b/documentation/modules/ROOT/pages/lab-setup.adoc
index b25da36..e1ee03f 100644
--- a/documentation/modules/ROOT/pages/lab-setup.adoc
+++ b/documentation/modules/ROOT/pages/lab-setup.adoc
@@ -82,8 +82,9 @@ curl -sL https://raw.githubusercontent.com/RHsyseng/hypershift-baremetal-lab/{br
 curl -sL https://raw.githubusercontent.com/RHsyseng/hypershift-baremetal-lab/{branch}/lab-materials/lab-env-data/dnsmasq/infrastructure-host.ipv4 -o /opt/dnsmasq/include.d/infrastructure-host.ipv4
 curl -sL https://raw.githubusercontent.com/RHsyseng/hypershift-baremetal-lab/{branch}/lab-materials/lab-env-data/dnsmasq/dnsmasq-virt.service -o /etc/systemd/system/dnsmasq-virt.service
 touch /opt/dnsmasq/hosts.leases
-semanage fcontext -a -t dnsmasq_lease_t /opt/dnsmasq/hosts.leases
-restorecon /opt/dnsmasq/hosts.leases
+semanage fcontext -a -t dnsmasq_etc_t '/opt/dnsmasq(/.*)?'         # semanage commands order is important
+semanage fcontext -a -t dnsmasq_lease_t /opt/dnsmasq/hosts.leases  # senabage commands order is important
+restorecon -vr /opt/dnsmasq/
 sed -i "s/UPSTREAM_DNS/1.1.1.1/" /opt/dnsmasq/upstream-resolv.conf
 systemctl daemon-reload
 systemctl enable dnsmasq-virt --now
@@ -263,4 +264,4 @@ Finally, remove the kubeadmin user:
 [source,bash,subs="attributes+,+macros"]
 -----
 oc -n kube-system delete secret kubeadmin
------
\ No newline at end of file
+-----