diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index f1c25e8969..8b3218484c 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -14,3 +14,10 @@
 # Since version 2, it tries to write liblto symlinks with absolute paths that
 # don't work when building for the board root directories.
 >=sys-devel/gcc-config-2
+
+# Overwrite portage-stable mask. We are delaying the transition to
+# libxcrypt, because we need to figure out how to solve the dep loop
+# that results from the migration (python -> virtual/libcrypt ->
+# libxcrypt -> glibc -> python), and also we need to update gcc to
+# version 10 or later.
+>=virtual/libcrypt-2
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
index dad5cf17a4..dbf41a9f24 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
@@ -5,3 +5,10 @@
 # gentoo. We still need it, since sys-libs/libsemanage still requires
 # it. When we update selinux, this can be dropped.
 =dev-libs/ustr-1.0.4-r8
+
+# Overwrite portage-stable mask. We are delaying the transition to
+# libxcrypt, because we need to figure out how to solve the dep loop
+# that results from the migration (python -> virtual/libcrypt ->
+# libxcrypt -> glibc -> python), and also we need to update gcc to
+# version 10 or later.
+=virtual/libcrypt-1-r1
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
index a98fc7ad28..66df6be1ce 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
@@ -19,3 +19,10 @@ sys-libs/ncurses cxx
 # To fix that, exclude the unicode USE flag from packages.use.force list,
 # which is defined in portage-stable.
 app-editors/nano unicode
+
+# Overwrite portage-stable mask. We are delaying the transition to
+# libxcrypt, because we need to figure out how to solve the dep loop
+# that results from the migration (python -> virtual/libcrypt ->
+# libxcrypt -> glibc -> python), and also we need to update gcc to
+# version 10 or later.
+sys-libs/glibc -crypt