diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/changes/2022-03-17-enable-systemd-sysext.md b/sdk_container/src/third_party/coreos-overlay/changelog/changes/2022-03-17-enable-systemd-sysext.md
new file mode 100644
index 0000000000..21bc62fe38
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/changelog/changes/2022-03-17-enable-systemd-sysext.md
@@ -0,0 +1 @@
+- Enabled `systemd-sysext.service` to activate systemd-sysext images on boot, to disable you will need to mask it. Also added a helper service `ensure-sysext.service` which reloads the systemd units to reevaluate the `sockets`, `timers`, and `multi-user` targets when `systemd-sysext.service` is (re)started, making it possible to enable units that are part of a sysext image ([PR#65](https://github.com/flatcar-linux/init/pull/65))
diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/changes/2022-03-17-lib-and-lib64-split.md b/sdk_container/src/third_party/coreos-overlay/changelog/changes/2022-03-17-lib-and-lib64-split.md
new file mode 100644
index 0000000000..d09e951e60
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/changelog/changes/2022-03-17-lib-and-lib64-split.md
@@ -0,0 +1 @@
+- For amd64 `/usr/lib` used to be a symlink to `/usr/lib64` but now they became two separate folders as common in other distributions (and was the case for arm64 already). Compatibility symlinks exist in case `/usr/lib64` was used to access, e.g., the `modules` folder or the `systemd` folder ([PR#1713](https://github.com/flatcar-linux/coreos-overlay/pull/1713), [PR#255](https://github.com/flatcar-linux/scripts/pull/255))
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-9999.ebuild
index 6dcd0d1232..dc09f9b3d2 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-9999.ebuild
@@ -10,7 +10,7 @@ CROS_WORKON_REPO="https://github.com"
 if [[ "${PV}" == 9999 ]]; then
 	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
 else
-	CROS_WORKON_COMMIT="2231de798a7393dd8e864ff2ee5409484a81c1d3" # flatcar-master
+	CROS_WORKON_COMMIT="a22b550c7cf689661970a2a23dd457870dd84c97" # flatcar-master
 	KEYWORDS="amd64 arm arm64 x86"
 fi
 
@@ -52,4 +52,11 @@ src_install() {
 
 	# Enable some services that aren't enabled elsewhere.
 	systemd_enable_service rpcbind.target rpcbind.service
+
+	# Create compatibility symlinks in case /usr/lib64/ instead of /usr/lib/ was used
+	local compat
+	# os-release symlink is set up in scripts
+	for compat in modules systemd flatcar coreos kernel modprobe.d pam pam.d sysctl.d udev ; do
+		dosym "../lib/${compat}" "/usr/lib64/${compat}"
+	done
 }
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-oem-gce/files/manglefs.sh b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-oem-gce/files/manglefs.sh
index 82d80c3922..ac499577bb 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-oem-gce/files/manglefs.sh
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-oem-gce/files/manglefs.sh
@@ -50,5 +50,5 @@ session optional pam_permit.so
 EOF
 
 # Don't bundle these paths, since they are useless to us.
-mv usr/lib64/systemd/lib*.so* usr/lib64/
-rm -fr boot etc/* usr/lib64/systemd var/db/pkg
+mv usr/lib/systemd/lib*.so* usr/lib64/
+rm -fr boot etc/* usr/lib/systemd var/db/pkg
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/make.defaults
index 395339442f..c3e0e2f642 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/make.defaults
@@ -98,3 +98,6 @@ ACCT_USER_SYSTEMD_RESOLVE_ID=245
 # tss seems to be one of those users with a mismatching UID/GID
 ACCT_GROUP_TSS_ID=252
 ACCT_USER_TSS_ID=236
+
+# Disable creation of /usr/lib as symlink
+SYMLINK_LIB="no"
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
index ff50a0d91e..70574b6e64 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
@@ -102,7 +102,7 @@ src_compile() {
 		local tmpfiles="${T}/baselayout-usr.conf"
 		echo -n > ${tmpfiles} || die
 		for sym in "${!USR_SYMS[@]}" ; do
-			echo "L	${sym}	-	-	-	-	${USR_SYMS[$sym]}" >> ${tmpfiles}
+			echo "L+	${sym}	-	-	-	-	${USR_SYMS[$sym]}" >> ${tmpfiles}
 		done
 	fi
 }
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-250.3.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-250.3.ebuild
index 7b89a3d0a8..a1a32828b0 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-250.3.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-250.3.ebuild
@@ -563,6 +563,9 @@ multilib_src_install_all() {
 	# Flatcar: enable reboot.target (not enabled - has no WantedBy
 	# entry)
 
+	# Flatcar: enable systemd-sysext.service by default
+	builddir_systemd_enable_service sysinit.target systemd-sysext.service
+
 	# Flatcar: Use an empty preset file, because systemctl
 	# preset-all puts symlinks in /etc, not in /usr. We don't use
 	# /etc, because it is not autoupdated. We do the "preset" above.