diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
index 1e5dd5d5b6..2b71e249dc 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
@@ -16,3 +16,7 @@
 # Overwrite portage-stable mask. OpenSSL-3* is building fine on Flatcar
 # and Flatcar's dependencies are building fine against it.
 =dev-libs/openssl-3.0*
+
+# Overwrite portage-stable mask - we want to use this version of git
+# for security fixes.
+=dev-vcs/git-2.35.3
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
index 1eb377ad12..2d051ed4c3 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@@ -19,7 +19,7 @@ sys-apps/gptfdisk -icu
 # for profile migration
 sys-libs/gdbm berkdb
 
-dev-vcs/git -pcre-jit -perl -iconv
+dev-vcs/git -perl -iconv
 
 net-analyzer/nmap ncat -system-lua
 
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
index 66df6be1ce..e96fa19be4 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
@@ -1,9 +1,6 @@
 # We don't ship GnuTLS by default, and smartcard has a dep loop
 app-crypt/gnupg smartcard ssl
 
-# We don't need integration with cvs, perl, or subversion in git, so we can
-dev-vcs/git cvs perl subversion
-
 # not needed, requires dev-lang/python-exec
 sys-apps/util-linux python