diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest
index b97a3ee09e..fd29924ccb 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest
@@ -1 +1 @@
-DIST wa-linux-agent-2.2.25.tar.gz 780315 SHA256 cc6451b92f65e9702b5bf7d21cf6224cf0f595de55a18776063bb3bcd559f798 SHA512 cd38f399baa1a9d60d88d9bc98ac458e153c1331877d2bc5a25f782a1dae22a0ceb8d8d07922716d663dca34e81eab923644019119adf47a0f086467f576b187 WHIRLPOOL 12d56a62760c1f4ab3173fc71a53e4aac75cc7c0e35bd82e25aba11f348230e7174bc81d81ae0279e23e471d6d8eb2b84b734069afff7f12acb30bb65d3dcd9c
+DIST wa-linux-agent-2.2.32.tar.gz 792114 BLAKE2B 9f708194707dd65c194dbee7e75712df44e509b35ed5636f0ee09b39e6ef5e4b80a1373b583dbf9ed460b1430b1ac7b7db4151844e484ca6a8a81fb78d6b06ba SHA512 e3f51b07172a9e0ec232f37b1ab2e06c0187ce66df53e0a118c33a00d074107d27a375f78c0a55942c92bf331e1a5f18c4dd10bb90a5d4191a33a34c15472b58
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf
index c50cfad91b..3d65d06b50 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf
@@ -5,6 +5,10 @@
 # Enable instance creation
 Provisioning.Enabled=y
 
+# Enable extension handling. Do not disable this unless you do not need password reset,
+# backup, monitoring, or any extension handling whatsoever.
+Extensions.Enabled=y
+
 # Rely on cloud-init to provision
 Provisioning.UseCloudInit=n
 
@@ -114,6 +118,10 @@ OS.SshDir=/etc/ssh
 # OS.AllowHTTP=n
 
 # Add firewall rules to protect access to Azure host node services
-# Note:
-# - The default is false to protect the state of existing VMs
 OS.EnableFirewall=y
+
+# Enforce control groups limits on the agent and extensions
+CGroups.EnforceLimits=n
+
+# CGroups which are excluded from limits, comma separated
+CGroups.Excluded=customscript,runcommand
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.25.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.32.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.25.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.32.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.25.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.32.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.25.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.32.ebuild