diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
index 736735cf52..ffe1d3d0bb 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@@ -155,3 +155,6 @@ dev-libs/libpcre2 -pcre16 unicode
 # enabled by upstream. Samba was enabled to make some tests pass. But
 # smi and ssl, no clue.
 net-analyzer/tcpdump -ssl -smi -samba
+
+# selinux: to find files with a particular SElinux label
+sys-apps/findutils selinux
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
index f4727dfd6d..32560af516 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
@@ -9,7 +9,7 @@ CROS_WORKON_REPO="https://github.com"
 if [[ "${PV}" == 9999 ]]; then
 	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
 else
-	CROS_WORKON_COMMIT="b2a203ff5d0c6b929b1c51a40457fbbe0c696893" # flatcar-master
+	CROS_WORKON_COMMIT="ef610cfd99190ba33b5f6b27eb66dddc299ee332" # flatcar-master
 	KEYWORDS="amd64 arm arm64 x86"
 fi