diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
index 7fa69a8ee4..36c9779cc0 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
@@ -18,12 +18,13 @@ LUA_SINGLE_TARGET="lua5-3"
 LUA_TARGETS="lua5-3"
 
 # Use Python 3 as the default version
-USE="${USE} -python_single_target_python2_7 python_single_target_python3_10"
-USE="${USE} -python_targets_python2_7 python_targets_python3_10"
+USE="${USE} -python_single_target_python2_7 python_single_target_python3_11"
+USE="${USE} -python_targets_python2_7 python_targets_python3_11"
 
 # Use Python 3 as the default version
-BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_single_target_python2_7 python_single_target_python3_10"
-BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_targets_python2_7 python_targets_python3_10"
+BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_single_target_python2_7 python_single_target_python3_11"
+BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_targets_python2_7 python_targets_python3_11"
+
 
 # Never install cron or cron jobs
 USE="${USE} -cron"
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index 04124822ce..97238158c1 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -17,6 +17,6 @@
 # libxcrypt -> glibc -> python).
 >=virtual/libcrypt-2
 
-# Python 3.11 is stable in portage-stable, so avoid picking it
+# Python 3.12 is in portage-stable (currently testing), so avoid picking it
 # up. Update this to mask later versions when we switch to 3.11.
->=dev-lang/python-3.11
+>=dev-lang/python-3.12
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
index 56ea60f1a8..51a4c4441a 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
@@ -1,15 +1,17 @@
 # Never enable experimental code
 kdbus
 
-# We default to python 3.10 for now
+# We default to python 3.11 for now
 python_targets_python2_7
 python_single_target_python2_7
 python_targets_python3_8
 python_single_target_python3_8
 python_targets_python3_9
 python_single_target_python3_9
-python_targets_python3_11
-python_single_target_python3_11
+python_targets_python3_10
+python_single_target_python3_10
+python_targets_python3_12
+python_single_target_python3_12
 
 # Unmask selinux so it can be enabled selectively in package.use
 -selinux