diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
index 9c9902f00b..cbf3bd6b3c 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
@@ -34,6 +34,10 @@
 # needed to force enable ipvsadm for arm64
 =sys-cluster/ipvsadm-1.27-r1 **
 
+# needed to enable gcc 11.3.1_p20230120-r1 for arm64, a required version
+# for fixing build issues in glibc with gcc, w.r.t USE flag cet.
+=sys-devel/gcc-11.3.1_p20230120-r1 ~arm64
+
 =sys-firmware/edk2-aarch64-18.02 **
 =sys-fs/btrfs-progs-4.19.1 ~arm64
 =sys-libs/libselinux-3.1-r2 ~arm64
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index 68d088c019..783cb56b97 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -22,7 +22,7 @@
 # up. Drop this when we switch to it.
 >=dev-lang/python-3.10
 
-# sys-devel/gcc-11.3.1_p20221209 is the latest gcc version that is
-# stable on both amd64 and arm64. There are newer versions of gcc
-# which are stable only on one of them, so mask them.
->sys-devel/gcc-11.3.1_p20221209
+# sys-devel/gcc-11.3.1_p20230120-r1 is the latest stable gcc version
+# that fixes the CET build issue of glibc. There are newer versions of
+# gcc that are not tested enough for CET, so mask them.
+>sys-devel/gcc-11.3.1_p20230120-r1