diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index 5ba23e9d6c..cb68fa1aab 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -378,6 +378,7 @@ sec-policy/selinux-unconfined
 
 sys-apps/acl
 sys-apps/attr
+sys-apps/bubblewrap
 sys-apps/checkpolicy
 sys-apps/config-site
 sys-apps/coreutils
@@ -508,6 +509,7 @@ virtual/perl-IO
 virtual/pkgconfig
 virtual/service-manager
 virtual/ssh
+virtual/tmpfiles
 
 x11-base/xorg-proto
 
diff --git a/build_library/prefix_util.sh b/build_library/prefix_util.sh
index 62a3adbdb6..a8a7734e3c 100644
--- a/build_library/prefix_util.sh
+++ b/build_library/prefix_util.sh
@@ -30,7 +30,7 @@ function set_prefix_vars() {
       ;;
     arm64-usr)
       PREFIX_CHOST="aarch64-cros-linux-gnu"
-      PREFIX_KEYWORDS="arm64 -~arm64 -multilib"
+      PREFIX_KEYWORDS="arm64 -~arm64"
       ;;
   esac
 
@@ -168,47 +168,50 @@ STAGINGROOT=${STAGINGROOT@Q}
 FINALROOT=${FINALROOT@Q}
 CB_ROOT=${CB_ROOT@Q}
 
-if [ "\${1}" = "--help" ] ; then
-    echo "\$0 : emerge prefix wrapper for prefix '\${PREFIXNAME}'"
+EOF
+
+  sudo_append "${filename}" <<'EOF'
+if [ "${1}" = "--help" ] ; then
+    echo "$0 : emerge prefix wrapper for prefix '${PREFIXNAME}'"
     echo "Usage:"
-    echo "  \$0 [--install|--stage] <emerge-opts>"
+    echo "  $0 [--install|--stage] <emerge-opts>"
     echo "                          Builds packages in prefix' staging and installs w/ runtime dependencies"
     echo "                           to prefix' final root."
     echo "             --stage      Build binpkg in staging but don't install."
     echo "             --install    Skip build, just install. Binpkg must exist in staging."
     echo
     echo "      Prefix configuration:"
-    echo "        PREFIXNAME=\${PREFIXNAME@Q}"
-    echo "        EPREFIX=\${EPREFIX@Q}"
-    echo "        STAGINGROOT=\${STAGINGROOT@Q}"
-    echo "        FINALROOT=\${FINALROOT@Q}"
-    echo "        CB_ROOT=\${CB_ROOT@Q}"
+    echo "        PREFIXNAME=${PREFIXNAME@Q}"
+    echo "        EPREFIX=${EPREFIX@Q}"
+    echo "        STAGINGROOT=${STAGINGROOT@Q}"
+    echo "        FINALROOT=${FINALROOT@Q}"
+    echo "        CB_ROOT=${CB_ROOT@Q}"
     exit
 fi
 
 skip_build="false"
 skip_install="false"
 
-case "\${1}" in
+case "${1}" in
     --install) skip_build="true"; shift;;
     --stage) skip_install="true"; shift;;
 esac
 
-if [ "\${skip_build}" = "true" ]  ; then
+if [ "${skip_build}" = "true" ]  ; then
     echo "Skipping build into staging as requested."
     echo "NOTE that install into final will fail if binpkgs are missing."
 else
     echo "Building in staging..."
-    sudo -E EPREFIX="\${EPREFIX}" "\${CB_ROOT}/bin/cb-emerge" "\${STAGINGROOT}" "\$@"
+    sudo -E EPREFIX="${EPREFIX}" "${CB_ROOT}/bin/cb-emerge" "${STAGINGROOT}" "$@"
 fi
 
-if [ "\${skip_install}" = "true" ]  ; then
+if [ "${skip_install}" = "true" ]  ; then
     echo "Skipping install into final as requested."
 else
     echo "Installing..."
-    sudo -E EPREFIX="\${EPREFIX}" \\
-            ROOT="\${FINALROOT}" \\
-            PORTAGE_CONFIGROOT="\${FINALROOT}\${EPREFIX}" emerge "\$@"
+    sudo -E EPREFIX="${EPREFIX}" \
+            ROOT="${FINALROOT}" \
+            PORTAGE_CONFIGROOT="${FINALROOT}${EPREFIX}" emerge "$@"
 fi
 EOF
 
diff --git a/sdk_container/src/third_party/prefix-overlay/dev-libs/libgpg-error/libgpg-error-1.47.ebuild b/sdk_container/src/third_party/prefix-overlay/dev-libs/libgpg-error/libgpg-error-1.47.ebuild
index 7be04a4f10..69878152eb 100644
--- a/sdk_container/src/third_party/prefix-overlay/dev-libs/libgpg-error/libgpg-error-1.47.ebuild
+++ b/sdk_container/src/third_party/prefix-overlay/dev-libs/libgpg-error/libgpg-error-1.47.ebuild
@@ -55,16 +55,9 @@ src_prepare() {
 	# only necessary for as long as we run eautoreconf, configure.ac
 	# uses ./autogen.sh to generate PACKAGE_VERSION, but autogen.sh is
 	# not a pure /bin/sh script, so it fails on some hosts
-	# Flatcar / t-lo 2023-09-19: Use build root for hprefixify to
-	#  prevent issues with prefix and cross-compiling, which causes
-	#  VERSION to be emptied when eautoreconf runs. This, in turn, will break
-	#  compilation with:
-	#     usage: mkhe:ader host_triplet template.h config.h version version_number
-	if tc-is-cross-compiler ; then
-		hprefixify -e "s#${EPREFIX}#${BROOT}#" -w 1 autogen.sh
-	else
-		hprefixify -w 1 autogen.sh
-	fi
+	# Flatcar / t-lo 2023-09-27: pull in upstream fix https://github.com/gentoo/gentoo/pull/33010
+    #  for prefix builds.
+    sed -i -e "1s:.*:#\!${BASH}:" autogen.sh || die
 	eautoreconf
 }