diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
index 03e2f4588b..8794385f7d 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
@@ -31,6 +31,7 @@
 =net-misc/bridge-utils-1.5 ~arm64
 =net-misc/curl-7.55.1 ~arm64
 =net-misc/iperf-3.1.3 **
+=net-misc/socat-1.7.3.2 ~arm64
 =net-nds/openldap-2.4.44 ~arm64
 =perl-core/File-Path-2.130.0 ~arm64
 =sys-apps/gptfdisk-1.0.1 ~arm64
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
index 064cd58fe7..0599628c3a 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@@ -99,3 +99,7 @@ sys-process/lsof rpc selinux
 # Don't include etcd2's etcdctl so we can include the newer version via the
 # etcdctl package
 dev-db/etcd -etcdctl
+
+# can be removed with socat-2.0.0; this is the openssl/readline license
+# incompatibility 
+net-misc/socat -ssl