diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo
index 89bd428736..3bd9e65f86 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo
@@ -1,9 +1,12 @@
-cros_post_src_install_keep_etc_sudoers_d() {
-    # Flatcar: Build system installs /etc/sudoers.d, let's make
-    # sure we keep having it.
+cros_post_src_install_flatcar_modifications() {
+    # Build system installs /etc/sudoers.d, let's make sure we keep
+    # having it.
     #
     # Upstream PR: https://github.com/gentoo/gentoo/pull/37397
     keepdir /etc/sudoers.d
+
+    # Move pam files to /usr.
+    vendorize_pam_files
 }
 
 # We don't ship OpenLDAP schemas (why?) and we provide sudo.conf
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-emulation/open-vm-tools b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-emulation/open-vm-tools
new file mode 100644
index 0000000000..36c7a9887d
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-emulation/open-vm-tools
@@ -0,0 +1,3 @@
+cros_post_src_install_vendorize_pam() {
+    vendorize_pam_files
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/cyrus-sasl b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/cyrus-sasl
index f730ae0878..ca25efa7fb 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/cyrus-sasl
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/cyrus-sasl
@@ -3,3 +3,7 @@
 # obviously won't work in case of cross-compilation, so we state up
 # front that SPNEGO is supported.
 export ac_cv_gssapi_supports_spnego=yes
+
+cros_post_src_install_vendorize_pam() {
+    vendorize_pam_files
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/libpwquality b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/libpwquality
new file mode 100644
index 0000000000..36c7a9887d
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/libpwquality
@@ -0,0 +1,3 @@
+cros_post_src_install_vendorize_pam() {
+    vendorize_pam_files
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/samba b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/samba
index dda472eea0..96510ff3dc 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/samba
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/samba
@@ -31,4 +31,7 @@ cros_post_src_install_samba_flatcar_modifications() {
     rm -rf "${ED}/usr/$(get_libdir)/perl"*
     rm -rf "${ED}/usr/$(get_libdir)/python"*
     rm -rf "${ED}/var"
+
+    # Move pam files to /usr.
+    vendorize_pam_files
 }
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
index 3a8ef725d0..77a32cfa39 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
@@ -8,3 +8,7 @@ if [[ $(flatcar_target) != 'sdk' ]] ; then
 	INSTALL_MASK+="${openssh_mask}"
 	unset openssh_mask
 fi
+
+cros_post_src_install_vendorize_pam() {
+    vendorize_pam_files
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/kbd b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/kbd
new file mode 100644
index 0000000000..36c7a9887d
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/kbd
@@ -0,0 +1,3 @@
+cros_post_src_install_vendorize_pam() {
+    vendorize_pam_files
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
index 756358188e..8b6c1ef2cd 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
@@ -14,3 +14,7 @@ cros_post_src_install_set_up_var_lib_selinux() {
     mv "${ED}/var/lib/selinux" "${ED}/usr/lib/selinux/policy"
     dosym -r /usr/lib/selinux/policy /var/lib/selinux
 }
+
+cros_post_src_install_vendorize_pam() {
+    vendorize_pam_files
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/shadow b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/shadow
index f3da0f6627..4d362da703 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/shadow
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/shadow
@@ -72,4 +72,7 @@ ttyS0
 
 ${devs}
 EOF
+
+    # Move pam files to /usr.
+    vendorize_pam_files
 }
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/util-linux b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/util-linux
index d7da140d7a..4afa621f87 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/util-linux
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/util-linux
@@ -1,3 +1,7 @@
 # New mount API does not work very well for mounting overlayfs when we
 # are building sysexts.
 export EXTRA_ECONF="--disable-libmount-mountfd-support"
+
+cros_post_src_install_vendorize_pam() {
+    vendorize_pam_files
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-auth/pambase b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-auth/pambase
new file mode 100644
index 0000000000..36c7a9887d
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-auth/pambase
@@ -0,0 +1,3 @@
+cros_post_src_install_vendorize_pam() {
+    vendorize_pam_files
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-auth/sssd b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-auth/sssd
index 6477bc4921..c2b8bd82df 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-auth/sssd
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-auth/sssd
@@ -2,14 +2,10 @@
 # plugin, even if sssd is not running.
 export EXTRA_ECONF="--enable-sss-default-nss-plugin"
 
-# We haven't switched to having pam config in /etc, so move the files
-# to /usr.
-cros_post_src_install_move_pamd() {
-	mkdir -p "${ED}/usr/share/"
-	mv "${ED}/etc/pam.d" "${ED}/usr/share/pam.d"
-}
+cros_post_src_install_flatcar_modifications() {
+    # This is to make sure that some sssd config is always in place.
+    cp -a "${ED}"/etc/sssd/sssd{-example,}.conf
 
-# This is to make sure that some sssd config is always in place.
-cros_post_src_set_initial_config() {
-	cp -a "${ED}"/etc/sssd/sssd{-example,}.conf
+    # Move pam files to /usr.
+    vendorize_pam_files
 }
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libcap b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libcap
new file mode 100644
index 0000000000..36c7a9887d
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libcap
@@ -0,0 +1,3 @@
+cros_post_src_install_vendorize_pam() {
+    vendorize_pam_files
+}