diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided
index cc2bfc4458..3f7ffe0eb2 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided
@@ -10,3 +10,7 @@ sys-fs/udev-init-scripts-35
 # A dependency of dev-libs/libtracefs. It's apparently for docs, that
 # we don't even include anywhere.
 dev-util/source-highlight-3.1.9-r2
+
+# Pulled in by bpftool[-clang], We never provided co-re in bpftool and
+# for now continue to do so.
+sys-devel/bpf-toolchain-14.2.0_p1
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
index ba6b95c172..0e3644833e 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
@@ -25,8 +25,3 @@ sys-fs/btrfs-progs man
 # put anywhere. Thus avoid pulling more dependencies than necessary
 # for throw-away things.
 dev-python/pillow jpeg
-
-# bpftool ebuild started to bdepend on sys-devel/clang unconditionally
-# in order to build co-re support. We can try avoiding it by masking
-# the USE flag that currently gets enabled by default.
-dev-util/bpftool llvm_slot_18
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
index 742eca0fb2..762a97f8b8 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
@@ -50,3 +50,10 @@ sys-fs/fuse -suid
 
 # skip dependency for this sysext package
 net-misc/chrony -readline
+
+# Do not pull llvm into prod (use binutils-libs instead).
+#
+# Disable co-re (we never had it enabled, but now it's forced by the
+# ebuild; this will pull sys-devel/bpf-toolchain, which we put into
+# package.provided in SDK).
+dev-util/bpftool -llvm -clang