diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest
index aeaf2d0daa..b97a3ee09e 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest
@@ -1 +1 @@
-DIST wa-linux-agent-2.2.4.tar.gz 621451 SHA256 ff6c25df41a5e159488182272670b3678bdd1611228c866766ea31b05a8a8195 SHA512 637fc40c5e40e311a528ec29761744f12250345a090509dbfcdd523072410881b8969da69c3eee2a2208bd139309babb039651d25b3de5a280427c1aedbf8546 WHIRLPOOL 71e13040172e9b62e5f3f6157427fa81263a2b23e49c8c851efe8e58bb9ac07f27fa08b91926c356323fee92d1eacaf387c6aefd07d4c22a1d89a24577d4f86d
+DIST wa-linux-agent-2.2.25.tar.gz 780315 SHA256 cc6451b92f65e9702b5bf7d21cf6224cf0f595de55a18776063bb3bcd559f798 SHA512 cd38f399baa1a9d60d88d9bc98ac458e153c1331877d2bc5a25f782a1dae22a0ceb8d8d07922716d663dca34e81eab923644019119adf47a0f086467f576b187 WHIRLPOOL 12d56a62760c1f4ab3173fc71a53e4aac75cc7c0e35bd82e25aba11f348230e7174bc81d81ae0279e23e471d6d8eb2b84b734069afff7f12acb30bb65d3dcd9c
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf
index 6d050240eb..c50cfad91b 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf
@@ -2,28 +2,21 @@
 # Microsoft Azure Linux Agent Configuration
 #
 
-# Specified program is invoked with the argument "Ready" when we report ready status
-# to the endpoint server.
-Role.StateConsumer=None
-
-# Specified program is invoked with XML file argument specifying role
-#  configuration.
-Role.ConfigurationConsumer=None
-
-# Specified program is invoked with XML file argument specifying role topology.
-Role.TopologyConsumer=None
-
 # Enable instance creation
 Provisioning.Enabled=y
 
+# Rely on cloud-init to provision
+Provisioning.UseCloudInit=n
+
 # Password authentication for root account will be unavailable.
 Provisioning.DeleteRootPassword=n
 
 # Generate fresh host key pair.
 Provisioning.RegenerateSshHostKeyPair=n
 
-# Supported values are "rsa", "dsa" and "ecdsa".
-Provisioning.SshHostKeyPairType=ed25519
+# Supported values are "rsa", "dsa", "ecdsa", "ed25519", and "auto".
+# The "auto" option is supported on OpenSSH 5.9 (2011) and later.
+Provisioning.SshHostKeyPairType=auto
 
 # Monitor host name changes and publish changes via DHCP requests.
 Provisioning.MonitorHostName=y
@@ -59,18 +52,27 @@ ResourceDisk.EnableSwap=n
 # Size of the swapfile.
 ResourceDisk.SwapSizeMB=0
 
-# Respond to load balancer probes if requested by Windows Azure.
-LBProbeResponder=y
+# Comma-seperated list of mount options. See man(8) for valid options.
+ResourceDisk.MountOptions=None
 
 # Enable verbose logging (y|n)
 Logs.Verbose=n
 
+# Is FIPS enabled
+OS.EnableFIPS=n
+
 # Root device timeout in seconds.
 OS.RootDeviceScsiTimeout=300
 
 # If "None", the system default version is used.
 OS.OpensslPath=None
 
+# Set the SSH ClientAliveInterval
+# OS.SshClientAliveInterval=180
+
+# Set the path to SSH keys and configuration files
+OS.SshDir=/etc/ssh
+
 # If set, agent will use proxy server to access internet
 #HttpProxy.Host=None
 #HttpProxy.Port=None
@@ -92,3 +94,26 @@ OS.OpensslPath=None
 
 #
 # Home.Dir=/home
+
+# Enable RDMA management and set up, should only be used in HPC images
+# OS.EnableRDMA=y
+
+# Enable or disable goal state processing auto-update, default is enabled
+# AutoUpdate.Enabled=y
+
+# Determine the update family, this should not be changed
+# AutoUpdate.GAFamily=Prod
+
+# Determine if the overprovisioning feature is enabled. If yes, hold extension
+# handling until inVMArtifactsProfile.OnHold is false.
+# Default is enabled
+# EnableOverProvisioning=y
+
+# Allow fallback to HTTP if HTTPS is unavailable
+# Note: Allowing HTTP (vs. HTTPS) may cause security risks
+# OS.AllowHTTP=n
+
+# Add firewall rules to protect access to Azure host node services
+# Note:
+# - The default is false to protect the state of existing VMs
+OS.EnableFirewall=y
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.4.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.25.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.4.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.25.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.4-r4.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.25.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.4-r4.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.25.ebuild